☰

Nginx 拒绝连接 443 端口

tag-icon • tag-icon nginx ssl firewall lets-encrypt gunicorn
Nginx 拒绝连接 443 端口

因此，我尝试让 Nginx 通过 https 为我的网站提供服务，但它一直显示拒绝连接错误。

因此，输出结果如下：

  1. 卷曲https://juristnet.ro（这是网站）

    curl: (7) Failed to connect to juristnet.ro port 443: Connection refused

  2. 网络状态监测

    tcp        0      0 0.0.0.0:80              0.0.0.0:*                  LISTEN      -               
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -               
tcp        0      0 127.0.0.1:5432          0.0.0.0:*               LISTEN      -               
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      -               
tcp        0      0 0.0.0.0:3306            0.0.0.0:*               LISTEN      -               
tcp        0      0 46.101.111.197:80       66.249.64.215:60905     TIME_WAIT   -               
tcp        0      0 46.101.111.197:80       66.249.64.211:57434     ESTABLISHED -               
tcp        0      0 46.101.111.197:22       82.208.159.43:26902         ESTABLISHED -               
tcp        0    476 46.101.111.197:22       82.208.159.43:11648     ESTABLISHED -               
tcp        0      0 46.101.111.197:22       223.99.60.37:16862      ESTABLISHED -               
tcp6       0      0 :::8080                 :::*                      LISTEN      -               
tcp6       0      0 :::22                   :::*                    LISTEN      -               
tcp6       0      0 :::30845                :::*                    LISTEN      -

可以看到，443 端口已经打开，Nginx 正在监听

80/tcp   open  http
443/tcp  open  https
3306/tcp open  mysql
5432/tcp open  postgresql

Nmap显示端口已开放。

UFW 处于非活动状态，因此不存在防火墙问题。它是 digitalocean 的一个 droplet，因此他们那边不存在转发问题。

  1. iptables -L

    Chain INPUT (policy ACCEPT)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
ACCEPT     tcp  --  anywhere             localhost            tcp spts:1024:65535 dpt:https state NEW,ESTABLISHED

Chain FORWARD (policy ACCEPT)
target     prot opt source               destination         
DOCKER-ISOLATION  all  --  anywhere             anywhere            
DOCKER     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
ACCEPT     all  --  anywhere             anywhere            
ACCEPT     all  --  anywhere             anywhere            

Chain OUTPUT (policy ACCEPT)
target     prot opt source               destination         

Chain DOCKER (1 references)
target     prot opt source               destination         
ACCEPT     tcp  --  anywhere             172.17.0.2           tcp dpt:http
ACCEPT     tcp  --  anywhere             172.17.0.2           tcp  dpt:https

我的Nginx.conf：

user admin root;
worker_processes auto;

error_log  /var/log/nginx/error.log debug;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;
    ssl_session_cache   shared:SSL:10m;
    ssl_session_timeout 10m;

    include /etc/nginx/conf.d/*.conf;
}

我的其他配置（用于服务器块）：

server {

listen 80;
listen 443 ssl;

server_name  juristnet.ro www.juristnet.ro;
keepalive_timeout   70;

ssl_certificate /etc/letsencrypt/live/juristnet.ro/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/juristnet.ro/privkey.pem;
ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers         HIGH:!aNULL:!MD5;

root /var/test/proiect;
client_max_body_size 10M;

location = /favicon.ico
{
    access_log off; log_not_found off;
            alias /var/test/proiect/favicon.ico;
}

location /static/
{
    autoindex on;
}

    location /assets/
{
            autoindex on;
            alias /var/test/proiect/assets/;
}

    location  ~ /.well-known/
{
            allow all;
}

location / {
    include /etc/nginx/fastcgi_params;
        proxy_set_header X-Real-IP  $remote_addr;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header Host $http_host;
        proxy_pass http://unix:/var/test/proiect/Tutorial2.sock;
        fastcgi_param   HTTPS               on;
        fastcgi_param   HTTP_SCHEME         https;


}

还有另一个子域，但我猜那不相关。

nginx 的错误日志和访问日志没有显示任何特殊内容。

证书是从 letsencrypt 获得的。如果我尝试使用
--keyfile 和 --certfile 选项将 gunicorn 绑定到 0.0.0.0:8000，它确实适用于 https，所以我猜这是一个 nginx 问题。或者也许我需要在某处添加这些设置？无论如何，我已经为此苦思冥想了两天，所以如果有人能解决这个问题，我将不胜感激。

答案1

我解决了这个问题，但这不是一个通用的解决方案。在我的例子中，Docker 干扰了 iptables 并且不允许在端口 443 上进行连接。在我从 Docker 公开端口后，它开始工作。

相关内容