☰

NGINX 反向代理上游未连接到特定端口

tag-icon • tag-icon nginx reverse-proxy
NGINX 反向代理上游未连接到特定端口

我正在尝试访问其中一个后端服务器，但出现了以下错误：

27#27：*21653 connect() 连接到上游时失败（111：连接被拒绝），客户端：84.255.55.25，服务器：premium.maltacraft.net，请求：“GET / HTTP/1.1”，上游：“http://172.28.0.3:37200/”，主机：“premium.maltacraft.net”

我有一个 docker-compose 堆栈，如下所示（为简单起见删除了一些服务）：

services:
  nginx-ingress:
    image: nginx:latest
    logging:
      driver: "json-file"
      options:
        max-size: "50m"
        max-file: "10"
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "./nginx-ingress/nginx.conf:/etc/nginx/nginx.conf:ro"
      - "./nginx-ingress/dhparam.pem:/etc/ssl/dhparam.pem:ro"
      - "./nginx-ingress/sites-available:/etc/nginx/sites-available:ro"
      - "./nginx-ingress/sites-enabled:/etc/nginx/sites-enabled:ro"
      - "./nginx-ingress/webroot:/var/www"
      - "/etc/letsencrypt:/etc/letsencrypt:ro"
    networks:
      - multicraft
      - wp_maltacraft

networks:
  multicraft:
  wp_maltacraft:

这是我的 nginx.conf 文件（非常基础）：

user  nginx;
worker_processes  auto;

error_log  /var/log/nginx/error.log notice;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;

    include /etc/nginx/sites-enabled/*.conf;
}

现在，我有两个网站连接到 Apache 服务器，一个叫 Vanilla，一个叫 Premium。Vanilla 可以正常工作，您可以在此处看到它的工作情况： https://vanilla.maltacraft.net/

但 Premium 版没有，如下所示： https://premium.maltacraft.net/

vanilla.maltacraft.net.conf：


upstream vanilla {
    server multicraft:38200;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name vanilla.maltacraft.net;
    server_tokens off;
    ssl_certificate /etc/letsencrypt/live/vanilla.maltacraft.net/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/vanilla.maltacraft.net/privkey.pem;

    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POL>

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_session_cache  builtin:1000  shared:SSL:10m;
    ssl_session_timeout  5m;
    add_header Strict-Transport-Security "max-age=63072000";
    add_header 'X-Frame-Options' 'SAMEORIGIN';
    add_header 'X-XSS-Protection' '1; mode=block';
    add_header 'X-Content-Type-Options' 'nosniff';
    add_header 'Referrer-Policy' 'no-referrer';
    ssl_dhparam /etc/ssl/dhparam.pem;

    location / {
        proxy_read_timeout 3600;
        proxy_pass http://vanilla;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Ssl on;
    }
}

premium.maltacraft.net.conf：


upstream premium {
    server multicraft:37200;
}

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name premium.maltacraft.net;
    server_tokens off;
    ssl_certificate /etc/letsencrypt/live/premium.maltacraft.net/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/premium.maltacraft.net/privkey.pem;

    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POL>

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
    ssl_session_cache  builtin:1000  shared:SSL:10m;
    ssl_session_timeout  5m;
    add_header Strict-Transport-Security "max-age=63072000";
    add_header 'X-Frame-Options' 'SAMEORIGIN';
    add_header 'X-XSS-Protection' '1; mode=block';
    add_header 'X-Content-Type-Options' 'nosniff';
    add_header 'Referrer-Policy' 'no-referrer';
    ssl_dhparam /etc/ssl/dhparam.pem;

    location / {
        proxy_read_timeout 3600;
        proxy_pass http://premium;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Ssl on;
    }
}

如果我将 Premium 的上游端口 (37200) 更改为 Vanilla 的上游端口 (38200)，它就可以正常工作，并显示 Vanilla 的网站。但我希望它显示 Premium 网站。

两个网站的 SSL 证书均已生成并正常运行，并且两个网站的符号链接也已生成（因为它们在sites-enabled文件夹中都具有相同的配置）

知道该怎么做才能解决这个问题吗？或者调试一下

答案1

问题在于后端服务器尝试监听 localhost (127.0.0.1) 而不是 0.0.0.0。修改后即可正常工作

相关内容