连接到新配置的SSL站点时遇到一个非常奇怪的问题。这是托管在Amazon lightail上的Ubuntu VPS。
我有为80和443端口提供服务的docker容器，如您所见：
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
ce7114e8383a nginx:alpine "nginx -g 'daemon of…" 43 minutes ago Up 7 minutes 0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp app_nginx_1
ffe588588a67 registry.gitlab.com/richardvanbergen/richardvanbergen-personal-website:latest "/bin/sh -c 'npm run…" 43 minutes ago Up 7 minutes 0.0.0.0:9000->9000/tcp app_web_1
从服务器内部，我可以向该容器发出curl请求，并在SSL上获得正确的响应。我在端口80上得到了相同的响应。
ubuntu@ip-172-26-13-199:~$ curl -k https://0.0.0.0:443
<!DOCTYPE html><html lang="en"><head><meta charSet="utf-8"/><meta http-equiv="x-ua-compatible" content="ie=edge"/>
... // rest of served HTML
我只是为了排除防火墙而完全禁用了防火墙。
ubuntu:~$ sudo ufw disable
Firewall stopped and disabled on system startup
ubuntu:~$ sudo ufw status
Status: inactive
但从外面我只能访问https://www.richardvanbergen.com/
这是我到目前为止的nginx默认配置。这是另一个Docker映像的反向代理。
upstream node-app {
server web:9000;
}
server {
listen 80;
listen 443 ssl;
server_name www.richardvanbergen.com;
ssl_certificate /certbot/live/www.richardvanbergen.com/fullchain.pem;
ssl_certificate_key /certbot/live/www.richardvanbergen.com/privkey.pem;
location / {
proxy_pass http://node-app;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $server_name;
}
}
这是其他默认的nginx配置所包含的。
user nginx;
worker_processes 1;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
#tcp_nopush on;
keepalive_timeout 65;
#gzip on;
include /etc/nginx/conf.d/*.conf;
}
编辑＃1-Test-NetConnection的输出
C:\Users\Richard> Test-NetConnection -Port 443 -ComputerName www.richardvanbergen.com -InformationLevel Detailed
WARNING: TCP connect to (3.8.139.86 : 443) failed
WARNING: Ping to 3.8.139.86 failed with status: TimedOut
ComputerName : www.richardvanbergen.com
RemoteAddress : 3.8.139.86
RemotePort : 443
NameResolutionResults : 3.8.139.86
MatchingIPsecRules :
NetworkIsolationContext : Internet
IsAdmin : False
InterfaceAlias : WiFi
SourceAddress : 192.168.1.103
NetRoute (NextHop) : 192.168.1.1
PingSucceeded : False
PingReplyDetails (RTT) : 0 ms
TcpTestSucceeded : False
C:\Users\Richard> Test-NetConnection -Port 80 -ComputerName www.richardvanbergen.com -InformationLevel Detailed
ComputerName : www.richardvanbergen.com
RemoteAddress : 3.8.139.86
RemotePort : 80
NameResolutionResults : 3.8.139.86
MatchingIPsecRules :
NetworkIsolationContext : Internet
IsAdmin : False
InterfaceAlias : WiFi
SourceAddress : 192.168.1.103
NetRoute (NextHop) : 192.168.1.1
TcpTestSucceeded : True
编辑2-我刚刚将静态IP添加到实例，因此DNS尚未更新。现在是18.130.20.43。
编辑3-评论输出
ubuntu@ip-172-26-13-199:~$ ss -ltn
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 127.0.0.53%lo:53 0.0.0.0:*
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 *:443 *:*
LISTEN 0 128 *:9000 *:*
LISTEN 0 128 *:80 *:*
LISTEN 0 128 [::]:22 [::]:*
ubuntu@ip-172-26-13-199:~$ sudo iptables -L -v -n -t nat
Chain PREROUTING (policy ACCEPT 51 packets, 3040 bytes)
pkts bytes target prot opt in out source destination
2827 153K DOCKER all -- * * 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type LOCAL
Chain INPUT (policy ACCEPT 2 packets, 100 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 11 packets, 1167 bytes)
pkts bytes target prot opt in out source destination
0 0 DOCKER all -- * * 0.0.0.0/0 !127.0.0.0/8 ADDRTYPE match dst-type LOCAL
Chain POSTROUTING (policy ACCEPT 107 packets, 6591 bytes)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE all -- * !br-3798a755f648 192.168.16.0/20 0.0.0.0/0
4 268 MASQUERADE all -- * !br-4d6ce8dde9c7 172.28.0.0/16 0.0.0.0/0
0 0 MASQUERADE all -- * !br-71c62a74438c 172.23.0.0/16 0.0.0.0/0
0 0 MASQUERADE all -- * !br-a694dba80b9b 192.168.208.0/20 0.0.0.0/0
0 0 MASQUERADE all -- * !br-b056a255c235 172.27.0.0/16 0.0.0.0/0
388 24669 MASQUERADE all -- * !docker0 172.17.0.0/16 0.0.0.0/0
0 0 MASQUERADE tcp -- * * 192.168.16.2 192.168.16.2 tcp dpt:9000
0 0 MASQUERADE tcp -- * * 192.168.16.3 192.168.16.3 tcp dpt:443
0 0 MASQUERADE tcp -- * * 192.168.16.3 192.168.16.3 tcp dpt:80
Chain DOCKER (2 references)
pkts bytes target prot opt in out source destination
0 0 RETURN all -- br-3798a755f648 * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- br-4d6ce8dde9c7 * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- br-71c62a74438c * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- br-a694dba80b9b * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- br-b056a255c235 * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- docker0 * 0.0.0.0/0 0.0.0.0/0
0 0 DNAT tcp -- !br-3798a755f648 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:9000 to:192.168.16.2:9000
0 0 DNAT tcp -- !br-3798a755f648 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 to:192.168.16.3:443
47 2484 DNAT tcp -- !br-3798a755f648 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 to:192.168.16.3:80
答案 0 :(得分：1)
问题已经解决，感谢您的帮助。在您的实例设置下，lightail上还有一个额外的防火墙。您必须在此处配置网络。