Nginx 拒绝连接到端口 443

Question

所以，我正在尝试让 Nginx 通过 https 为我的网站提供服务，但它不断出现拒绝连接错误。

所以这里是输出：

1. curl https://juristnet.ro（这是网站）

   curl: (7) Failed to connect to juristnet.ro port 443: Connection refused
   

2. netstat -anltp

   tcp        0      0 0.0.0.0:80              0.0.0.0:*                  LISTEN      -               
   tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -               
   tcp        0      0 127.0.0.1:5432          0.0.0.0:*               LISTEN      -               
   tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      -               
   tcp        0      0 0.0.0.0:3306            0.0.0.0:*               LISTEN      -               
   tcp        0      0 46.101.111.197:80       66.249.64.215:60905     TIME_WAIT   -               
   tcp        0      0 46.101.111.197:80       66.249.64.211:57434     ESTABLISHED -               
   tcp        0      0 46.101.111.197:22       82.208.159.43:26902         ESTABLISHED -               
   tcp        0    476 46.101.111.197:22       82.208.159.43:11648     ESTABLISHED -               
   tcp        0      0 46.101.111.197:22       223.99.60.37:16862      ESTABLISHED -               
   tcp6       0      0 :::8080                 :::*                      LISTEN      -               
   tcp6       0      0 :::22                   :::*                    LISTEN      -               
   tcp6       0      0 :::30845                :::*                    LISTEN      -   
   

可以看到，443端口是开放的，Nginx正在监听

80/tcp   open  http
443/tcp  open  https
3306/tcp open  mysql
5432/tcp open  postgresql

Nmap 显示端口已打开。

UFW 处于非活动状态，因此不是防火墙问题。这是digitalocean的一个小滴，所以他们这边没有转发问题。

3. iptables -L

   Chain INPUT (policy ACCEPT)
   target     prot opt source               destination         
   ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https
   ACCEPT     tcp  --  anywhere             localhost            tcp spts:1024:65535 dpt:https state NEW,ESTABLISHED
   
   Chain FORWARD (policy ACCEPT)
   target     prot opt source               destination         
   DOCKER-ISOLATION  all  --  anywhere             anywhere            
   DOCKER     all  --  anywhere             anywhere            
   ACCEPT     all  --  anywhere             anywhere             ctstate RELATED,ESTABLISHED
   ACCEPT     all  --  anywhere             anywhere            
   ACCEPT     all  --  anywhere             anywhere            
   
   Chain OUTPUT (policy ACCEPT)
   target     prot opt source               destination         
   
   Chain DOCKER (1 references)
   target     prot opt source               destination         
   ACCEPT     tcp  --  anywhere             172.17.0.2           tcp dpt:http
   ACCEPT     tcp  --  anywhere             172.17.0.2           tcp  dpt:https
   

我的 Nginx.conf：

user admin root;
worker_processes auto;

error_log  /var/log/nginx/error.log debug;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;
    ssl_session_cache   shared:SSL:10m;
    ssl_session_timeout 10m;

    include /etc/nginx/conf.d/*.conf;
}

我的其他配置（用于服务器块）：

server {

listen 80;
listen 443 ssl;

server_name  juristnet.ro www.juristnet.ro;
keepalive_timeout   70;

ssl_certificate /etc/letsencrypt/live/juristnet.ro/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/juristnet.ro/privkey.pem;
ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers         HIGH:!aNULL:!MD5;

root /var/test/proiect;
client_max_body_size 10M;

location = /favicon.ico
{
    access_log off; log_not_found off;
            alias /var/test/proiect/favicon.ico;
}

location /static/
{
    autoindex on;
}

    location /assets/
{
            autoindex on;
            alias /var/test/proiect/assets/;
}

    location  ~ /.well-known/
{
            allow all;
}

location / {
    include /etc/nginx/fastcgi_params;
        proxy_set_header X-Real-IP  $remote_addr;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header Host $http_host;
        proxy_pass http://unix:/var/test/proiect/Tutorial2.sock;
        fastcgi_param   HTTPS               on;
        fastcgi_param   HTTP_SCHEME         https;


}

还有另一个子域，但我猜这不相关。

nginx 的错误日志和访问日志没有显示任何特殊内容。

证书是从letsencrypt 获得的。如果我尝试
在 0.0.0.0:8000 上绑定 gunicorn ，使用 --keyfile 和 --certfile 选项，它确实适用于 https，所以我猜这是一个 nginx 问题。或者我可能需要在某处添加这些设置？无论如何，我已经为此苦恼了 2 天，所以如果有人对此有任何解决方案，我将非常感激。

Answer 1

我解决了这个问题，但这不是一个通用的解决方案。就我而言，Docker 干扰了 iptables 并且不允许端口 443 上的连接。在我从 Docker 公开端口后，它开始工作。