Richard Vanbergen
Reputation: 1974
Cannot connect to SSL from outside ubuntu
I've got a very strange problem connecting to my newly configured SSL site. This is an Ubuntu VPS hosted on Amazon lightsail.
I have docker container serving port 80 and 443 as you can see here:
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
ce7114e8383a nginx:alpine "nginx -g 'daemon of…" 43 minutes ago Up 7 minutes 0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp app_nginx_1
ffe588588a67 registry.gitlab.com/richardvanbergen/richardvanbergen-personal-website:latest "/bin/sh -c 'npm run…" 43 minutes ago Up 7 minutes 0.0.0.0:9000->9000/tcp app_web_1
From inside the server I can make a curl request to that container and get a proper response on SSL. I get this same response on port 80.
ubuntu@ip-172-26-13-199:~$ curl -k https://0.0.0.0:443
<!DOCTYPE html><html lang="en"><head><meta charSet="utf-8"/><meta http-equiv="x-ua-compatible" content="ie=edge"/>
... // rest of served HTML
I have temporarily disabled the firewall entirely just to rule it out.
ubuntu:~$ sudo ufw disable
Firewall stopped and disabled on system startup
ubuntu:~$ sudo ufw status
Status: inactive
Yet from the outside I cannot access https://www.richardvanbergen.com/ only http://www.richardvanbergen.com/
This is my nginx default configuration so far. It's a reverse proxy to another docker image.
upstream node-app {
server web:9000;
}
server {
listen 80;
listen 443 ssl;
server_name www.richardvanbergen.com;
ssl_certificate /certbot/live/www.richardvanbergen.com/fullchain.pem;
ssl_certificate_key /certbot/live/www.richardvanbergen.com/privkey.pem;
location / {
proxy_pass http://node-app;
proxy_redirect off;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $server_name;
}
}
And this is included by an otherwise default nginx configuration.
user nginx;
worker_processes 1;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;
events {
worker_connections 1024;
}
http {
include /etc/nginx/mime.types;
default_type application/octet-stream;
log_format main '$remote_addr - $remote_user [$time_local] "$request" '
'$status $body_bytes_sent "$http_referer" '
'"$http_user_agent" "$http_x_forwarded_for"';
access_log /var/log/nginx/access.log main;
sendfile on;
#tcp_nopush on;
keepalive_timeout 65;
#gzip on;
include /etc/nginx/conf.d/*.conf;
}
Edit #1 - Output from Test-NetConnection
C:\Users\Richard> Test-NetConnection -Port 443 -ComputerName www.richardvanbergen.com -InformationLevel Detailed
WARNING: TCP connect to (3.8.139.86 : 443) failed
WARNING: Ping to 3.8.139.86 failed with status: TimedOut
ComputerName : www.richardvanbergen.com
RemoteAddress : 3.8.139.86
RemotePort : 443
NameResolutionResults : 3.8.139.86
MatchingIPsecRules :
NetworkIsolationContext : Internet
IsAdmin : False
InterfaceAlias : WiFi
SourceAddress : 192.168.1.103
NetRoute (NextHop) : 192.168.1.1
PingSucceeded : False
PingReplyDetails (RTT) : 0 ms
TcpTestSucceeded : False
C:\Users\Richard> Test-NetConnection -Port 80 -ComputerName www.richardvanbergen.com -InformationLevel Detailed
ComputerName : www.richardvanbergen.com
RemoteAddress : 3.8.139.86
RemotePort : 80
NameResolutionResults : 3.8.139.86
MatchingIPsecRules :
NetworkIsolationContext : Internet
IsAdmin : False
InterfaceAlias : WiFi
SourceAddress : 192.168.1.103
NetRoute (NextHop) : 192.168.1.1
TcpTestSucceeded : True
Edit 2 - I've just added a static IP to the instance so the DNS hasn't updated yet. It's now at 18.130.20.43.
Edit 3 - Output for comments
ubuntu@ip-172-26-13-199:~$ ss -ltn
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 128 127.0.0.53%lo:53 0.0.0.0:*
LISTEN 0 128 0.0.0.0:22 0.0.0.0:*
LISTEN 0 128 *:443 *:*
LISTEN 0 128 *:9000 *:*
LISTEN 0 128 *:80 *:*
LISTEN 0 128 [::]:22 [::]:*
ubuntu@ip-172-26-13-199:~$ sudo iptables -L -v -n -t nat
Chain PREROUTING (policy ACCEPT 51 packets, 3040 bytes)
pkts bytes target prot opt in out source destination
2827 153K DOCKER all -- * * 0.0.0.0/0 0.0.0.0/0 ADDRTYPE match dst-type LOCAL
Chain INPUT (policy ACCEPT 2 packets, 100 bytes)
pkts bytes target prot opt in out source destination
Chain OUTPUT (policy ACCEPT 11 packets, 1167 bytes)
pkts bytes target prot opt in out source destination
0 0 DOCKER all -- * * 0.0.0.0/0 !127.0.0.0/8 ADDRTYPE match dst-type LOCAL
Chain POSTROUTING (policy ACCEPT 107 packets, 6591 bytes)
pkts bytes target prot opt in out source destination
0 0 MASQUERADE all -- * !br-3798a755f648 192.168.16.0/20 0.0.0.0/0
4 268 MASQUERADE all -- * !br-4d6ce8dde9c7 172.28.0.0/16 0.0.0.0/0
0 0 MASQUERADE all -- * !br-71c62a74438c 172.23.0.0/16 0.0.0.0/0
0 0 MASQUERADE all -- * !br-a694dba80b9b 192.168.208.0/20 0.0.0.0/0
0 0 MASQUERADE all -- * !br-b056a255c235 172.27.0.0/16 0.0.0.0/0
388 24669 MASQUERADE all -- * !docker0 172.17.0.0/16 0.0.0.0/0
0 0 MASQUERADE tcp -- * * 192.168.16.2 192.168.16.2 tcp dpt:9000
0 0 MASQUERADE tcp -- * * 192.168.16.3 192.168.16.3 tcp dpt:443
0 0 MASQUERADE tcp -- * * 192.168.16.3 192.168.16.3 tcp dpt:80
Chain DOCKER (2 references)
pkts bytes target prot opt in out source destination
0 0 RETURN all -- br-3798a755f648 * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- br-4d6ce8dde9c7 * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- br-71c62a74438c * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- br-a694dba80b9b * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- br-b056a255c235 * 0.0.0.0/0 0.0.0.0/0
0 0 RETURN all -- docker0 * 0.0.0.0/0 0.0.0.0/0
0 0 DNAT tcp -- !br-3798a755f648 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:9000 to:192.168.16.2:9000
0 0 DNAT tcp -- !br-3798a755f648 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 to:192.168.16.3:443
47 2484 DNAT tcp -- !br-3798a755f648 * 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 to:192.168.16.3:80
Upvotes: 0
Views: 155
Answers (1)
Richard Vanbergen
Reputation: 1974
Issue is gone now, thanks for the help guys. There's an additional firewall on lightsail under your instance settings. You have to configure the network there.
Upvotes: 1
Related Questions
- Nginx cannot load certificate in docker container
- trying ssl to docker nginx container
- Unable to run Nginx HTTPS webserver on Docker
- Docker nginx self-signed certificate - can't connect to https
- Can't connect to Website - Connection refused - Nginx - SSL
- Set up https access to nginx docker container
- Nginx Docker haven't access to server through server_name
- Docker with Nginx - Https not working
- nginx not accessible outside of Docker container
- Nginx SSL inside a docker container