0

facing a strange problem with my current Nginx installation. The background is:

  • Dedicated server with proxmox
  • IPTables configured for: allow incoming connections on port 80, then with the nat table, forward to a virtual machine which is running nginx.
  • Same behavior (another vm) for port 53 with a DNS server (where it works).

It's strange and I don't know why, I'm not able to see the index of the site from internet. If I try with:

lynx http://127.0.0.1/index.html

from the host that have nginx installed, I can see the page. If i try the same with the lan ip from the dedicated server (which is hosting the vm), same result.

Checked the following commands and everything seems to be good for me...

root@web:~# netstat -tulpn | grep 80
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      1499/nginx
root@web:~# ps aux | grep nginx
root      1499  0.0  0.1  91188  3084 ?        Ss   22:25   0:00 nginx: master process /usr/sbin/nginx
www-data  1500  0.0  0.1  91504  3676 ?        S    22:25   0:00 nginx: worker process
www-data  1501  0.0  0.1  91504  3676 ?        S    22:25   0:00 nginx: worker process
www-data  1502  0.0  0.1  91504  3676 ?        S    22:25   0:00 nginx: worker process
www-data  1503  0.0  0.1  91504  3676 ?        S    22:25   0:00 nginx: worker process
root      2165  0.0  0.1  12728  2208 pts/0    R+   22:42   0:00 grep nginx
root@web:~# iptables -L -nv
Chain INPUT (policy ACCEPT 1228 packets, 87001 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 821 packets, 75307 bytes)
 pkts bytes target     prot opt in     out     source               destination
root@web:~# iptables -t nat -L -nv
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
root@web:~# iptables -t mangle -nv -L
Chain PREROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain INPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain FORWARD (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain OUTPUT (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination

Chain POSTROUTING (policy ACCEPT 0 packets, 0 bytes)
 pkts bytes target     prot opt in     out     source               destination
root@web:~

What could be the origin of the problem? Thanks in advance.

Edit: the above mentioned rules are from vm itself. Here is the input allowing for 80 port from the host system:

    0     0 ACCEPT     tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80 /* Allows HTTP traffic */

And there is the forward rule:

    0     0 DNAT       tcp  --  *      *       0.0.0.0/0            0.0.0.0/0            tcp dpt:80 /* Forward HTTP */ to:10.250.3.5
7
  • 1
    You claim that iptables is configured to FORWARD port 80 packets, however there are no such rules listed, I assume because you have listed the rules from the web server VM itself and not the forwarding router. Please edit your question and list the iptables rule set for whatever computer is actually doing the port forwarding. Aug 28, 2017 at 21:05
  • Yes, sorry for being so unclear. Just edited as requested :)
    – alestark
    Aug 28, 2017 at 21:25
  • 1
    Is forwarding enbaled? check via cat /proc/sys/net/ipv4/ip_forward. If not then enable it. If yes, then we need more context, i.e. your host's entire iptables rule set. Aug 28, 2017 at 21:38
  • Do you mean forwarding enabled on the router? Yes it is..as said the same approach is used for many vms running different services...one for SSH for example (working), one other for DNS (working too), configuring one now for the email (will say if working.....)
    – alestark
    Aug 28, 2017 at 21:42
  • Well, I still say we need some context, but without it I would suggest to use tcpdump to start to isolate the issue. For example, on the VM at 10.235.3.5 run sudo tcpdump -n -tttt -i enp4s0 port 80 (change enp4s0 to whatever IF name 10.235.3.5 is on), to answer the question do the packets even get to the VM, and does the VM respond? Aug 28, 2017 at 22:04

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy