Score:2

nginx listening on ipv6, but for some reason websites won't load

in flag

I'm trying to get ipv6 working on nginx (nginx/1.19.6) for SSL. In my domain configs I have:

server {
    listen      93.93.135.169:443 http2;
    listen      [::]:443 http2;
    server_name backups.myserver.com;
   ....
}

..and then for the standard port;

server {
    listen      93.93.135.169:80;
    listen      [::]:80;
    server_name backups.myserver.com ;
    ...
}

Netstat shows nginx as listening on port 443 and 80:

 netstat -tulpn | grep nginx
tcp        0      0 93.93.135.169:80        0.0.0.0:*               LISTEN      1168/nginx: master
tcp        0      0 127.0.0.1:8084          0.0.0.0:*               LISTEN      1168/nginx: master
tcp        0      0 93.93.135.169:443       0.0.0.0:*               LISTEN      1168/nginx: master
tcp        0      0 0.0.0.0:9183            0.0.0.0:*               LISTEN      5247/nginx: master
tcp6       0      0 :::80                   :::*                    LISTEN      1168/nginx: master
tcp6       0      0 :::443                  :::*                    LISTEN      1168/nginx: master

I can find the server find on ipv4 and ipv6:

root@admin3:~# ping -4 backups.myserver.com
PING backups.myserver.com (93.93.135.169) 56(84) bytes of data.
64 bytes from backups.myserver.com (93.93.135.169): icmp_seq=1 ttl=60 time=1.58 ms
^X^C
--- backups.myserver.com ping statistics ---
1 packets transmitted, 1 received, 0% packet loss, time 0ms
rtt min/avg/max/mdev = 1.575/1.575/1.575/0.000 ms
root@admin3:~# ping -6 backups.myserver.com
PING backups.myserver.com(2a00:1098:80:a0::1 (2a00:1098:80:a0::1)) 56 data bytes
64 bytes from 2a00:1098:80:a0::1 (2a00:1098:80:a0::1): icmp_seq=1 ttl=61 time=1.55 ms
^X64 bytes from 2a00:1098:80:a0::1 (2a00:1098:80:a0::1): icmp_seq=2 ttl=61 time=1.74 ms

On iptables, I get:

iptables --list -n | grep 443
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 80,443

iptables --list -n | grep 80
ACCEPT     tcp  --  0.0.0.0/0            0.0.0.0/0            multiport dports 80,443

..and ip6tables:

ip6tables --list -n | grep 80
ACCEPT     tcp      ::/0                 ::/0                 state NEW tcp dpt:80

ip6tables --list -n | grep 443
ACCEPT     tcp      ::/0                 ::/0                 state NEW tcp dpt:443

Yet , when I test the site on https://ipv6-test.com/ with http, it works:

enter image description here

But as soon as I try SSL, I get:

enter image description here

Running a curl test from another server to it, I get:

curl -v -6 https://backups.myserver.com
*   Trying 2a00:1098:80:a0::1:443...
* TCP_NODELAY set
* Connected to backups.myserver.com (2a00:1098:80:a0::1) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /etc/ssl/certs/ca-certificates.crt
  CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* error:1408F10B:SSL routines:ssl3_get_record:wrong version number
* Closing connection 0
curl: (35) error:1408F10B:SSL routines:ssl3_get_record:wrong version number

I'm running out of other things to try. Any suggestions?

Score:3
cz flag

You have forgotten to tell nginx that these listening ports on port 443 are for TLS.

    listen      93.93.135.169:443 http2;
    listen      [::]:443 http2;

Note that ssl is missing. It should read:

    listen      93.93.135.169:443 ssl http2;
    listen      [::]:443 ssl http2;
Andrew Newby avatar
in flag
OMG I knew I had to be missing something. Duh! Thanks for bringing some sanity to me. It sometimes just takes a fresh pair of eyes to look at something!
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.