HTTPS 443 port: netstat shows wildcard but curl --insecure only works for localhost

cr001

5/6/23, 10:09 AM

I have a remote machine with public IP address 121.x.y.z, with Gitlab (the software does not really matter and Gitlab knowledge is not required here) installed (which uses nginx for its web interface) and HTTPS setup. However I am in a situation where I can only access through HTTPS using localhost but no other IP address.

When I do netstat -an | grep 443 in the remote machine I get

[user@machine ~]$ netstat -an | grep 443
tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN

When I do curl --insecure https://127.0.0.1 in the remote machine I get

[user@machine ~]$ curl --insecure https://127.0.0.1
<html><body>You are being <a href="https://127.0.0.1/users/sign_in">redirected</a>.</body></html>

The redirected message is the default correct message with Gitlab.

However when I do curl --insecure https://121.x.y.z in the remote machine I get nothing but infinite waiting time (seems like it is not actually listening). But netstat result seems to indicate it is listening to all ip addresses, not just localhost.

The Gitlab web interface works correctly if I discard HTTPS settings and go back to HTTP.

I don't know how to even proceed debugging this issue and is pretty much stuck. Is there anything I can do to figure out why it only listens to localhost while netstat shows it listens to everything?

Edit: The system is CentOS7 and firewalld seems to be not active too.

[user@machine ~]$ sudo systemctl status firewalld
● firewalld.service - firewalld - dynamic firewall daemon
   Loaded: loaded (/usr/lib/systemd/system/firewalld.service; disabled; vendor preset: enabled)
   Active: inactive (dead)
     Docs: man:firewalld(1)

Aug 14 10:55:45 xxxxxx systemd[1]: firewalld.service: Unit cannot be reloaded because it is inactive.

105

0 + 0

https

port

Gerald Schneider

5/6/23, 10:10 AM

A timeout usually points toward a firewall issue.

cr001

5/6/23, 10:15 AM

I also included `sudo systemctl status firewalld` result and it seems not active. Is there any other possible firewall on centOS7?

Gerald Schneider

5/6/23, 10:16 AM

The firewall can be anywhere between you and the remote machine. Since you provide no information about the infrastructure we can't even guess.

cr001

5/6/23, 10:17 AM

The curl commands are all executed in the remote machine ssh terminal

Bob

5/6/23, 10:33 AM

When the public IP-address is not configured on the machine itself (which is typically the case for floating IP-addresses and similar constructs in cloud environments (check for example with `ip addr` ) traffic from the instance to that public IP-address is also subject to external access controls such as security groups. Those access controls are not enforced with a local firewall (iptables, firewalld, ufw or similar) and not immediately apparent.

cr001

5/6/23, 10:46 AM

@Bob Thank you so much. It looks like the IP address issue is exactly the problem. The cloud service I am using seems to have server instance and ip addresses handled separately

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: HTTPS 443 port: netstat shows wildcard but curl --insecure only works for localhost

TH: พอร์ต HTTPS 443: netstat แสดงไวด์การ์ด แต่ curl --insecure ใช้ได้กับ localhost เท่านั้น

RO: Port HTTPS 443: netstat afișează wildcard, dar curl --insecure funcționează numai pentru localhost

RU: Порт HTTPS 443: netstat показывает подстановочный знак, но curl --insecure работает только для локального хоста

VI: Cổng HTTPS 443: netstat hiển thị ký tự đại diện nhưng curl --insecure chỉ hoạt động đối với máy chủ cục bộ

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.