Why is ufw blocking https access to nginx?

June 28, 2019 1.5k views
Ubuntu 18.04 LEMP Firewall Nginx

ufw is set to allow full access to nginx web server, but blocks https

dmesg error report:
[Fri Jun 28 02:56:17 2019] [UFW BLOCK] IN=enp4s0 OUT= MAC=01:00:5e:00:00:01:20:c0:47:13:01:15:08:00 SRC=192.168.1.1 DST=224.0.0.1 LEN=36 TOS=0x00 PREC=0xC0 TTL=1 ID=33361 DF PROTO=2

http requests are passed successfully

3 Answers

Hello,

Can you try explicitly allowing Nginx HTTPS as well with this command:

ufw allow 'Nginx HTTP'

Then after that run this command to verify your change:

ufw status

Hope that this helps!
Bobby

  • The current ufw status is:
    To Action From


    OpenSSH ALLOW Anywhere

    Nginx Full ALLOW Anywhere

    Nginx HTTPS ALLOW Anywhere

    Nginx HTTP ALLOW Anywhere

    OpenSSH (v6) ALLOW Anywhere (v6)

    Nginx Full (v6) ALLOW Anywhere (v6)

    Nginx HTTPS (v6) ALLOW Anywhere (v6)

    Nginx HTTP (v6) ALLOW Anywhere (v6)

    but all HTTPS requests are blocked as pointed out above.

    I did try changing the rule to deny HTTPS for Nginx and then changed it back again just to see if anything happened. Nothing changed. The status is still as you see it above and HTTPS requests are still being blocked.

    • I also tried disabling and re-enabling ufw and I tried rebooting my server - still no change.

      Additional info: I am using Ubuntu 18.04 Mate. My ufw version is 0.36. According to Ubuntu Wiki, the version available for 18.04 is 0.35-5. I wouldn’t think that would make a difference, but I don’t know. If it does, I’m not sure how to obtain the right version.

      • Uninstalled ver 0.36 and installed ver 0.35-5. Still does not pass https traffic.

        • Would you mind running this command and providing me with the output:

          netstat -antp 
          

          I just want to make sure that Nginx is actually listening on port 443.

          Regards,
          Bobby

          • netstat show that nginx is listening on port 80 but there is no record of it listening on port 443.

        • That would explain the issue. You need to install an SSL certificate first. Here’s a great article on the DO site on how to install a let’s encrypt SSL for Nginx:

          https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-16-04

          Hope that this helps!
          Bobby

          by Mitchell Anicas
          In this tutorial, we will show you how to use Let's Encrypt to obtain a free SSL certificate and use it with Nginx on Ubuntu 16.04. We will also show you how to automatically renew your SSL certificate. If you're running a different web server, simply follow your web server's documentation to learn how to use the certificate with your setup.
          • Right after installing and configuring nginx (the other day) I followed the instructions in Let’s Encrypt (the newer version for ubuntu 18.04) and supposedly I have the SSL certificate. (I’m not sure how to verify that.)

            Since I am clueless about how UFW really works, I don’t understand how UFW and the certificate which is installed in nginx are connected.

          • You need to make sure that you have a valid HTTPS server block, otherwise your Nginx would not listen on port 443 as you saw with the netstat command.

          • Here is my present server block:

            server {
            listen 80 defaultserver;
            listen [::]:80 default
            server;
            listen 443 ssl defaultserver;
            listen [::]:443 ssl default
            server;

                include snippets/snakeoil.conf;
            
                root /var/www/html;
            
                index index.html index.htm index.nginx-debian.html;
            
                server_name musingsofamaverick.org;
            
                location / {
                        # First attempt to serve request as file, then
                        # as directory, then fall back to displaying a 404.
                        try_files $uri $uri/ =404;
                }
            

            }

            The snippet snakeoil.conf contains the following:

            sslcertificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
            ssl
            certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;

            Not sure how to validatew this server block.

          • You can validate your config syntax by running:

            nginx -t
            

Found two problems. In setting up my certificate I had started a new serverblock for my website but not completed it. I was working with the default serverblock to work out the firewall problems. Both server blocks (which now had my domain name in them) were in the sites-enabled folder and that screwed up the firewall.

The second problem was the snakeoil snippet pointing which pointed to a certificate that was truly snakeoil. Deleting that snippet and pointing to the correct certificate and key fixed the problem.

@wrknight

When it comes to ufw, I often recommend a full reset to ensure the firewall is properly configured to meet the specific needs of what I’m using the server for. In some cases, it’s often best to specify the ports versus using the shortcodes.

I posted a quick guide on how to reset ufw, which may be helpful for future use.

https://www.digitalocean.com/community/questions/how-to-reset-the-firewall-on-ubuntu

Have another answer? Share your knowledge.