› NGINX
› NGINX Trac
› 3rd Party Modules
› Security Advisories
› CHANGES
› OpenResty
› ngx_lua
› Tengine
在线学习资源
› NGINX 开发从入门到精通
NGINX Modules
› ngx_echo
ab
V2EX  ›  NGINX

NGINX 求助 禁止访问 https://ip 后,前端机器 proxy 502

  •  
  •   ab · Apr 6, 2022 · 3693 views
    This topic created in 1677 days ago, the information mentioned may be changed or developed.
    为关闭 ip 直接访问,我们在后端机器的 nginx 添加配置

    原配置:
    server {
    listen 80 default_server;
    listen 443 ssl http2 default_server;
    server_name _;
    ssl_certificate cert/empty.crt; #自签假证
    ssl_certificate_key cert/empty.key; #自签假证
    return 444;
    }


    新配置:
    server {
    listen 80 default_server;
    listen 443 ssl http2 default_server;
    server_name _;
    ssl_reject_handshake on; # nginx 1.19 新参数
    return 444;
    }


    改了新配置以后,前端反代某个已在后端绑定的域名时,80 端口可以正常请求到,但 443 全部 502 ,请老哥们赐教了
    14 replies  •  2022-04-07 07:51:29 +08:00
    ZE3kr
    ZE3kr
    Apr 6, 2022 via iPhone
    1
    看 errorlog
    Judoon
    Judoon
    Apr 6, 2022❤️1
    2
    前端反代 443 时向后端也是 443 访问吗?那目测直接握手拒绝了,建立连接时没有带 SNI 信息吧?
    ab
    ab
    OP
    Apr 6, 2022
    3
    @Judoon 是的,直接反代 403

    proxy_cache off;
    proxy_redirect off;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
    proxy_set_header Referer $http_referer;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Host $host;
    proxy_set_header X-Forwarded-Port $server_port;
    ab
    ab
    OP
    Apr 6, 2022
    4
    @Judoon 是的,直接反代 443
    Judoon
    Judoon
    Apr 6, 2022
    5
    GBdG6clg2Jy17ua5
    GBdG6clg2Jy17ua5
    Apr 6, 2022
    6
    将 80,443 配置成两个 server 块。443 类似你原来的配置。
    cnrting
    cnrting
    Apr 6, 2022 via iPhone
    7
    ssl_reject_handshake on; 没用过这参数,可是看字面意思返回 502 难道不是正常反应吗
    ab
    ab
    OP
    Apr 6, 2022❤️1
    8
    5 楼正解
    非常谢谢 @Judoon

    @angryfish
    @cnrting

    ssl_reject_handshake on;这个参数是没有绑定域名的访问拒绝握手。前端需要向后端发送 SNI 信息

    添加以下两行解决
    proxy_ssl_server_name on;
    proxy_ssl_name $host;
    Silently
    Silently
    Apr 6, 2022 via iPhone
    9
    @ab 如果有多个 location 块的话 是需要每个都添加么 还是单 /这个块添加
    Silently
    Silently
    Apr 6, 2022 via iPhone
    10
    @Silently 我看说明是可以直接添加到 server 块上
    ab
    ab
    OP
    Apr 6, 2022 via iPhone
    11
    我是加在 server 段,只用来禁用非绑定的域名
    ab
    ab
    OP
    Apr 6, 2022 via iPhone
    12
    Silently
    Silently
    Apr 6, 2022 via iPhone
    13
    @ab 用上了 谢谢
    yxnwh
    yxnwh
    Apr 7, 2022
    14
    多谢,mark 一记,之前也遇到了类似问题
    About   ·   Help   ·   Advertise   ·   Blog   ·   API   ·   FAQ   ·   Privacy   ·   Solana   ·   4276 Online   Highest 6679   ·     Select Language
    创意工作者们的社区
    World is powered by solitude
    VERSION: 3.9.8.5 · 54ms · UTC 02:20 · PVG 10:20 · LAX 18:20 · JFK 21:20
    ♥ Do have faith in what you're doing.