title: Why do I get connection timeout on ssl even though nginx is listening and firewall allows 443?
body: <p>Most/many visitors to the site <a href="https://example.org" rel="nofollow noreferrer">https://example.org</a> get a connection timeout. Some visitors get through, possibly ones redirected from <a href="http://example.org" rel="nofollow noreferrer">http://example.org</a> or those who've previously visited the site.</p>
  <p>I'm trying to determine if this is a <strong>firewall issue or an nginx configuration</strong> issue.</p>
  <h1>Firewall</h1>
  <p>I'm using UFW as a firewall, which has the following rules:</p>
  <pre><code>To                         Action      From
  --                         ------      ----
  SSH                        ALLOW       Anywhere                  
  Nginx Full                 ALLOW       Anywhere                  
  80/tcp                     ALLOW       Anywhere                  
  443/tcp                    ALLOW       Anywhere                  
  SSH (v6)                   ALLOW       Anywhere (v6)             
  Nginx Full (v6)            ALLOW       Anywhere (v6)             
  80/tcp (v6)                ALLOW       Anywhere (v6)             
  443/tcp (v6)               ALLOW       Anywhere (v6) 
  </code></pre>
  <p>I could give some relevant rules from iptables if anyone needs that, but I'd need some direction on what to look for.</p>
  <p>For <code>sudo netstat -anop | grep LISTEN | grep ':443'</code> I get</p>
  <pre><code>tcp        0      0 0.0.0.0:443             0.0.0.0:*               LISTEN      120907/nginx: worke  off (0.00/0/0)
  tcp6       0      0 :::443                  :::*                    LISTEN      120907/nginx: worke  off (0.00/0/0)
  </code></pre>
  <p>Not sure what &quot;worke off&quot; means.</p>
  <h1>nginx</h1>
  <p>It's a virtual host with the server name myservername.com which serves up two websites, example.org and example.com/directory. Example.org points to a docker container running eXist-db. Example.com/directory is serving up a directory on localhost:8080 proxied from another server where example.com lives. Example.com/directory is running smoothly on https when I access it in the browser -- I presume this is because it actually talks to the example.com host over http.</p>
  <p>Example.org and myservername.com both have certs from let's encrypt generated by certbot.</p>
  <p>When I try nmap from my local machine I get some results I can't explain. Notice the discrepancy between ports 80 and ports 443 and between IPv4 and IPv6</p>
  <pre><code>$ nmap -A -T4 -p443 example.org
  443/tcp filtered https
  </code></pre>
  <pre><code>$ nmap -A -T4 -p443 my.server.ip.address
  443/tcp filtered https
  </code></pre>
  <pre><code>$ nmap -A -T4 -p443 -6 my:server:ip::v6:address
  443/tcp open  ssl/http nginx 1.10.3
  </code></pre>
  <pre><code>$ nmap -A -T4 -p80 example.org
  80/tcp open  http    nginx 1.10.3
  </code></pre>
  <pre><code>$ nmap -A -T4 -p80 my.server.ip.address
  80/tcp open  http    nginx 1.10.3
  </code></pre>
  <p>My <strong>nginx.conf</strong> is</p>
  <pre><code>user www-data;
  worker_processes auto;
  pid /run/nginx.pid;
  include /etc/nginx/modules-enabled/*.conf;
  
  events {
          worker_connections 768;
          # multi_accept on;
  }
  
  http {
  
          ##
          # Basic Settings
          ##
  
          client_max_body_size 50M;
          sendfile on;
          tcp_nopush on;
          tcp_nodelay on;
          keepalive_timeout 65;
          types_hash_max_size 2048;
          # server_tokens off;
  
          server_names_hash_bucket_size 64;
          # server_name_in_redirect off;
  
          include /etc/nginx/mime.types;
          default_type application/octet-stream;
  
          ##
          # SSL Settings
          ##
  
          ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
          ssl_prefer_server_ciphers on;
  
          ##
          # Logging Settings
          ##
  
          access_log /var/log/nginx/access.log;
          error_log /var/log/nginx/error.log;
  
          ##
          # Gzip Settings
          ##
  
          gzip on;
          gzip_disable &quot;msie6&quot;;
  
          # gzip_vary on;
          # gzip_proxied any;
          # gzip_comp_level 6;
          # gzip_buffers 16 8k;
          # gzip_http_version 1.1;
          # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;
  
          ##
          # Virtual Host Configs
          ##
  
          include /etc/nginx/conf.d/*.conf;
          include /etc/nginx/sites-enabled/*;
  }
  
  </code></pre>
  <p>and my <strong>nginx server blocks</strong>:</p>
  <pre><code>server {
          listen 80 default_server;
          listen [::]:80 default_server;
  
          server_name _ myservername.com;
          return 301 https://myservername.com$request_uri;
  }
  
  server {
          # SSL configuration
          #
          listen 443 ssl default_server;
          listen [::]:443 ssl default_server;
          
          server_name _ myservername.com;
  
          location / {
              proxy_set_header Host $host;
              proxy_set_header X-Real-IP $remote_addr;
              proxy_pass http://localhost:8080;
         }
  
          ssl_certificate /etc/letsencrypt/live/myservername.com/fullchain.pem;
          ssl_certificate_key /etc/letsencrypt/live/myservername.com/privkey.pem;
  }
  
  server {
          listen 80;
          listen [::]:80;
  
          server_name example.com www.example.com;
  
          gzip off;
  
          location / {
                  proxy_set_header Host $host;
                  proxy_set_header X-Real-IP $remote_addr;
                  proxy_pass http://localhost:8080;
          }
  }
  
  server {
         listen 80;
         listen [::]:80;
  
         server_name example.org www.example.org;
         return 301 https://example.org$request_uri;
  }
  
  server {
  
          # SSL configuration
          #
          listen 443 ssl;
          listen [::]:443 ssl;
          
          server_name example.org www.example.org;
  
          gzip off;
  
          location / {
                  proxy_set_header Host $host;
                  proxy_set_header X-Real-IP $remote_addr;
                  proxy_pass http://docker.container.ip.address:port/exist/apps/example/;
          }
  
          location /workshop2020/ {
                  return 302 http://example.org/forum2020/;
          }
  
  
      location /exist/apps/example/ { 
              rewrite ^/exist/apps/example/(.*)$ /$1; 
      }
  
  
      ssl_certificate /etc/letsencrypt/live/example.org/fullchain.pem; # managed by Certbot
      ssl_certificate_key /etc/letsencrypt/live/example.org/privkey.pem; # managed by Certbot
  
  }
  </code></pre>
  <p>Very grateful for any help!!</p>