Estou configurando o Varnish and Hitch para atender solicitações HTTP e HTTPS recebidas no meu site Drupal. O site Drupal roda em Nginx em um Digital Ocean VPS e estava escutando nas portas 80 e 443. Alterei todos os blocos de servidor para escutar na porta 8080. Configurei o Varnish para escutar em 80 na mesma máquina. Eu criei um script de shell para configurar o iptables. O script contém as seguintes linhas
iptables -F
iptables -A INPUT -p tcp --tcp-flags ALL NONE -j DROP
iptables -A INPUT -p tcp ! --syn -m state --state NEW -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL ALL -j DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 9999 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 25 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 465 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 110 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 995 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 143 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 993 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 4949 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 8080 -j ACCEPT
iptables -I INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
ipchains -A input -p icmp --icmp-type timestamp-request -j DROP ipchains -A output -p icmp --icmp-type timestamp-reply -j DROP
iptables -P OUTPUT ACCEPT
iptables -P INPUT DROP
iptables -L -n
iptables-save | sudo tee /etc/sysconfig/iptables
service iptables restart
Quando listo as regras do iptables após executar o script acima, esta é a saída
sridhar@SastraTechnologies:~$ sudo iptables -L
[sudo] password for sridhar:
Chain INPUT (policy DROP)
target prot opt source destination
ACCEPT all -- anywhere anywhere state RELATED,ESTABLISHED
DROP tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE
DROP tcp -- anywhere anywhere tcp flags:!FIN,SYN,RST,ACK/SYN state NEW
DROP tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/FIN,SYN,RST,PSH,ACK,URG
ACCEPT all -- anywhere anywhere
ACCEPT tcp -- anywhere anywhere tcp dpt:http
ACCEPT tcp -- anywhere anywhere tcp dpt:https
ACCEPT tcp -- anywhere anywhere tcp dpt:9999
ACCEPT tcp -- anywhere anywhere tcp dpt:smtp
ACCEPT tcp -- anywhere anywhere tcp dpt:urd
ACCEPT tcp -- anywhere anywhere tcp dpt:pop3
ACCEPT tcp -- anywhere anywhere tcp dpt:pop3s
ACCEPT tcp -- anywhere anywhere tcp dpt:imap2
ACCEPT tcp -- anywhere anywhere tcp dpt:imaps
ACCEPT tcp -- anywhere anywhere tcp dpt:munin
ACCEPT tcp -- anywhere anywhere tcp dpt:http-alt
Chain FORWARD (policy DROP)
target prot opt source destination
Chain OUTPUT (policy ACCEPT)
target prot opt source destination
Chain DOCKER (0 references)
target prot opt source destination
Chain DOCKER-ISOLATION (0 references)
target prot opt source destination
O http-alt é a porta 8080, pois é a última regra no meu script de shell do iptables. No entanto, quando tento um telnet, recebo um erro "Conexão recusada"
sridhar@SastraTechnologies:~$ telnet localhost 8080
Trying 127.0.0.1...
telnet: Unable to connect to remote host: Connection refused
Tentei verificar se o verniz é capaz de se conectar ao Nginx usando curl do meu laptop para buscar os cabeçalhos e esta é a saída (endereço IP ofuscado por motivos óbvios)
sridhar@sridhar-HP-Laptop-15-bs0xx:~$ curl -I 139.99.99.99
HTTP/1.1 503 Backend fetch failed
Date: Mon, 11 Jan 2021 08:57:53 GMT
Server: Varnish
Content-Type: text/html; charset=utf-8
Retry-After: 5
X-Varnish: 4271
Age: 0
Via: 1.1 varnish-v4
Connection: keep-alive
No entanto, se eu verificar o status da porta usando netstat, vejo que o Nginx está escutando na porta 8080
sridhar@SastraTechnologies:~$ sudo netstat -tulpn
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:6082 0.0.0.0:* LISTEN 2246/varnishd
tcp 0 0 127.0.0.1:8999 0.0.0.0:* LISTEN 1543/perl
tcp 0 0 127.0.0.1:9000 0.0.0.0:* LISTEN 541/php-fpm.conf)
tcp 0 0 139.99.99.99:3306 0.0.0.0:* LISTEN 1472/mysqld
tcp 0 0 0.0.0.0:9999 0.0.0.0:* LISTEN 9050/sshd
tcp 0 0 139.99.99.99:8080 0.0.0.0:* LISTEN 4071/nginx -g daemo
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 2246/varnishd
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 4071/nginx -g daemo
tcp6 0 0 :::9999 :::* LISTEN 9050/sshd
tcp6 0 0 :::80 :::* LISTEN 2246/varnishd
tcp6 0 0 :::4949 :::* LISTEN 7923/perl
Mas está ouvindo a porta 80 apenas no IP público em vez de em todos os IPs, não é o mesmo para todas as outras portas. Há alguma coisa que estou faltando? Como faço para que a porta 8080 fique acessível ao Varnish?
EDITAR
Conteúdo do arquivo de unidade do sistema
[Unit]
Description=Varnish HTTP accelerator
Documentation=https://www.varnish-cache.org/docs/4.1/ man:varnishd
[Service]
Type=simple
LimitNOFILE=131072
LimitMEMLOCK=82000
ExecStart=/usr/sbin/varnishd -j unix,user=vcache -F -a :80 -T localhost:6082 -f /etc/varnish/default.vcl -S /etc/varnish/secret -s malloc,256m
ExecReload=/usr/share/varnish/reload-vcl
ProtectSystem=full
ProtectHome=true
PrivateTmp=true
PrivateDevices=true
[Install]
WantedBy=multi-user.target
Definição de back-end para verniz
backend default {
.host = "127.0.0.1";
.port = "8080";
}
sub vcl_recv {
# Happens before we check if we have this in cache already.
#
# Typically you clean up the request here, removing cookies you don't need,
# rewriting the request, etc.
}
sub vcl_backend_response {
# Happens after we have read the response headers from the backend.
#
# Here you clean the response headers, removing silly Set-Cookie headers
# and other mistakes your backend does.
}
sub vcl_deliver {
# Happens when we have all the pieces we need, and are about to send the
# response to the client.
#
# You can do accounting or modifying the final object here.
}
Alterei apenas a configuração padrão do back-end por enquanto
Configuração Nginx
server {
listen mydomain.co.in:8080;
server_name mydomain.co.in www.mydomain.co.in;
root /home/sridhar/public_html/newanybank/public; ## <-- Your only path reference.
keepalive_timeout 70;
access_log /home/sridhar/public_html/newanybank/log/access.log;
error_log /home/sridhar/public_html/newanybank/log/error.log;
# Enable compression, this will help if you have for instance advagg ^ modue# by serving Gzip versions of the files.
gzip_static on;
index index.php;
location = /favicon.ico {
log_not_found off;
access_log off;
}
location = /robots.txt {
allow all;
log_not_found off;
access_log off;
}
# Very rarely should these ever be accessed outside of your lan
location ~* \.(txt|log)$ {
allow 192.168.0.0/16;
deny all;
}
location ~ \..*/.*\.php$ {
return 403;
}
# No no for private
location ~ ^/sites/.*/private/ {
return 403;
}
# Block access to "hidden" files and directories whose names begin with a
# period. This includes directories used by version control systems such
# as Subversion or Git to store control files.
location ~ (^|/)\. {
return 403;
}
location / {
try_files $uri $uri/ @rewrite;
expires max;
}
location @rewrite {
# You have 2 options here
# For D7 and above:
# Clean URLs are handled in drupal_environment_initialize().
rewrite ^ /index.php;
# For Drupal 6 and bwlow:
# Some modules enforce no slash (/) at the end of the URL
# Else this rewrite block wouldn't be needed (GlobalRedirect)
#rewrite ^/(.*)$ /index.php?q=$1;
}
location ~ \.php$ {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
#NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_intercept_errors on;
#fastcgi_pass unix:/tmp/phpfpm.sock;
fastcgi_pass 127.0.0.1:9000;
}
# Fighting with Styles? This little gem is amazing.
# This is for D6
#location ~ ^/sites/.*/files/imagecache/ {
# This is for D7 and D8
location ~ ^/sites/.*/files/styles/ {
try_files $uri $uri/ @rewrite;
}
location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
expires 365d;
log_not_found off;
add_header Cache-Control "public, no-transform";
}
location ~* \.(pdf|css|html|js|swf)$ {
expires 7d;
log_not_found off;
add_header Cache-Control "public, no-transform";
}
Responder1
A listen mydomain.co.in:8080;diretiva na configuração do Nginx é provavelmente o problema.
O Nginx escutará apenas na interface de rede o IP que é resolvido pelo domínio. Estou ciente de que o domínio foi editado por uma questão de privacidade. Mas você provavelmente sabe o que quero dizer.
Isso também é refletido pelo 139.99.99.99:8080endereço local na sua netstatsaída.
O localhostendereço não resolve esse endereço IP e usa a interface de loopback. Então é provavelmente por isso que não funcionará.
Altere seu endereço de escuta do Nginx da seguinte forma:
listen 8080;
Isso vinculará o processo Nginx a todas as interfaces de rede disponíveis nesse servidor, incluindo localhost.