Webサーバーにはアクセスできませんが、SSHにはアクセスできます

Question

私はUbuntuサーバーを持っていますが、理解できない奇妙なことがいくつかあります。

IPアドレス経由でサーバーにpingすることはできませんが、sshすることはできます。コマンドラインを介してサーバー内のApacheサーバーにアクセスできますが、Windowsブラウザーでアクセスできません。

今、どのような設定を確認する必要がありますか？

pradeepchhetri · Answer

次のツールを使用して問題をデバッグできます。

wiresharkまたはtcpdumpを実行して、HTTPリクエストがサーバーに到達しているかどうかを確認します。
tcptracerouteを使用

$ tcptraceroute "webserver-ip" 80
Webサーバーがすべてのインターフェース（0.0.0.0）をリッスンするのではなく、localhost（127.0.0.1）のみをリッスンしている可能性があります。

$ Sudo netstat -taupen | grep LISTEN
を使用してiptablesルールを確認してください

$ Sudo iptables -nvL
ファイアウォールとしても機能するSELinuxのステータスを確認します。

$ Sudo sestatus

janos · Answer

ファイアウォールルールがアクセスをブロックしている可能性があります。 iptables -Lの出力を確認してください。たぶん、ssh以外はすべてブロックされています。
サービスが正しいインターフェイスまたはポートでリッスンしていない可能性があります。 netstat -ntlの出力を確認してください。

これらのコマンドが理解に役立たない場合は、質問に出力を追加してください。 ifconfigの出力も追加します。

nevillescollop · Answer

私もこの問題を抱えています。上記のコマンドからの出力は次のとおりです

# netstat -taupen | grep LISTEN tcp 0 0 0.0.0.0:139 0.0.0.0:* LISTEN 0 19239 2490/smbd tcp 0 0 0.0.0.0:10000 0.0.0.0:* LISTEN 0 19149 2475/Perl tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 0 18616 1241/sshd tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN 0 20281 2487/master tcp 0 0 0.0.0.0:445 0.0.0.0:* LISTEN 0 19238 2490/smbd tcp6 0 0 :::8009 :::* LISTEN 91 19311 1247/Java tcp6 0 0 :::139 :::* LISTEN 0 19237 2490/smbd tcp6 0 0 :::80 :::* LISTEN 0 163453 4050/httpd tcp6 0 0 :::8080 :::* LISTEN 91 19310 1247/Java tcp6 0 0 :::21 :::* LISTEN 0 19479 1282/vsftpd tcp6 0 0 :::22 :::* LISTEN 0 18618 1241/sshd tcp6 0 0 ::1:25 :::* LISTEN 0 20282 2487/master tcp6 0 0 :::445 :::* LISTEN 0 19236 2490/smbd tcp6 0 0 127.0.0.1:8005 :::* LISTEN 91 20467 1247/Java # netstat -ntl Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 0.0.0.0:139 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:10000 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN tcp 0 0 0.0.0.0:445 0.0.0.0:* LISTEN tcp6 0 0 :::8009 :::* LISTEN tcp6 0 0 :::139 :::* LISTEN tcp6 0 0 :::80 :::* LISTEN tcp6 0 0 :::8080 :::* LISTEN tcp6 0 0 :::21 :::* LISTEN tcp6 0 0 :::22 :::* LISTEN tcp6 0 0 ::1:25 :::* LISTEN tcp6 0 0 :::445 :::* LISTEN tcp6 0 0 127.0.0.1:8005 :::* LISTEN

IPテーブルの出力：

# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED ACCEPT all -- anywhere anywhere INPUT_direct all -- anywhere anywhere INPUT_ZONES_SOURCE all -- anywhere anywhere INPUT_ZONES all -- anywhere anywhere ACCEPT icmp -- anywhere anywhere REJECT all -- anywhere anywhere reject-with icmp-Host-prohibited Chain FORWARD (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED ACCEPT all -- anywhere anywhere FORWARD_direct all -- anywhere anywhere FORWARD_IN_ZONES_SOURCE all -- anywhere anywhere FORWARD_IN_ZONES all -- anywhere anywhere FORWARD_OUT_ZONES_SOURCE all -- anywhere anywhere FORWARD_OUT_ZONES all -- anywhere anywhere ACCEPT icmp -- anywhere anywhere REJECT all -- anywhere anywhere reject-with icmp-Host-prohibited Chain OUTPUT (policy ACCEPT) target prot opt source destination OUTPUT_direct all -- anywhere anywhere Chain FORWARD_IN_ZONES (1 references) target prot opt source destination FWDI_internal all -- anywhere anywhere [goto] FWDI_internal all -- anywhere anywhere [goto] Chain FORWARD_IN_ZONES_SOURCE (1 references) target prot opt source destination Chain FORWARD_OUT_ZONES (1 references) target prot opt source destination FWDO_internal all -- anywhere anywhere [goto] FWDO_internal all -- anywhere anywhere [goto] Chain FORWARD_OUT_ZONES_SOURCE (1 references) target prot opt source destination Chain FORWARD_direct (1 references) target prot opt source destination Chain FWDI_internal (2 references) target prot opt source destination FWDI_internal_log all -- anywhere anywhere FWDI_internal_deny all -- anywhere anywhere FWDI_internal_allow all -- anywhere anywhere Chain FWDI_internal_allow (1 references) target prot opt source destination Chain FWDI_internal_deny (1 references) target prot opt source destination Chain FWDI_internal_log (1 references) target prot opt source destination Chain FWDO_internal (2 references) target prot opt source destination FWDO_internal_log all -- anywhere anywhere FWDO_internal_deny all -- anywhere anywhere FWDO_internal_allow all -- anywhere anywhere Chain FWDO_internal_allow (1 references) target prot opt source destination Chain FWDO_internal_deny (1 references) target prot opt source destination Chain FWDO_internal_log (1 references) target prot opt source destination Chain INPUT_ZONES (1 references) target prot opt source destination IN_internal all -- anywhere anywhere [goto] IN_internal all -- anywhere anywhere [goto] Chain INPUT_ZONES_SOURCE (1 references) target prot opt source destination Chain INPUT_direct (1 references) target prot opt source destination Chain IN_internal (2 references) target prot opt source destination IN_internal_log all -- anywhere anywhere IN_internal_deny all -- anywhere anywhere IN_internal_allow all -- anywhere anywhere Chain IN_internal_allow (1 references) target prot opt source destination ACCEPT udp -- anywhere 224.0.0.251 udp dpt:mdns ctstate NEW ACCEPT tcp -- anywhere anywhere tcp dpt:http ctstate NEW ACCEPT udp -- anywhere anywhere udp dpt:ipp ctstate NEW ACCEPT tcp -- anywhere anywhere tcp dpt:ssh ctstate NEW ACCEPT udp -- anywhere anywhere udp dpt:netbios-ns ctstate NEW ACCEPT udp -- anywhere anywhere udp dpt:netbios-dgm ctstate NEW Chain IN_internal_deny (1 references) target prot opt source destination Chain IN_internal_log (1 references) target prot opt source destination Chain OUTPUT_direct (1 references) target prot opt source destination [root@localhost etc]# iptables -L Chain INPUT (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED ACCEPT all -- anywhere anywhere INPUT_direct all -- anywhere anywhere INPUT_ZONES_SOURCE all -- anywhere anywhere INPUT_ZONES all -- anywhere anywhere ACCEPT icmp -- anywhere anywhere REJECT all -- anywhere anywhere reject-with icmp-Host-prohibited Chain FORWARD (policy ACCEPT) target prot opt source destination ACCEPT all -- anywhere anywhere ctstate RELATED,ESTABLISHED ACCEPT all -- anywhere anywhere FORWARD_direct all -- anywhere anywhere FORWARD_IN_ZONES_SOURCE all -- anywhere anywhere FORWARD_IN_ZONES all -- anywhere anywhere FORWARD_OUT_ZONES_SOURCE all -- anywhere anywhere FORWARD_OUT_ZONES all -- anywhere anywhere ACCEPT icmp -- anywhere anywhere REJECT all -- anywhere anywhere reject-with icmp-Host-prohibited Chain OUTPUT (policy ACCEPT) target prot opt source destination OUTPUT_direct all -- anywhere anywhere Chain FORWARD_IN_ZONES (1 references) target prot opt source destination FWDI_internal all -- anywhere anywhere [goto] FWDI_internal all -- anywhere anywhere [goto] Chain FORWARD_IN_ZONES_SOURCE (1 references) target prot opt source destination Chain FORWARD_OUT_ZONES (1 references) target prot opt source destination FWDO_internal all -- anywhere anywhere [goto] FWDO_internal all -- anywhere anywhere [goto] Chain FORWARD_OUT_ZONES_SOURCE (1 references) target prot opt source destination Chain FORWARD_direct (1 references) target prot opt source destination Chain FWDI_internal (2 references) target prot opt source destination FWDI_internal_log all -- anywhere anywhere FWDI_internal_deny all -- anywhere anywhere FWDI_internal_allow all -- anywhere anywhere Chain FWDI_internal_allow (1 references) target prot opt source destination Chain FWDI_internal_deny (1 references) target prot opt source destination Chain FWDI_internal_log (1 references) target prot opt source destination Chain FWDO_internal (2 references) target prot opt source destination FWDO_internal_log all -- anywhere anywhere FWDO_internal_deny all -- anywhere anywhere FWDO_internal_allow all -- anywhere anywhere Chain FWDO_internal_allow (1 references) target prot opt source destination Chain FWDO_internal_deny (1 references) target prot opt source destination Chain FWDO_internal_log (1 references) target prot opt source destination Chain INPUT_ZONES (1 references) target prot opt source destination IN_internal all -- anywhere anywhere [goto] IN_internal all -- anywhere anywhere [goto] Chain INPUT_ZONES_SOURCE (1 references) target prot opt source destination Chain INPUT_direct (1 references) target prot opt source destination Chain IN_internal (2 references) target prot opt source destination IN_internal_log all -- anywhere anywhere IN_internal_deny all -- anywhere anywhere IN_internal_allow all -- anywhere anywhere Chain IN_internal_allow (1 references) target prot opt source destination ACCEPT udp -- anywhere 224.0.0.251 udp dpt:mdns ctstate NEW ACCEPT tcp -- anywhere anywhere tcp dpt:http ctstate NEW ACCEPT udp -- anywhere anywhere udp dpt:ipp ctstate NEW ACCEPT tcp -- anywhere anywhere tcp dpt:ssh ctstate NEW ACCEPT udp -- anywhere anywhere udp dpt:netbios-ns ctstate NEW ACCEPT udp -- anywhere anywhere udp dpt:netbios-dgm ctstate NEW Chain IN_internal_deny (1 references) target prot opt source destination Chain IN_internal_log (1 references) target prot opt source destination Chain OUTPUT_direct (1 references) target prot opt source destination

vyeluri5 · Answer

Firewalldを使用して、httpなどの特定のポートまたはサービスを許可する必要がある場合があります。

Sudo firewall-cmd --permanent --add-service=http && firewall-cmd --reload