@
NUT 谢谢您,我测试了,是通的。
@
doveyoung 谢谢您,1 、虚拟机上用 curl -v,结果就是
Trying
xxx.xxx.xxx.xxx:443 ....
TCP_NODELAY SET
然后等一会就超时了,提示 Closing connection 0……
2 和 3 、客户端虚拟机上( 18.200 )使用 curl 发送 get 请求,输出情况是这样:
tcpdump -n port 443 -i ens192 and host 192.168.16.218 -vv
tcpdump: listening on ens192, link-type EN10MB (Ethernet), capture size 262144 bytes
15:52:24.481160 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 52)
192.168.16.218.https > 192.168.18.200.41034: Flags [S.], cksum 0x3dcd (correct), seq 3835702915, ack 1032333183, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0
15:52:24.481209 IP (tos 0x0, ttl 64, id 9141, offset 0, flags [DF], proto TCP (6), length 40)
192.168.18.200.41034 > 192.168.16.218.https: Flags [R], cksum 0x03e1 (correct), seq 1032333183, win 0, length 0
15:52:25.482070 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 52)
192.168.16.218.https > 192.168.18.200.41034: Flags [S.], cksum 0x9963 (correct), seq 3851342334, ack 1032333183, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0
15:52:25.482136 IP (tos 0x0, ttl 64, id 9552, offset 0, flags [DF], proto TCP (6), length 40)
192.168.18.200.41034 > 192.168.16.218.https: Flags [R], cksum 0x03e1 (correct), seq 1032333183, win 0, length 0
15:52:27.485907 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 52)
192.168.16.218.https > 192.168.18.200.41034: Flags [S.], cksum 0xc9fe (correct), seq 3882655621, ack 1032333183, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0
15:52:27.485972 IP (tos 0x0, ttl 64, id 10776, offset 0, flags [DF], proto TCP (6), length 40)
192.168.18.200.41034 > 192.168.16.218.https: Flags [R], cksum 0x03e1 (correct), seq 1032333183, win 0, length 0
15:52:31.489995 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 52)
192.168.16.218.https > 192.168.18.200.41034: Flags [S.], cksum 0x1633 (correct), seq 3945222038, ack 1032333183, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0
15:52:31.490057 IP (tos 0x0, ttl 64, id 13410, offset 0, flags [DF], proto TCP (6), length 40)
192.168.18.200.41034 > 192.168.16.218.https: Flags [R], cksum 0x03e1 (correct), seq 1032333183, win 0, length 0
15:52:39.505889 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 52)
192.168.16.218.https > 192.168.18.200.41034: Flags [S.], cksum 0xcf03 (correct), seq 4070477646, ack 1032333183, win 29200, options [mss 1460,nop,nop,sackOK,nop,wscale 7], length 0
15:52:39.505945 IP (tos 0x0, ttl 64, id 19809, offset 0, flags [DF], proto TCP (6), length 40)
192.168.18.200.41034 > 192.168.16.218.https: Flags [R], cksum 0x03e1 (correct), seq 1032333183, win 0, length 0
然后 nginx 上( 16.218 )使用 tcpdump 监听到的日志是这样:
tcpdump: listening on ens192, link-type EN10MB (Ethernet), capture size 262144 bytes
15:52:25.568684 IP (tos 0x0, ttl 63, id 6305, offset 0, flags [DF], proto TCP (6), length 52)
192.168.18.200.41034 > 192.168.16.218.https: Flags [S], cksum 0x513e (correct), seq 1032333182, win 29200, options [mss 1400,nop,nop,sackOK,nop,wscale 7], length 0
15:52:25.569331 IP (tos 0x0, ttl 63, id 9141, offset 0, flags [DF], proto TCP (6), length 40)
192.168.18.200.41034 > 192.168.16.218.https: Flags [R], cksum 0x03e1 (correct), seq 1032333183, win 0, length 0
15:52:26.569602 IP (tos 0x0, ttl 63, id 6306, offset 0, flags [DF], proto TCP (6), length 52)
192.168.18.200.41034 > 192.168.16.218.https: Flags [S], cksum 0x513e (correct), seq 1032333182, win 29200, options [mss 1400,nop,nop,sackOK,nop,wscale 7], length 0
15:52:26.570270 IP (tos 0x0, ttl 63, id 9552, offset 0, flags [DF], proto TCP (6), length 40)
192.168.18.200.41034 > 192.168.16.218.https: Flags [R], cksum 0x03e1 (correct), seq 1032333183, win 0, length 0
15:52:28.573661 IP (tos 0x0, ttl 63, id 6307, offset 0, flags [DF], proto TCP (6), length 52)
192.168.18.200.41034 > 192.168.16.218.https: Flags [S], cksum 0x513e (correct), seq 1032333182, win 29200, options [mss 1400,nop,nop,sackOK,nop,wscale 7], length 0
15:52:28.574321 IP (tos 0x0, ttl 63, id 10776, offset 0, flags [DF], proto TCP (6), length 40)
192.168.18.200.41034 > 192.168.16.218.https: Flags [R], cksum 0x03e1 (correct), seq 1032333183, win 0, length 0
15:52:32.577927 IP (tos 0x0, ttl 63, id 6308, offset 0, flags [DF], proto TCP (6), length 52)
192.168.18.200.41034 > 192.168.16.218.https: Flags [S], cksum 0x513e (correct), seq 1032333182, win 29200, options [mss 1400,nop,nop,sackOK,nop,wscale 7], length 0
15:52:32.578604 IP (tos 0x0, ttl 63, id 13410, offset 0, flags [DF], proto TCP (6), length 40)
192.168.18.200.41034 > 192.168.16.218.https: Flags [R], cksum 0x03e1 (correct), seq 1032333183, win 0, length 0
15:52:40.594269 IP (tos 0x0, ttl 63, id 6309, offset 0, flags [DF], proto TCP (6), length 52)
192.168.18.200.41034 > 192.168.16.218.https: Flags [S], cksum 0x513e (correct), seq 1032333182, win 29200, options [mss 1400,nop,nop,sackOK,nop,wscale 7], length 0
15:52:40.594906 IP (tos 0x0, ttl 63, id 19809, offset 0, flags [DF], proto TCP (6), length 40)
192.168.18.200.41034 > 192.168.16.218.https: Flags [R], cksum 0x03e1 (correct), seq 1032333183, win 0, length 0
15:52:56.643423 IP (tos 0x0, ttl 63, id 6310, offset 0, flags [DF], proto TCP (6), length 52)
192.168.18.200.41034 > 192.168.16.218.https: Flags [S], cksum 0x513e (correct), seq 1032333182, win 29200, options [mss 1400,nop,nop,sackOK,nop,wscale 7], length 0
15:52:56.644167 IP (tos 0x0, ttl 63, id 33143, offset 0, flags [DF], proto TCP (6), length 40)
192.168.18.200.41034 > 192.168.16.218.https: Flags [R], cksum 0x03e1 (correct), seq 1032333183, win 0, length 0
15:53:28.709344 IP (tos 0x0, ttl 63, id 6311, offset 0, flags [DF], proto TCP (6), length 52)
192.168.18.200.41034 > 192.168.16.218.https: Flags [S], cksum 0x513e (correct), seq 1032333182, win 29200, options [mss 1400,nop,nop,sackOK,nop,wscale 7], length 0
15:53:28.709799 IP (tos 0x0, ttl 63, id 48301, offset 0, flags [DF], proto TCP (6), length 40)
192.168.18.200.41034 > 192.168.16.218.https: Flags [R], cksum 0x03e1 (correct), seq 1032333183, win 0, length 0
以上都是用域名请求的,客户端能解析到实际的内网 IP 且服务端能监听到请求,我认为网络层是通的,现在就是没有发送到 nginx 里。
使用 curl 对 IP 请求是这样请求的: https://IP:port/assets,可以正常得到返回信息。
另外就是 /proc/sys/net/ipv4/tcp_tw_recycle 这个值是 0