1

I have nginx as reverse proxy and apache in the back, a firewall setup to enable just http and https, and ssh.

netstat -tlupna gives me tens of lines with multiple TIME_WAIT or ESTABLISHED lines coming from plenty of IPs:80 and IPs:443 into my server.

There were few ESTABLISHED connections to ports on my server that I did not recognize. I assumed the firewall took care of these? So how come there is an established connection from an external IP to a port that I have not opened? Is this suspicious?

How can I stop these attempts to access all my ports?

netstat -tlupna

tcp 0 0 MY_PUBLIC_IP_ADDRESS:57354 zzz.abc.239.34:80 TIME_WAIT -
tcp 0 0 MY_PUBLIC_IP_ADDRESS:36234 zzz.xyz.108.108:80 TIME_WAIT -
tcp 0 0 MY_PUBLIC_IP_ADDRESS:37014 xxx.abc.120.90:443 TIME_WAIT -
tcp 0 0 MY_PUBLIC_IP_ADDRESS:48508 xxx.xyz.40.40:443 TIME_WAIT -
tcp 0 0 MY_PUBLIC_IP_ADDRESS:40396 xxx.abc.23.31:443 TIME_WAIT -
tcp 0 0 MY_PUBLIC_IP_ADDRESS:35614 xxx.xyz.151.18:80 TIME_WAIT -
tcp 0 0 MY_PUBLIC_IP_ADDRESS:37828 xxx.abc.101.102:443 TIME_WAIT -
tcp 0 0 MY_PUBLIC_IP_ADDRESS:42258 xxx.xyz.64.171:80 TIME_WAIT -
tcp 0 0 MY_PUBLIC_IP_ADDRESS:12346 xxx.abc.160.70:443 TIME_WAIT -
tcp 0 0 MY_PUBLIC_IP_ADDRESS:12345 xxx.xyz.16.132:443 TIME_WAIT -
tcp 0 0 MY_PUBLIC_IP_ADDRESS:xxx xxx.abc.xxx.xxx:443 ESTABLISHED xxx/nginx: worker [

tcp 0 0 MY_PUBLIC_IP_ADDRESS:37702 xxx.xyz.181.15:443 TIME_WAIT -
tcp 0 0 MY_PUBLIC_IP_ADDRESS:52380 xxx.abc.97.16:80 TIME_WAIT -
tcp 0 0 MY_PUBLIC_IP_ADDRESS:37032 xxx.xyz.120.90:443 TIME_WAIT -
tcp 0 0 MY_PUBLIC_IP_ADDRESS:54220 xxx.abc.dc.123:80 TIME_WAIT -
tcp 0 0 MY_PUBLIC_IP_ADDRESS:33324 xxx.abc.ab.123:443 TIME_WAIT -

0

How can I stop these attempts to access all my ports?

These are not attempts to access your ports. These are connections originating from your system to remote servers.

It is nothing known about your system setup. But given that at least one of the entries seems to originate from nginx (or at least a process claiming to be nginx) it might be that your system is configured as an open proxy, i.e. allowing others to use your system to access arbitrary servers while hiding their original source IP. But again, due to missing information this is just speculation.

8
  • Thanks for the insight! I have nothing else on that server than nginx and apache servers and sshd. The webpage only points to one html files with helloworld on display. I am learning the setup process at the moment. How do I know if my nginx is acting as an open proxy?
    – myke
    Oct 24 at 19:21
  • @myke: Try to use it as a proxy, i.e. something like curl -x proxy_ip:proxy_port http://example.com Oct 24 at 19:45
  • I tried it - I get the TIME_WAIT line only when I enter proxy_ip:443 example.com. or proxy_ip:80 example.com. I get no other outputs when I try the other ports that were listed. 54220, etc... The reverse proxy is on the same machine as apache.
    – myke
    Oct 24 at 20:40
  • @myke: "I get the TIME_WAIT line only when I enter proxy_ip:443 example.com. or proxy_ip:80 example.com." - Looks like your nginx is configured as an open proxy based on this description. Oct 24 at 20:43
  • Thank you so much! Any suggestion/links for hardening my reverse proxy and making it a closed proxy? None of my searches address the closed proxy setup. This is for Centos7
    – myke
    Oct 24 at 21:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.