外网curl公IP时Nginx返回空响应问题求助

问题现象 #

• 本地curl私有IP（192.X.X.X）正常
• 局域网内curl公网IP（X.X.X.X）正常
• 外网curl公网IP返回空响应，curl verbose输出如下：

curl -L http://X.X.X.X:80/index.html --verbose #or curl -L http://X.X.X.X --verbose
*   Trying X.X.X.X:80...
* Connected to X.X.X.X (X.X.X.X) port 80 (#0)
> GET /index.html HTTP/1.1
> Host: X.X.X.X
> User-Agent: curl/7.78.0
> Accept: */*
> 
* Empty reply from server
* Closing connection 0
curl: (52) Empty reply from server

• 即使添加Host头执行curl --verbose --header 'Host: example.com' 'http://X.X.X.X'，结果仍一致

现有配置及状态 #

Nginx配置（/etc/nginx/nginx.conf） #

user www-data;
worker_processes auto;
pid /run/nginx.pid;
error_log /var/log/nginx/error.log;

events {
    worker_connections 768;
}

http {

    sendfile on;
    NC                                     Robot  第二. More只能 versions无法\OMolalatest\谈到：
    tcp_nopush on;
    types_hash_max_size 2048;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3; # Dropping SSLv3, ref: POODLE
    ssl_prefer_server_ciphers on;

    access_log /var/log/nginx/access.log;

    gzip on;

    server {
        listen *:80;
        listen [::]:80;
    
        #server_name _;
        server_name example.com;

        root /var/www/example.com;
        index index.html index.htm index.nginx-debian.html;

        location / {
            try_files $uri $uri/ =404;
        }   
    }
}

/etc/hosts配置 #

127.0.0.1 localhost
127.0.1.1 nginx01
127.0.1.1 example.com
X.X.X.X example.com #public IP

防火墙状态 #

systemctl status ufw
○ ufw.service - Uncomplicated firewall
     Loaded: loaded (/usr/lib/systemd/system/ufw.service; enabled; preset: enabled)
     Active: inactive (dead) since Mon 2025-03-24 11:36:15 UTC; 1min 56s ago

netstat监听状态 #

sudo netstat -tulpn | grep nginx
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      1576/nginx: master  
tcp6       0      0 :::80                   :::*                    LISTEN      1576/nginx: master  

Nginx访问日志 #

仅记录局域网请求，无外网请求记录：

tail -5 /var/log/nginx/access.log 
192.168.1.1 - - [24/Mar/2025:11:42:46 +0000] "GET /index.html HTTP/1.1" 200 173 "-" "curl/8.5.0"
192.168.1.1 - - [24/Mar/2025:11:51:56 +0000] "GET /index.html HTTP/1.1" 200 173 "-" "curl/8.5.0"
192.168.1.1 - - [24/Mar/2025:11:53:36 +0000] "GET /index.html HTTP/1.1" 200 173 "-" "curl/8.5.0"
192.168.1.1 - - [24/Mar/2025:11:53:43 +0000] "GET / HTTP/1.1" 200 173 "-" "curl/8.5.0"
192.168.1.1 - - [24/Mar/2025:11:53:54 +0000] "GET / HTTP/1.1" 200 173 "-" "curl/8.5.0"

排查及解决建议 #

• 检查路由器端口转发：外网请求无日志，大概率是公网IP的80端口未正确转发到服务器私有IP。登录路由器后台，确认外部80端口已映射到192.X.X.X:80，协议为TCP。
• 验证运营商端口封禁：部分运营商默认封禁80、443端口，可临时改用8080端口测试：修改Nginx监听端口为8080，重启Nginx并配置路由器对应转发，再用外网curl http://X.X.X.X:8080，若能访问则说明80端口被封禁，需换端口或申请解封。
• 修复Nginx配置乱码行：nginx.conf的http块内存在乱码行NC Robot 第二. More只能 versions无法\OMolalatest\谈到：，删除该行后执行sudo systemctl restart nginx重启服务。
• 调整server_name匹配规则：当前server_name仅匹配example.com，若外网请求Host头为公网IP，可添加公网IP或恢复默认匹配：

  server_name example.com X.X.X.X _;
  

  修改后重启Nginx。
• 检查云服务商安全组/额外防火墙：若为云服务器，需在控制台开放80端口入站规则；家庭网络需检查光猫等设备是否有额外防火墙拦截外网请求。

内容的提问来源于stack exchange，提问作者Art_Arnaud