跨独立服务器的Apache2反向代理WebSocket网站配置故障排查求助

大家好，我正在尝试用Apache2做反向代理，把一个带WebSocket功能的网站代理到我的域名上，但网站服务器和反向代理服务器是完全隔离的两台独立机器。我按常规反向代理配置设置后一直没法正常运行，想请各位帮忙排查下问题。

我的Apache虚拟主机配置如下：

<VirtualHost *:443>

ServerName domain

ProxyPreserveHost On

ProxyRequests off

<Location />
ProxyPass  http://ip:80/
ProxyPassReverse  http://ip:80/
</Location>

<Location /sub>
ProxyPass  wss://ip:443/
ProxyPassReverse  wss://ip:443/
</Location>

RewriteEngine on

RewriteRule ^/\.well-known/host-meta /public.php?service=host-meta [QSA,L]
RewriteRule ^/\.well-known/host-meta\.json /public.php?service=host-meta-json [QSA,L]
RewriteRule ^/\.well-known/webfinger /index.php/.well-known/webfinger [R=301,L]
RewriteRule ^/\.well-known/carddav /remote.php/dav/ [R=301,L]
RewriteRule ^/\.well-known/caldav /remote.php/dav/ [R=301,L]
RewriteRule ^/\.well-known/nodeinfo /index.php/.well-known/nodeinfo [R=301,L]

RewriteCond ${HTTP:Upgrade} websocket [NC]
RewriteCond ${HTTP:Connection} upgrade [NC]
RewriteRule .* "wss:/ip:443/$1" [P,L]

Protocols h2 http/1.1

Header always set Strict-Transport-Security: "max-age=63072000; includeSubDomains; preload"
Header set Content-Security-Policy "frame-ancestors 'self';"

SSLEngine on
SSLProtocol             all -SSLv3 +TLSv1.2 +TLSv1.3
SSLHonorCipherOrder     on
SSLSessionTickets       off
SSLUseStapling on
SSLStaplingResponderTimeout 5
SSLStaplingReturnResponderErrors off
SSLCertificateFile      /etc/letsencrypt/live/cert/fullchain.pem
SSLCertificateKeyFile   /etc/letsencrypt/live/cert/privkey.pem

</VirtualHost>

查看Apache错误日志，得到以下报错：

[Wed May 10 16:31:11.198085 2023] [proxy:error] [pid 54233:tid 139683125876288] (111)Connection refused: AH00957: wss: attempt to connect to ip:443 (ip:443) failed
[Wed May 10 16:31:11.198130 2023] [proxy_http:error] [pid 54233:tid 139683125876288] [client ip:52037] AH01114: HTTP: failed to make connection to backend: ip

我自己试过检查基础连通性，但还是没找到问题根源，想请教各位有什么排查方向或者配置修正建议？

排查方向与修正建议 #

我梳理了几个可能的问题点，也给遇到类似问题的朋友做个参考：

• 先修正语法错误：配置里的RewriteRule存在明显问题，wss:/ip:443/$1少了一个斜杠，应该是wss://ip:443/$1；而且原正则.*没有捕获分组，$1是空值，建议改成^/?(.*)来正确捕获请求路径，修正后的规则：

  RewriteCond %{HTTP:Upgrade} websocket [NC]
  RewriteCond %{HTTP:Connection} upgrade [NC]
  RewriteRule ^/?(.*) wss://你的后端ip:443/$1 [P,L]
  

• 验证网络连通性：因为两台服务器是隔离的，先确认反向代理机器能访问后端的443端口，用nc -zv 后端ip 443或者telnet 后端ip 443测试，要是连接失败，先检查两台机器的防火墙/安全组规则，开放443端口的通行权限。
• 确认后端服务监听状态：在后端服务器上用ss -tulpn | grep :443查看是否有进程在监听443端口，确保WebSocket服务确实运行在这个端口上；如果后端WebSocket是用HTTP（ws://）而非HTTPS，那要把代理目标改成ws://后端ip:对应端口/$1，同时开放对应端口。
• 优化WebSocket代理规则：Apache处理WebSocket更推荐用Rewrite规则统一处理，而非单独在Location里配置wss://，避免规则冲突，可以考虑注释掉<Location /sub>那段配置，用Rewrite规则覆盖所有WebSocket请求。
• 重启服务测试：修改配置后记得重启Apache（systemctl restart apache2），然后用浏览器开发者工具查看Network里的WebSocket请求状态，确认连接是否建立。

备注：内容来源于stack exchange，提问作者T0b1a5