部署在EC2上的站点请求Node Express服务器返回ERR_CONNECTION_REFUSED

问题现象 #

• 浏览器向Node Express服务器发起请求时，收到ERR_CONNECTION_REFUSED错误，示例：

  POST http://localhost:9000/api/search net::ERR_CONNECTION_REFUSED
  

• Chrome控制台发起的请求同样被拒绝，但在EC2终端使用curl发起请求时，可成功获取JSON响应。

相关配置信息 #

Nginx配置（nginx.conf） #

server {
  listen 80 default_server;

  server_name _;

  location / {
      root /usr/share/nginx/html;
      include /etc/nginx/mime.types;
      try_files $uri $uri/ /index.html;
      add_header 'Access-Control-Allow-Headers' *;
      add_header 'Access-Control-Allow-Origin' *;
      add_header 'Access-Control-Allow-Methods' *;
  }

  location /sockjs-node {
      proxy_pass http://localhost:80;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "Upgrade";
  }

  location /api {
      proxy_pass http://localhost:9000;
  }
}

EC2实例防火墙状态（sudo ufw status） #

Status: active
    To                         Action      From
    --                         ------      ----
    OpenSSH                    ALLOW       Anywhere
    Nginx Full                 ALLOW       Anywhere
    9000                       ALLOW       Anywhere
    OpenSSH (v6)               ALLOW       Anywhere (v6)
    Nginx Full (v6)            ALLOW       Anywhere (v6)
    9000 (v6)                  ALLOW       Anywhere (v6)

端口监听状态（netstat -tunlp） #

(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      -
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -
tcp        0      0 127.0.0.1:27017         0.0.0.0:*               LISTEN      -
tcp6       0      0 :::22                   :::*                    LISTEN      -
tcp6       0      0 :::9000                 :::*                    LISTEN      -
udp        0      0 127.0.0.53:53           0.0.0.0:*                           -
udp        0      0 172.31.2.45:68          0.0.0.0:*                           -
udp        0      0 127.0.0.1:323           0.0.0.0:*                           -
udp6       0      0 ::1:323                 :::*                                -

EC2安全组规则 #

当前临时解决方案 #

将前端所有fetch请求的目标地址从localhost改为EC2实例的公网IP后，请求可正常响应，但EC2重启后公网IP会变化，需要更稳定的替代方案。

内容的提问来源于stack exchange，提问作者Pablo T