1

In the first 40-50 minutes after I restart my server (Apache with Ngintron) I get a 403 nginx error, and in the logs it says "access forbidden by rule". I have all my traffic redirected to HTTPS. This is my etc/nginx/common_https.conf:

# Common definitions for HTTPS content

# TLS/SSL common
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;

# Diffie-Hellman parameter for DHE ciphersuites (2048 bits)
ssl_dhparam /etc/ssl/certs/dhparam.pem;

# --- Protocols & Ciphers [start] ---

# Maximum client support [enabled by default]
# Supports Firefox 1, Android 2.3, Chrome 1, Edge 12, IE8 on Windows XP, Java 6, OpenSSL 0.9.8, Opera 5 & Safari 1
ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
ssl_ciphers / removed /;
ssl_prefer_server_ciphers on;

# Intermediate client support [disabled by default]
# Supports Firefox 27, Android 4.4.2, Chrome 31, Edge, IE 11 on Windows 7, Java 8u31, OpenSSL 1.0.1, Opera 20 & Safari 9
#ssl_protocols TLSv1.2 TLSv1.3;
#ssl_ciphers /removed/;
#ssl_prefer_server_ciphers off;

# Modern client support [disabled by default]
# Supports Firefox 63, Android 10.0, Chrome 70, Edge 75, Java 11, OpenSSL 1.1.1, Opera 57 & Safari 12.1
#ssl_protocols TLSv1.3;
#ssl_prefer_server_ciphers off;

# --- Protocols & Ciphers [finish] ---

# Set the port for HTTPS proxying
set $PROXY_TO_PORT 443;

# Include common definitions and rules with HTTP
include common_http.conf;

Could be the problem this rule: ssl_session_cache shared:SSL:50m; ?

And this is my etc/nginx/common_http.conf:

# Common definitions for HTTP content

# Initialize important variables
set $CACHE_BYPASS_FOR_DYNAMIC 0;
set $CACHE_BYPASS_FOR_STATIC 0;
set $PROXY_DOMAIN_OR_IP $host;
set $PROXY_FORWARDED_HOST $host;
set $PROXY_SCHEME $scheme;
set $SITE_URI "$host$request_uri";

# Generic query string to request a page bypassing Nginx's caching entirely for both dynamic & static content
if ($query_string ~* "nocache") {
    set $CACHE_BYPASS_FOR_DYNAMIC 1;
    set $CACHE_BYPASS_FOR_STATIC 1;
}

# Proxy requests to "localhost"
if ($host ~* "localhost") {
    set $PROXY_DOMAIN_OR_IP "127.0.0.1";
}

# Disable caching for cPanel specific subdomains
if ($host ~* "^(webmail|cpanel|whm|webdisk|cpcalendars|cpcontacts)\.") {
    set $CACHE_BYPASS_FOR_DYNAMIC 1;
    set $CACHE_BYPASS_FOR_STATIC 1;
}

# Fix Horde webmail forwarding
if ($host ~* "^webmail\.") {
    set $PROXY_FORWARDED_HOST '';
}

# Set custom rules like domain/IP exclusions or redirects here
include custom_rules;

location / {
    try_files $uri $uri/ u/backend;
}

location u/backend {
    include proxy_params_common;
    # === MICRO CACHING ===
    # Comment the following line to disable 1 second micro-caching for dynamic HTML content
    include proxy_params_dynamic;
}

# Enable browser cache for static content files (TTL is 1 hour)
location ~* \.(?:json|xml|rss|atom)$ {
    include proxy_params_common;
    include proxy_params_static;
    expires 1h;
}

# Enable browser cache for CSS / JS (TTL is 30 days)
location ~* \.(?:css|js)$ {
    include proxy_params_common;
    include proxy_params_static;
    expires 30d;
}

# Enable browser cache for images (TTL is 60 days)
location ~* \.(?:ico|jpg|jpeg|gif|png|webp)$ {
    include proxy_params_common;
    include proxy_params_static;
    expires 60d;
}

# Enable browser cache for archives, documents & media files (TTL is 60 days)
location ~* \.(?:3gp|7z|avi|bmp|bz2|csv|divx|doc|docx|eot|exe|flac|flv|gz|less|mid|midi|mka|mkv|mov|mp3|mp4|mpeg|mpg|odp|ods|odt|ogg|ogm|ogv|opus|pdf|ppt|pptx|rar|rtf|swf|tar|tbz|tgz|tiff|txz|wav|webm|wma|wmv|xls|xlsx|xz|zip)$ {
    set $CACHE_BYPASS_FOR_STATIC 1;
    include proxy_params_common;
    include proxy_params_static;
    expires 60d;
}

# Enable browser cache for fonts & fix u/font-face cross-domain restriction (TTL is 60 days)
location ~* \.(eot|ttf|otf|woff|woff2|svg|svgz)$ {
    include proxy_params_common;
    include proxy_params_static;
    expires 60d;
}

# Prevent logging of favicon and robot request errors
location = /favicon.ico {
    include proxy_params_common;
    include proxy_params_static;
    expires 60d;
    log_not_found off;
}

location = /robots.txt  {
    include proxy_params_common;
    include proxy_params_static;
    expires 1d;
    log_not_found off;
}

# Deny access to files like .htaccess or .htpasswd
location ~ /\.ht {
    deny all;
}

How do I troubleshoot further exactly which rule causes the issue?

Apache and Nginx errors in the same time frame in the first 50 minutes after restart or rebuild when the nginx 403 is on:

[Wed Feb 10 01:09:29.595626 2021] [core:notice] [pid 5040:tid 46978991481920] SELinux policy enabled; httpd running as context system_u:system_r:unconfined_service_t:s0
[Wed Feb 10 01:09:29.608925 2021] [:notice] [pid 5040:tid 46978991481920] ModSecurity for Apache/2.9.3 (http://www.modsecurity.org/) configured.
[Wed Feb 10 01:09:29.608949 2021] [:notice] [pid 5040:tid 46978991481920] ModSecurity: APR compiled version="1.7.0"; loaded version="1.7.0"
[Wed Feb 10 01:09:29.608959 2021] [:notice] [pid 5040:tid 46978991481920] ModSecurity: PCRE compiled version="8.32 "; loaded version="8.32 2012-11-30"
[Wed Feb 10 01:09:29.608967 2021] [:notice] [pid 5040:tid 46978991481920] ModSecurity: LUA compiled version="Lua 5.1"
[Wed Feb 10 01:09:29.608974 2021] [:notice] [pid 5040:tid 46978991481920] ModSecurity: YAJL compiled version="2.0.4"
[Wed Feb 10 01:09:29.608981 2021] [:notice] [pid 5040:tid 46978991481920] ModSecurity: LIBXML compiled version="2.9.7"
[Wed Feb 10 01:09:29.608988 2021] [:notice] [pid 5040:tid 46978991481920] ModSecurity: Status engine is currently disabled, enable it by set SecStatusEngine to On.
[Wed Feb 10 01:09:29.611715 2021] [suexec:notice] [pid 5040:tid 46978991481920] AH01232: suEXEC mechanism enabled (wrapper: /usr/sbin/suexec)
[Wed Feb 10 01:09:29.705545 2021] [mpm_worker:notice] [pid 5063:tid 46978991481920] AH00292: Apache/2.4.46 (cPanel) OpenSSL/1.1.1i mod_bwlimited/1.4 configured -- resuming normal operations
[Wed Feb 10 01:09:29.705625 2021] [core:notice] [pid 5063:tid 46978991481920] AH00094: Command line: '/usr/sbin/httpd'

2021/02/10 01:09:11 [error] 2292#2292: *9 access forbidden by rule, client: ::ffff:83.137.6.171, server: localhost, request: "GET / HTTP/2.0", host: "example.com"
2021/02/10 01:09:11 [error] 2292#2292: *9 access forbidden by rule, client: ::ffff:83.137.6.171, server: localhost, request: "GET /favicon.ico HTTP/2.0", host: "example.com", referrer: "https://example.com/"
2021/02/10 01:09:14 [error] 2292#2292: *9 access forbidden by rule, client: ::ffff:83.137.6.171, server: localhost, request: "GET / HTTP/2.0", host: "example.com"
2021/02/10 01:09:14 [error] 2292#2292: *9 access forbidden by rule, client: ::ffff:83.137.6.171, server: localhost, request: "GET /favicon.ico HTTP/2.0", host: "example.com", referrer: "https://example.com/"
9
  • Do you know what request URL is causing this? You also have several includes, and this one in particular: include custom_rules; looks like it could be anything?! Does this 403 response reoccur? Or does it literally only once after 40-50 mins?! Is it occuring without any visitor traffic?
    – MrWhite
    Feb 25 '21 at 23:52
  • Hi, all request URL's are causing this. Here is output from "sudo nginx -T" with the actual configuration if that helps regarding the includes: github.com/internetwiki/nginx-config/blob/main/nginxconfig
    – Mobil Home
    Feb 26 '21 at 14:06
  • What is Ngintron? Google isn't giving me any relevant results for it. What does it do? Does it have a website? It sounds like it might be connecting Nginx and Apache or it might be making Apache act like Nginx? Feb 27 '21 at 9:59
  • Sorry for the spelling, sometimes they spell it engintron, but in my WHM/CPanel interface it's called Ngintron. engintron.com It's a reverse caching nginx proxy in front of Apache, implemented in CPanel.
    – Mobil Home
    Feb 27 '21 at 14:13
  • "all request URL's are causing this" - So, your site is completely inaccessible? But only after 40-50 minutes?!
    – MrWhite
    Feb 27 '21 at 15:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.