# Nginx with Varnish as a proxy. Phantom Port 80

**URL:** <https://www.ruby-forum.com/t/nginx-with-varnish-as-a-proxy-phantom-port-80/244389>\
**Category:** NGINX\
**Created:** [April 1, 2016, 6:29am UTC](https://www.ruby-forum.com/t/nginx-with-varnish-as-a-proxy-phantom-port-80/244389 "2016-04-01T06:29:59Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sadaf\_N](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/858c86/32.png) [@Sadaf\_N](https://www.ruby-forum.com/u/Sadaf_N)\
**Post date:** [April 1, 2016, 6:29am UTC](https://www.ruby-forum.com/t/nginx-with-varnish-as-a-proxy-phantom-port-80/244389/1 "2016-04-01T06:29:59Z")

</div>

Hi,

I’m having an odd problem here. I’m trying to set up nginx with a  
varnish  
proxy in front of it. The box is Ubuntu 15.10, nginx 1.9.3, varnish  
4.0.3.

For testing I set up varnish on port 8080, and nginx was running on port  
80  
and 443. I shut down both, edit the config files so that varnish is  
listening on port 80 and forwarding to the nginx backend on 8080. I do a  
search and replace on all the listen directives in  
/etc/nginx/sites-enabled  
to change listen 80 to listen 8080.

When I restart nginx, it comes up listening on port 8080 and 443 as  
expected, but ALSO on port 80. This means varnish is unable to start up  
as  
the port is already bound.

tcp 0 0 0.0.0.0:80 0.0.0.0:\*  
LISTEN  
17514/nginx -g daem  
tcp 0 0 0.0.0.0:8080 0.0.0.0:\*  
LISTEN  
17514/nginx -g daem  
tcp 0 0 0.0.0.0:443 0.0.0.0:\*  
LISTEN  
17514/nginx -g daem

I’ve checked through the nginx conf files many times. There are no other  
listen 80 directives. I’ve also tried putting a server block in the main  
nginx.conf with listen 8080 in it, but that doesn’t help.

I think the problem may be that this system is confused between systemd  
and  
init.d. I was having trouble with varnish in this respect. However I’ve  
checked all the systemd files and none of them mention a port, and the  
/etc/init.d/nginx file doesn’t either.

Why is nginx using port 80? And how to stop it! Any pointers gratefully  
received.

Posted at Nginx Forum:

> **[Nginx with Varnish as a proxy. Phantom Port 80](https://forum.nginx.org/read.php?2,265791,265791#msg-265791)**
>
> Hi, I'm having an odd problem here. I'm trying to set up nginx with a varnish proxy in front of it. The box is Ubuntu 15.10, nginx 1.9.3, varnish 4.0.3. For testing I set up varnish on port 8080, and nginx was running on port 80 and 443. I shut down...

---

<div class="post-metadata">

**Author:** ![plutocrat](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/e480ec/32.png) [@plutocrat](https://www.ruby-forum.com/u/plutocrat)\
**Post date:** [April 1, 2016, 6:33am UTC](https://www.ruby-forum.com/t/nginx-with-varnish-as-a-proxy-phantom-port-80/244389/2 "2016-04-01T06:33:30Z")

</div>

Without showing your nginx config it’s unlikely that anyone will be able  
to  
troubleshoot. Likely there is a stray listen directive that’s causing  
this.

On Thu, Mar 31, 2016 at 9:29 PM, plutocrat [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![plutocrat](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/e480ec/32.png) [@plutocrat](https://www.ruby-forum.com/u/plutocrat)\
**Post date:** [April 1, 2016, 6:43am UTC](https://www.ruby-forum.com/t/nginx-with-varnish-as-a-proxy-phantom-port-80/244389/3 "2016-04-01T06:43:26Z")

</div>

## Robert P. Wrote:

> Without showing your nginx config it’s unlikely that anyone will be able  
> to  
> troubleshoot. Likely there is a stray listen directive that’s causing  
> this.

There are no stray listen directives. I’ve checked many times.  
grep -ril listen /etc/nginx  
Shows only files in sites-enabled and sites-available directories.  
grep -i listen /etc/nginx/sites-enabled  
Shows only port 8080  
grep 80 /etc/nginx/sites-enabled  
Shows only port 8080  
I’ve also manually opened all files and verified just in case my  
grepping  
skills were failing. I’ve checked probably 10 times. This is why I can’t  
figure it out and came to ask the mailing list! 🙂

Posted at Nginx Forum:  
[https://forum.nginx.org/read.php?2,265791,265793#msg-265793](https://forum.nginx.org/read.php?2,265791,265793#msg-265793)

---

<div class="post-metadata">

**Author:** ![plutocrat](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/e480ec/32.png) [@plutocrat](https://www.ruby-forum.com/u/plutocrat)\
**Post date:** [April 1, 2016, 6:47am UTC](https://www.ruby-forum.com/t/nginx-with-varnish-as-a-proxy-phantom-port-80/244389/4 "2016-04-01T06:47:31Z")

</div>

I’m sure the mailing list would be happy to help if you would provide  
your  
config files so that debugging doesn’t involve reading your mind 🙂

On Thu, Mar 31, 2016 at 9:42 PM, plutocrat [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![plutocrat](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/e480ec/32.png) [@plutocrat](https://www.ruby-forum.com/u/plutocrat)\
**Post date:** [April 1, 2016, 7:41am UTC](https://www.ruby-forum.com/t/nginx-with-varnish-as-a-proxy-phantom-port-80/244389/5 "2016-04-01T07:41:51Z")

</div>

So, just to be clear, these are the ones running now without varnish. Of  
course the lines with listen 80 are changed to listen 8080, and when I  
restart nginx, it appears on ports 80, 8080 and 443.

Posted at Nginx Forum:

> **[Re: Nginx with Varnish as a proxy. Phantom Port 80](https://forum.nginx.org/read.php?2,265791,265796#msg-265796)**
>
> Hi, I'm having an odd problem here. I'm trying to set up nginx with a varnish proxy in front of it. The box is Ubuntu 15.10, nginx 1.9.3, varnish 4.0.3. For testing I set up varnish on port 8080, and nginx was running on port 80 and 443. I shut down...

---

<div class="post-metadata">

**Author:** ![plutocrat](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/e480ec/32.png) [@plutocrat](https://www.ruby-forum.com/u/plutocrat)\
**Post date:** [April 1, 2016, 7:38am UTC](https://www.ruby-forum.com/t/nginx-with-varnish-as-a-proxy-phantom-port-80/244389/6 "2016-04-01T07:38:20Z")

</div>

# OK, was trying to keep the post relevant and succinct, but here goes with the config. Its a newly set up server, so pretty much standard.

# cat nginx.conf

user www-data;  
worker\_processes auto;  
pid /run/nginx.pid;

events {  
worker\_connections 768;

# multi\_accept on;

}

http {

# required for letsencrypt verification

```
    server {

            location ~ /.well-known/acme-challenge/(.*) {
                    default_type text/plain;
            }
    }

```

## 

# Basic Settings

## 

sendfile on;  
tcp\_nopush on;  
tcp\_nodelay on;  
keepalive\_timeout 65;  
types\_hash\_max\_size 2048;

# server\_tokens off;

# server\_names\_hash\_bucket\_size 64;

# server\_name\_in\_redirect off;

include /etc/nginx/mime.types;  
default\_type application/octet-stream;

## 

# SSL Settings

## 

ssl\_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE  
ssl\_prefer\_server\_ciphers on;

## 

# Logging Settings

## 

access\_log /var/log/nginx/access.log;  
error\_log /var/log/nginx/error.log;

## 

# Gzip Settings

## 

gzip on;  
gzip\_disable “msie6”;

# gzip\_vary on;

# gzip\_proxied any;

# gzip\_comp\_level 6;

# gzip\_buffers 16 8k;

# gzip\_http\_version 1.1;

# gzip\_types text/plain text/css application/json

application/javascript  
text/xml application/xml application/xml+rss text/javascript;

## 

# Virtual Host Configs

## 

include /etc/nginx/conf.d/_.conf;  
include /etc/nginx/sites-enabled/_;  
}

# =========================== nothing at all in ./conf.d/

> cat sites-enabled/default

# Default server configuration

# 

server {

# handles anything going to numeric IP address.

listen 80 default\_server;

root /var/www/html;

# Add index.php to the list if you are using PHP

index index.html index.php index.htm index.nginx-debian.html;

server\_name localhost 16.17.18.19;

location / {  
# First attempt to serve request as file, then  
# as directory, then fall back to displaying a 404.  
try\_files $uri $uri/ =404;  
}

error\_page 404 /404.html;  
error\_page 500 502 503 504 /50x.html;  
location = /50x.html {  
root /usr/share/nginx/html;  
}

}

=======================================================  
$\> cat sites-enabled/domain1.com.

server {  
listen 80;

```
    server_name www.domain1.com domain1.com;
    root /home/user/domains/domain1.com/public_html/public;
    access_log /home/user/domains/domain1.com/logs/access.log;
    error_log /home/user/domains/domain1.com/logs/error.log;

    index index.php index.html index.htm;
    error_page 404 /404.html;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    # Pass PHP scripts to PHP-FPM
    location ~ \.php$ {
        try_files $uri =403;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/var/run/php/php7.0-fpm-user.sock;
        include fastcgi_params;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME

```

$document\_root$fastcgi\_script\_name;  
}

```
    # Enable browser cache for CSS / JS
    location ~* \.(?:css|js)$ {
        expires 2d;
        add_header Pragma "public";
        add_header Cache-Control "public";
        add_header Vary "Accept-Encoding";
    }

    # Enable browser cache for static files
    location ~*

```

.(?:ico|jpg|jpeg|gif|png|bmp|webp|tiff|svg|svgz|pdf|mp3|flac|ogg|mid|midi|wav|mp4|webm|mkv|ogv|wmv|eot|otf|woff|ttf|rss|atom|zip|7z|tgz|gz|rar|bz2|tar|exe|doc|docx|xls|xlsx|ppt|pptx|rtf|odt|ods|odp)$  
{  
expires 5d;  
add\_header Pragma “public”;  
add\_header Cache-Control “public”;  
}

```
    # Prevent logging of favicon and robot request errors
    location = /favicon.ico { log_not_found off; access_log off; }
    location = /robots.txt { log_not_found off; access_log off; }

```

}

server {  
listen 443;  
server\_name [www.domain1.com](http://www.domain1.com) [domain1.com](http://domain1.com);  
root /home/user/domains/domain1.com/public\_html;  
access\_log /home/user/domains/domain1.com/logs/access.log;  
error\_log /home/user/domains/domain1.com/logs/error.log;

```
    index index.php index.html index.htm;
    error_page 404 /404.html;

    ssl on;
    ssl_certificate /etc/letsencrypt/live/domain1.com/fullchain.pem;
    ssl_certificate_key 

```

/etc/letsencrypt/live/domain1.com/privkey.pem;

```
    ssl_session_timeout 5m;

    ssl_protocols SSLv2 SSLv3 TLSv1;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
    index index.php index.html index.htm;
    error_page 404 /404.html;

    location / {
        try_files $uri $uri/ /index.php?$args;
    }

    # Pass PHP scripts to PHP-FPM
    location ~ \.php$ {
        try_files $uri =403;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/var/run/php/php7.0-fpm-user.sock;
        include fastcgi_params;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME

```

$document\_root$fastcgi\_script\_name;  
}

```
    # Enable browser cache for CSS / JS
    location ~* \.(?:css|js)$ {
        expires 2d;
        add_header Pragma "public";
        add_header Cache-Control "public";
        add_header Vary "Accept-Encoding";
    }

    # Enable browser cache for static files
    location ~*

```

.(?:ico|jpg|jpeg|gif|png|bmp|webp|tiff|svg|svgz|pdf|mp3|flac|ogg|mid|midi|wav|mp4|webm|mkv|ogv|wmv|eot|otf|woff|ttf|rss|atom|zip|7z|tgz|gz|rar|bz2|tar|exe|doc|docx|xls|xlsx|ppt|pptx|rtf|odt|ods|odp)$  
{  
expires 5d;  
add\_header Pragma “public”;  
add\_header Cache-Control “public”;  
}

```
    # Prevent logging of favicon and robot request errors
    location = /favicon.ico { log_not_found off; access_log off; }
    location = /robots.txt { log_not_found off; access_log off; }

```

}

===========  
There are three other domains in this directory, all created by copying  
and  
editing the domain1 file. So nothing extra in there. You’ll just have to  
take my word for it that the listen directives are all the same.

Posted at Nginx Forum:  
[https://forum.nginx.org/read.php?2,265791,265795#msg-265795](https://forum.nginx.org/read.php?2,265791,265795#msg-265795)

---

<div class="post-metadata">

**Author:** ![plutocrat](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/e480ec/32.png) [@plutocrat](https://www.ruby-forum.com/u/plutocrat)\
**Post date:** [April 1, 2016, 9:12am UTC](https://www.ruby-forum.com/t/nginx-with-varnish-as-a-proxy-phantom-port-80/244389/7 "2016-04-01T09:12:23Z")

</div>

On Fri, Apr 01, 2016 at 12:42:57AM -0400, plutocrat wrote:

Hi there,

> There are no stray listen directives. I’ve checked many times.  
> grep -ril listen /etc/nginx  
> Shows only files in sites-enabled and sites-available directories.  
> grep -i listen /etc/nginx/sites-enabled  
> Shows only port 8080  
> grep 80 /etc/nginx/sites-enabled  
> Shows only port 8080

> **[Module ngx\_http\_core\_module](http://nginx.org/en/docs/http/ngx_http_core_module.html#listen)**
>
> This directive appeared in version 1.11.8.

“Default” there means that if a server{} block does not have any listen  
directive, it is equivalent to “listen \*:80” (or “listen \*:8080” if  
running as non-root).

Your “letsencrypt” server{} block does not have any listen directive.

So add one there – and to any other similar blocks – or do not start  
nginx as root (and therefore be unable to listen to any port below  
1024).

## f

Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![plutocrat](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/e480ec/32.png) [@plutocrat](https://www.ruby-forum.com/u/plutocrat)\
**Post date:** [April 1, 2016, 9:17am UTC](https://www.ruby-forum.com/t/nginx-with-varnish-as-a-proxy-phantom-port-80/244389/8 "2016-04-01T09:17:04Z")

</div>

On Fri, Apr 01, 2016 at 08:12:12AM +0100, Francis D. wrote:

> On Fri, Apr 01, 2016 at 12:42:57AM -0400, plutocrat wrote:

One silly typo and thinko…

> [Module ngx\_http\_core\_module](http://nginx.org/r/listen)
> 
> “Default” there means that if a server{} block does not have any listen  
> directive, it is equivalent to “listen \*:80” (or “listen \*:8080” if

8000, not 8080.

> running as non-root).
> 
> Your “letsencrypt” server{} block does not have any listen directive.
> 
> So add one there – and to any other similar blocks – or do not start  
> nginx as root (and therefore be unable to listen to any port below 1024).

“start as not root” would listen on 8000; and would fail to listen on  
443.

So adding an explicit “listen” to every server{} block without one is  
the way to go.

## f

Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![plutocrat](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/e480ec/32.png) [@plutocrat](https://www.ruby-forum.com/u/plutocrat)\
**Post date:** [April 1, 2016, 12:34pm UTC](https://www.ruby-forum.com/t/nginx-with-varnish-as-a-proxy-phantom-port-80/244389/9 "2016-04-01T12:34:31Z")

</div>

## Francis D. Wrote:

> “Default” there means that if a server{} block does not have any  
> listen directive, it is equivalent to “listen \*:80” (or “listen \*:8080”  
> if  
> running as non-root).
> 
> Your “letsencrypt” server{} block does not have any listen directive.

Oh wow. It was that simple. Thanks. I probably should have found it, but  
when you start going around in circles its hard to break out. Adding a  
listen directive to the letsencrypt server {} block fixed it.

Posted at Nginx Forum:  
[https://forum.nginx.org/read.php?2,265791,265803#msg-265803](https://forum.nginx.org/read.php?2,265791,265803#msg-265803)