NGINX Reverse Proxy terminate TCP connection after 5 minutes of inactivity

[J Carter]

Hello,

On Tue, 20 Feb 2024 11:57:27 +0800
Kin Seng <ckinseng at gmail.com> wrote:

> Hi J Carter,
> 
> Thank you for your reply.
> I am capturing the packet from firewall, and the filtering is as per below
> for the previously attached pcap.

I see, I assumed you had run tcpdump on the nginx
host. I'd reccomend doing that too then (as well as client app host) if
you have a network firewall in the mix - to see what nginx itself
truely sends/recieves.

> Source : client app -- Dest : nginx proxy , any port to any port
> 
> Source : public server -- Dest : nginx proxy , any port to any port
> 
> Source : nginx proxy -- Dest : client app , any port to any port
> 
> Source : nginx proxy -- Dest : public server , any port to any port.
> 

It shouldn't be missing such data then - although again, this may be
specific to the firewall itself.

> Perhaps I will try to do tcpdump from the client app as well.
> 
> One more info that I notice from client app host, from the netstat command,
> it shows CLOSE_WAIT for the terminated session, it seems like close_wait is
> the symbol that the closing is from external ( in this case client app is
> connect to nginx proxy), is this right?

close_wait on client would indicate that the other party initated
connection close (sent the first FIN) - again, firewall makes me more
skeptical, as it can have it's own timers for closing tcp connection /
it's own logic.