1

I'm trying to create a Node server with express. I did the following:

npm init
npm i express

and copied this sample code from express:

const express = require('express')
const app = express()

app.get('/', function (req, res) {
  res.send('Hello World!')
})

app.listen(80, function () {
  console.log('Example app listening on port 80!')
})

On localhost, that works. On my VPS from OVH, I got this issue that I solved with:

setcap 'cap_net_bind_service=+ep' $(which node)

I also have the following Firewall configuration:

# Vider les tables actuelles
iptables -t filter -F

# Vider les règles personnelles
iptables -t filter -X

# Interdire toute connexion entrante et sortante
iptables -t filter -P INPUT DROP
iptables -t filter -P FORWARD DROP
iptables -t filter -P OUTPUT DROP

# ---

# Ne pas casser les connexions etablies
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

# Autoriser loopback
iptables -t filter -A INPUT -i lo -j ACCEPT
iptables -t filter -A OUTPUT -o lo -j ACCEPT

# ICMP (Ping)
iptables -t filter -A INPUT -p icmp -j ACCEPT
iptables -t filter -A OUTPUT -p icmp -j ACCEPT

# ---

# SSH In
iptables -t filter -A INPUT -p tcp --dport 22 -j ACCEPT

# SSH Out
iptables -t filter -A OUTPUT -p tcp --dport 22 -j ACCEPT

# DNS In/Out
iptables -t filter -A OUTPUT -p tcp --dport 53 -j ACCEPT
iptables -t filter -A OUTPUT -p udp --dport 53 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 53 -j ACCEPT
iptables -t filter -A INPUT -p udp --dport 53 -j ACCEPT

# NTP Out
iptables -t filter -A OUTPUT -p udp --dport 123 -j ACCEPT

# HTTP + HTTPS Out
iptables -t filter -A OUTPUT -p tcp --dport 80 -j ACCEPT
iptables -t filter -A OUTPUT -p tcp --dport 443 -j ACCEPT

# HTTP + HTTPS In
iptables -t filter -A INPUT -p tcp --dport 80 -j ACCEPT
iptables -t filter -A INPUT -p tcp --dport 443 -j ACCEPT

# FTP Out
iptables -t filter -A OUTPUT -p tcp --dport 20:21 -j ACCEPT

# FTP In
modprobe ip_conntrack_ftp # ligne facultative avec les serveurs OVH
iptables -t filter -A INPUT -p tcp --dport 20:21 -j ACCEPT
iptables -t filter -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

I guess that my express code is ok. But when I try to make a request to my website, I get no answer and no trace of it on the server, even when using the direct IP of the server.

But netstat -tulpn | grep LISTEN tells me that Node is listening on port 80...

If I do everything on port 3000, everything works fine...

I have Node version 12.11.1.

I have absolutely no clue what to do next to understand the problem...

Sharcoux
  • 5,546
  • 7
  • 45
  • 78
  • are you running it using normal user?? because all port below 1024 requires root user – Aslam Oct 15 '19 at 10:41
  • Can you telnet to the server: telnet 80 and check if the connection is happening from your local machine. (Just to make sure, there is no other firewall ahead of the server.) – Sagar Chilukuri Oct 15 '19 at 10:41
  • What if you turn all of the firewalling off and, once you know it works without a firewall, then add rules incrementally. – coolaj86 Oct 15 '19 at 11:13
  • Also, don't use express' app.listen, use the normal http module instead: `var http = require('http'); http.createServer(app).listen(80);` That way you know it's not something with express that's messing it up. – coolaj86 Oct 15 '19 at 11:14
  • @CoolAJ86 Ok, I think that it is definetely the firewall rules, but I don't see how to fix the issue. My current rules are more like: drop everything, then open what is needed. But right now I don't see what is missing. – Sharcoux Oct 15 '19 at 13:21
  • @Aslam, as mentioned, `setcap` enable a non root user to run a process on port below 1024 – Sharcoux Oct 15 '19 at 13:25
  • @Sharcoux Try using `ufw` to manage the firewall. See https://www.digitalocean.com/community/tutorials/ufw-essentials-common-firewall-rules-and-commands – coolaj86 Oct 15 '19 at 17:50

1 Answers1

0

Port 80 is the default port for HTTP requests, therefore when trying to access a website on port 80 you may be having a conflicting issue given that port may already be in use.

There are numerous reason not to run a web server on port 80. One of these being that if your node process is compromised it would have access to run sudo commands on your server. Generally, you shouldn't be running anything as root on port 80, however using a reverse proxy and nginx can utilise port 80 given they have the correct start up code to bind to the port using downgraded permissions.

If you're creating a demo application, stay away from running the express server on either port 80 or port 443 in order to maintain best practices. Port 3000 would be fine to use and should be ok for everything.

Not sure where you found the sample code, but express documentation recommends using port 3000 in the hello world example.

https://expressjs.com/en/starter/hello-world.html

Rory Fielding
  • 110
  • 8