Getting port scanned. NPM should return 444 but returning 400.

[Asmhoa]

Hello, sorry for the noob question, setting this up for the first time.

I've got nginx-proxy-manager up and running on 192.168.1.43. Ports 80 and 443 are opened on my router and forwarded to NPM.

When I check my router logs, I see that I'm getting thousands of requests per hours

[LAN access from remote] from 143.137.79.192 port 11840 to 192.168.1.43 port <INTERNAL> Thursday, Aug 22, 2024 01:30:23
[LAN access from remote] from 177.36.137.76 port 26084 to 192.168.1.43 port <INTERNAL> Thursday, Aug 22, 2024 01:30:22
[LAN access from remote] from 143.137.79.172 port 23669 to 192.168.1.43 port <INTERNAL> Thursday, Aug 22, 2024 01:30:22
[LAN access from remote] from 168.194.245.246 port 15016 to 192.168.1.43 port <INTERNAL> Thursday, Aug 22, 2024 01:30:22
[LAN access from remote] from 143.137.78.237 port 11106 to 192.168.1.43 port <INTERNAL> Thursday, Aug 22, 2024 01:30:22
[LAN access from remote] from 170.231.246.0 port 46027 to 192.168.1.43 port <INTERNAL> Thursday, Aug 22, 2024 01:30:22
[LAN access from remote] from 190.9.122.5 port 46810 to 192.168.1.43 port <INTERNAL> Thursday, Aug 22, 2024 01:30:22

where the request is being routed to the <INTERNAL> port that's mapped to 443.

Should I be worried about this? 😨

When I go to my <PUBLIC_IP>:443, I get a 400 message (screenshot below).

I believe this is coming from NPM and not my router. Is there any way to not return a response (return 444) instead? My NPM settings have always been set to return 444.

Thank you!

[katonagl]

I have the same setting (no response), but for https requests it returns SSL_ERROR_UNRECOGNIZED_NAME_ALERT. Which is clearly a response. Maybe this should be filed as a bug?

[Asmhoa]

My workaround was to use iptables on the host and drop HTTP requests going to the nginx docker container at the HTTPS port.

/usr/sbin/iptables -I DOCKER-USER -p tcp --dport 443 -m string --string "HTTP/" --algo bm -j DROP

The --dport is the SSL port inside the docker container (so 443).

[Asmhoa]

I did try fixing this is NPM itself, by changing data/nginx/default_host/site.conf to include listen 443; (without ssl) but it never quite worked.