Reverse proxy websocket If the number of concurrency is large, many close_waits will appear.

[f4nff@…]

#user  www;
worker_processes  4;

#error_log  logs/error.log;
#error_log  logs/error.log  notice;
#error_log  logs/error.log  info;
#error_log  "pipe:rollback logs/error_log interval=1d baknum=7 maxsize=2G";

#pid        logs/nginx.pid;


events {
    use epoll;
    worker_connections  65535;
}

# load modules compiled as Dynamic Shared Object (DSO)
#
#dso {
#    load ngx_http_fastcgi_module.so;
#    load ngx_http_rewrite_module.so;
#}

http {
    include       mime.types;
    default_type  application/octet-stream;

    #log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
    #                  '$status $body_bytes_sent "$http_referer" '
    #                  '"$http_user_agent" "$http_x_forwarded_for"';

    #access_log  logs/access.log  main;
    #access_log  "pipe:rollback logs/access_log interval=1d baknum=7 maxsize=2G"  main;

    sendfile        on;
    #tcp_nopush     on;

    #keepalive_timeout  0;
    keepalive_timeout  65;
	tcp_nodelay on; 

    #gzip  on;

 
server {
  listen 443 ssl http2;
  server_name 1.314r.net;


 
	ssl_stapling off;
	ssl_stapling_verify off;
   ssl_certificate     /usr/local/nginx/tls/1.314r.net.cert;
   ssl_certificate_key /usr/local/nginx/tls/1.314r.net.key;
    ssl_ciphers          ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256;

    ssl_prefer_server_ciphers  on;
    ssl_protocols        TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    ssl_buffer_size 4k;

    ssl_session_tickets      on;

	
location /{
	proxy_pass http://10.105.11.203:2052;
	proxy_set_header		Host "1.314r.net";
	proxy_ssl_session_reuse         on;
	proxy_ssl_protocols		TLSv1.2;
	proxy_ssl_verify		off;
	proxy_send_timeout		120s;
	proxy_ssl_server_name	        on;
	proxy_ssl_name			"1.314r.net";	
	proxy_redirect			off;
    proxy_set_header		X-Real-IP $remote_addr;
    proxy_set_header		X-Forwarded-For $proxy_add_x_forwarded_for;
	proxy_http_version		1.1;
	proxy_set_header		Upgrade $http_upgrade;
	proxy_set_header		Connection "upgrade";
		}
		}

}

If the websocket has a lot of concurrency, there will be a lot of tcp close_wait states.
I queried a lot of information, and also tried to use caddyserver reverse proxy websocket, but this is not the case.

 version: (nginx/1.15.1)

built by gcc 4.4.7 20120313 (Red Hat 4.4.7-23) (GCC)
built with OpenSSL 1.1.1a  20 Nov 2018
TLS SNI support enabled
configure arguments: --user=www --group=www --prefix=/usr/local/nginx --with-http_stub_status_module --with-http_ssl_module --with-http_v2_module --with-http_gzip_static_module --with-http_sub_module --with-openssl=/root/openssl-1.1.1a

[Maxim Dounin]

It looks like you are using not nginx, but rather a heavily modified fork, Tengine. Please make sure you are able to reproduce the problem with latest unmodified nginx, as available from ​http://nginx.org/en/download.html (nginx 1.15.8 as of now).

[Maxim Dounin]

Feedback timeout.