Issue Cannot bring http3 to domains.

[MartinT]

Server operating system version

Debian 11

Plesk version and microupdate number

18.0.61 #1

Hi,

I try to get this new http3 feature to work.
What I have done:
Install new Plesk update -> enable http3 like explained in Intorduction of plesk (I treid both way, only nginx and nginx+panel)
Allowed Plesk Firewall setting the new rules, allowed udf port 443/8443 in command line backend firewall.
But all domains are still connected via http2 when I check at this tool (advertised in plesk maual for http3 HTTP/3 Check).

The Serverdomain passes that test for one server. Another server installed exacly equal does not (the difference is the first is on domain.com and the second on server2.domain.com.

I disabeld for testing nearly everything like plesk firewall, server firewall and modsecurity. Checked udf/443 and udf/8443 a thousand times.

Checking tool is responding Bad Server Status Code from server / Cant establish a Quic connection or cant get http over tcp. Depends on domain checked, all domains are installed equal. Something is blocking I do not see.

Don't know what to ckeck else?

So while maybe somesone could help I look up at Domain registrar and settings there.

Server works on nginx-proxy in front of apache.

 

[Maarten.]

Does your hosting provider have a firewall in front of your server?

 

[MartinT]

No they don`t. There is only a kind of standard ddos protection for all servers.

 

[MartinT]

Is there something to install in addition? QUIC should be on be default at debian11.9.

 

[Maarten.]

Can you check if Nginx has the --with-http_v3_module compiler flag enabled?

# nginx -V

 

[MartinT]

configure arguments: --prefix=/usr/share --sbin-path=/usr/sbin/nginx --conf-path=/etc/nginx/nginx.conf --modules-path=/usr/share/nginx/modules --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --lock-path=/var/lock/nginx.lock --pid-path=/run/nginx.pid --http-client-body-temp-path=/var/lib/nginx/body --http-fastcgi-temp-path=/var/lib/nginx/fastcgi --http-proxy-temp-path=/var/lib/nginx/proxy --http-scgi-temp-path=/var/lib/nginx/scgi --http-uwsgi-temp-path=/var/lib/nginx/uwsgi --user=nginx --group=nginx --with-file-aio --with-compat --with-ld-opt=-L/var/jenkins/workspace/PLESK/CI/rapid-ci/buck-out/gen/unix/plesk/packages/brotli/brotli.files/usr/lib/x86_64-linux-gnu --with-http_ssl_module --with-http_realip_module --with-http_sub_module --with-http_dav_module --with-http_gzip_static_module --with-http_stub_status_module --with-http_v2_module --with-http_v3_module --add-dynamic-module=mod_brotli --add-dynamic-module=mod_passenger/src/nginx_module --add-dynamic-module=mod_pagespeed --add-dynamic-module=mod_security --add-dynamic-module=mod_geoip2

Yes it is

 

[Maarten.]

I suggest testing if the server is listening on UDP port 443 using the netcat command:

# nc -vuzw 3 server2.domain.com 443

You may have to install that command if it's not available.

 

[MartinT]

Result was MY-IP 443 (https) open

 

[MartinT]

Sorry
Domain MY-IP 443 (https) open

 

[Maarten.]

I was expecting something like this from netcat:

"Ncat: UDP packet sent successfully"

 

[MartinT]

no
That was the only line.

 

[MartinT]

I tried it now with the generic hostname from the server:
vmd76643.hostingpartner.net [MY-IP] 443 (https) open

 

[MartinT]

Frustrating. But this : "Ncat: UDP packet sent successfully" is something to investigate.

 

[Maarten.]

Can you please contact Plesk Support? This needs to be investigated directly on your server.
Plesk Support is free for the first month, so be sure to cancel it on time:

https://support.plesk.com/hc/en-us/articles/12388090147095-How-to-get-support-directly-from-Plesk

 

[MartinT]

Ok. UFW Ports are open, as well iptalbes show 443 is open fpr udp. I even reinstalled Plesk Firewall and reconnect additional http3 rules. But I cannot connect udp-Port on my server. Connection refused. Could it be something with Debian 11.9. ? Where could I look at? Do I have to write something into the nginx.conf - Templete for the domains.?
My hosting-Provider says at Server they don not filter any ports or traffic (I asked again) to give complete feedom. Just the udp port 53 is shown open in tools, 443 is shown as open/filtered, but firewalls are open. Any ideas what to control beside.

something stragne on one domain a single .png-Picture as the favicon are serve h3, the rest is h2 Chrome tools said for the serveed. Chrome served h3 because the data won the race against h2.

Could it be a caching issue (so only being patient? Something with the additional nginx-directives?

Simple question beside, is someone else with Debain as OS, where everything work fine with http3?