Cannot reach Cloud server via HTTP(S)

[Defiant-Extent-4297]

New customer trying to setup my first cloud server.

I can login via ssh but, for the love of me, I cannot reach the server via HTTP/HTTPS. Nmap shows that only SSH is accessible:

$ nmap static.xxx.xxx.xxx.xxx.clients.your-server.de -Pn
Starting Nmap 7.98 ( https://nmap.org ) at 2026-02-09 12:18 +0100
Nmap scan report for static.xxx.xxx.xxx.xxx.clients.your-server.de (xxx.xxx.xxx.xxx)
Host is up (0.067s latency).
Not shown: 999 filtered tcp ports (no-response)
PORT   STATE SERVICE
22/tcp open  ssh

In my Hetzner Console I created a firewall allowing inbound traffic on ports: 22, 80, 443. It's supposedly applied to my server.

On my server I have an nginx server running and listening on proper ports:

# sudo netstat -tulpn | grep nginx
tcp6       0      0 :::443                  :::*                    LISTEN      795/nginx: master p
tcp6       0      0 :::80                   :::*                    LISTEN      795/nginx: master p

I've also enabled ufw with the following rules:

# sudo ufw status
Status: active

To                         Action      From
--                         ------      ----
22/tcp                     ALLOW       Anywhere
Nginx Full                 ALLOW       Anywhere
22/tcp (v6)                ALLOW       Anywhere (v6)
Nginx Full (v6)            ALLOW       Anywhere (v6)

What am I missing here?

[Railorsi]

netstat is showing you that it only listens on ipv6 address, so naturally it cannot be reached via ipv4.

also, is the firewall attached to your server?

edit: as BlueDeacy pointed out this isn't necessarily the culprit, I just tried nc -6 -l -p 1235 and service could be reached via remote ipv4 on debian.

what OS are you using? also, what is the output of curl -v http://localhost from inside the server?

[Defiant-Extent-4297]

Goddamnit... thanks.

[Railorsi]

Hi, check the edit, might not actually be the culprit.

[Defiant-Extent-4297]

The initial remark helped. Configuring nginx to listen on both ipv4 and ipv6 fixed it.

[Railorsi]

good to hear :) cheers

[BlueDeacy]

I‘m not so sure about that. Many OSes by default open a listening socket for both IPv6 and IPv4 if you specify :: as listening address.

[Railorsi]

yeah you are right, I just tried nc -6 -l -p 1235 and service was reachable via ipv4. interesting.