{"id":1162,"date":"2026-11-05T15:19:48","date_gmt":"2026-11-05T15:19:48","guid":{"rendered":"https:\/\/www.vps.tc\/blog\/?p=1162"},"modified":"2026-11-05T09:29:45","modified_gmt":"2026-11-05T09:29:45","slug":"cloudflare-521-hatasi-cozumu","status":"publish","type":"post","link":"https:\/\/www.vps.tc\/blog\/tr\/cloudflare-521-hatasi-cozumu\/","title":{"rendered":"Cloudflare 521 Hatas\u0131 Nedir? Nas\u0131l \u00c7\u00f6z\u00fcl\u00fcr?"},"content":{"rendered":"<div class=\"aiw-summary\" id=\"aiw-ozet\">\n<p class=\"aiw-summary-title\">H\u0131zl\u0131 \u00d6zet &#8211; Cloudflare 521 Hatas\u0131<\/p>\n<p>Cloudflare 521 hatas\u0131, kaynak web sunucusunun Cloudflare ba\u011flant\u0131s\u0131n\u0131 reddetmesiyle ili\u015fkilidir. Servisin durmu\u015f olmas\u0131 veya Cloudflare adreslerinin engellenmesi yayg\u0131n nedenlerdir; hata kodu tek ba\u015f\u0131na hangisinin ger\u00e7ekle\u015fti\u011fini g\u00f6stermez.<\/p>\n<ul>\n<li><strong>Kaynak adresi<\/strong> \u2014 A ve varsa AAAA hedeflerini Cloudflare DNS panelinden do\u011frulay\u0131n; proxy edilen kayd\u0131n genel DNS yan\u0131t\u0131 kaynak adresini g\u00f6stermez.<\/li>\n<li><strong>HTTPS dinleyicisi<\/strong> \u2014 Full (strict) ve port de\u011fi\u015ftiren kural bulunmayan bu senaryoda Nginx&#039;in d\u0131\u015f ba\u011flant\u0131lar\u0131 kabul edecek \u015fekilde TCP 443 dinledi\u011fini kontrol edin.<\/li>\n<li><strong>Do\u011frudan ba\u011flant\u0131<\/strong> \u2014 Yetkili bir d\u0131\u015f test noktas\u0131ndan curl &#8211;resolve kullanarak kaynak IP&#039;yi s\u0131narken alan ad\u0131n\u0131, SNI bilgisini ve sertifika do\u011frulamas\u0131n\u0131 koruyun.<\/li>\n<li><strong>G\u00fcvenlik duvar\u0131<\/strong> \u2014 Sunucu ve sa\u011flay\u0131c\u0131 kurallar\u0131nda Cloudflare&#039;\u0131n g\u00fcncel IPv4 ve IPv6 aral\u0131klar\u0131na gereken eri\u015fimin verildi\u011fini inceleyin.<\/li>\n<li><strong>TLS ayr\u0131m\u0131<\/strong> \u2014 521 ba\u011flant\u0131 reddiyle ili\u015fkiliyken 525 TLS el s\u0131k\u0131\u015fmas\u0131, 526 ise Full (strict) sertifika do\u011frulamas\u0131 hatas\u0131n\u0131 belirtir.<\/li>\n<li><strong>Son do\u011frulama<\/strong> \u2014 D\u00fczeltmeyi Cloudflare \u00fczerinden \u00f6nbellekten sunulmad\u0131\u011f\u0131 do\u011frulanan bir yan\u0131tla s\u0131nay\u0131n; \u00f6nbellekteki ba\u015far\u0131l\u0131 sayfa kaynak sa\u011fl\u0131\u011f\u0131n\u0131 kan\u0131tlamaz.<\/li>\n<\/ul>\n<\/div>\n<p class=\"aiw-lead\">Sunucuya SSH ile ba\u011flanabiliyor olman\u0131z, sitenizin Cloudflare \u00fczerinden eri\u015filebilir oldu\u011funu g\u00f6stermez. Cloudflare 521 hatas\u0131, genellikle kaynak web sunucusunun Cloudflare ba\u011flant\u0131s\u0131n\u0131 reddetti\u011fini belirtir. \u00c7\u00f6z\u00fcm i\u00e7in do\u011fru kaynak IP&#039;yi, Nginx&#039;in HTTPS dinleyicisini ve g\u00fcvenlik duvar\u0131 izinlerini do\u011frulay\u0131n; ard\u0131ndan Full (strict) ba\u011flant\u0131s\u0131n\u0131 alan ad\u0131n\u0131 koruyan do\u011frudan kaynak testiyle ve Cloudflare \u00fczerinden ayr\u0131 ayr\u0131 s\u0131nay\u0131n.<\/p>\n<div class=\"aiw-toc\" style=\"border:1px solid #dbe3ea;border-radius:8px;padding:16px 20px;margin:0 0 28px\">\n<p class=\"aiw-toc-head\"><strong>\u0130\u00e7indekiler<\/strong><span class=\"aiw-toc-meta\"> \u00b7 16 dk okuma<\/span><\/p>\n<ol style=\"margin:10px 0 0;padding-left:22px\">\n<li><a href=\"#site-acik-gorunuyor-cloudflare-neden-521-donduruyor\">Site a\u00e7\u0131k g\u00f6r\u00fcn\u00fcyor, Cloudflare neden 521 d\u00f6nd\u00fcr\u00fcyor?<\/a><\/li>\n<li><a href=\"#once-cloudflarein-hangi-kaynaga-gittigini-dogrulayin\">\u00d6nce Cloudflare&#039;\u0131n hangi kayna\u011fa gitti\u011fini do\u011frulay\u0131n<\/a><\/li>\n<li><a href=\"#kaynak-ipye-alan-adini-koruyarak-baglanin\">Kaynak IP&#039;ye alan ad\u0131n\u0131 koruyarak ba\u011flan\u0131n<\/a><\/li>\n<li><a href=\"#nginx-gercekten-443-portunu-dinliyor-mu\">Nginx ger\u00e7ekten 443 portunu dinliyor mu?<\/a><\/li>\n<li><a href=\"#cloudflare-baglantisini-kesen-guvenlik-duvari-katmanlari\">Cloudflare ba\u011flant\u0131s\u0131n\u0131 kesen g\u00fcvenlik duvar\u0131 katmanlar\u0131<\/a><\/li>\n<li><a href=\"#full-strict-icin-https-yolunu-tamamlayin\">Full (strict) i\u00e7in HTTPS yolunu tamamlay\u0131n<\/a><\/li>\n<li><a href=\"#duzeltmeyi-cloudflare-uzerinden-dogrulayin\">D\u00fczeltmeyi Cloudflare \u00fczerinden do\u011frulay\u0131n<\/a><\/li>\n<li><a href=\"#degisiklikten-once-ve-sonra-kontrol-edin\">De\u011fi\u015fiklikten \u00d6nce ve Sonra Kontrol Edin<\/a><\/li>\n<li><a href=\"#sik-sorulan-sorular\">S\u0131k Sorulan Sorular<\/a><\/li>\n<li><a href=\"#kaynaklar\">Kaynaklar<\/a><\/li>\n<\/ol>\n<\/div>\n<h2 id=\"site-acik-gorunuyor-cloudflare-neden-521-donduruyor\">Site a\u00e7\u0131k g\u00f6r\u00fcn\u00fcyor, Cloudflare neden 521 d\u00f6nd\u00fcr\u00fcyor?<\/h2>\n<p>SSH oturumunuz a\u00e7\u0131k, sunucudan yapt\u0131\u011f\u0131n\u0131z yerel HTTP iste\u011fi yan\u0131t al\u0131yor; taray\u0131c\u0131da ise <strong>Cloudflare 521 hatas\u0131<\/strong> var. \u00c7eli\u015fki yok. Bu kontroller farkl\u0131 ba\u011flant\u0131lar\u0131 s\u0131nar: SSH eri\u015fiminin s\u00fcrmesi, Nginx&#8217;in d\u0131\u015far\u0131dan HTTPS ba\u011flant\u0131s\u0131 kabul etti\u011fini g\u00f6stermez. Yerel HTTP yan\u0131t\u0131 da yaln\u0131zca denedi\u011finiz adres ve port hakk\u0131nda bilgi verir. Makinenin ayakta olmas\u0131, web hizmetinin Cloudflare taraf\u0131ndan eri\u015filebilir oldu\u011fu anlam\u0131na gelmez.<\/p>\n<p>\u0130stek yolunu taray\u0131c\u0131-Cloudflare-kaynak sunucu olarak ay\u0131r\u0131n. Turuncu bulutla proxy edilen <code>www.example.com<\/code> i\u00e7in taray\u0131c\u0131n\u0131z Cloudflare&#8217;a ba\u011flan\u0131r; Cloudflare, kaynaktan yan\u0131t almas\u0131 gerekti\u011finde ayr\u0131 bir ba\u011flant\u0131 kurar. Taray\u0131c\u0131da hata sayfas\u0131n\u0131n g\u00f6r\u00fcnmesi, kaynak Nginx&#8217;in iste\u011fi ald\u0131\u011f\u0131n\u0131 kan\u0131tlamaz. Burada g\u00f6rd\u00fc\u011f\u00fcn\u00fcz, Cloudflare&#8217;\u0131n taray\u0131c\u0131ya iletti\u011fi hata yan\u0131t\u0131d\u0131r; uygulaman\u0131z\u0131n \u00fcretti\u011fi bir sayfa de\u011fildir.<\/p>\n<p>Cloudflare&#8217;\u0131n 521 belgesi, bu kodu kaynak web sunucusunun Cloudflare ba\u011flant\u0131s\u0131n\u0131 reddetmesiyle a\u00e7\u0131klar. Ba\u015fl\u0131ca olas\u0131l\u0131klar, kaynak web hizmetinin kapal\u0131 olmas\u0131 ve Cloudflare isteklerinin engellenmesidir. Nginx \u00e7al\u0131\u015fsa bile g\u00fcvenlik duvar\u0131 ba\u011flant\u0131y\u0131 reddedebilir. <strong>Hata kodu, tek ba\u015f\u0131na kesin k\u00f6k neden de\u011fildir.<\/strong> Kendi bilgisayar\u0131n\u0131zdan kayna\u011fa ula\u015fman\u0131z da Cloudflare adreslerinden gelen ba\u011flant\u0131lar\u0131n kabul edildi\u011fini g\u00f6stermez; eri\u015fim kurallar\u0131 ba\u011flant\u0131n\u0131n geldi\u011fi IP adresine g\u00f6re de\u011fi\u015febilir.<\/p>\n<p>Varsay\u0131msal laboratuvarda tek kaynak sunucu, Ubuntu Server 24.04 LTS \u00fczerinde da\u011f\u0131t\u0131m paketlerinden Nginx 1.24.0 \u00e7al\u0131\u015ft\u0131r\u0131r; arada y\u00fck dengeleyici, Cloudflare Tunnel, Docker veya ikinci ters proxy yoktur. Cloudflare, s\u00fcr\u00fcm\u00fc sabitlenen bir paket de\u011fil, y\u00f6netilen hizmettir. SSL\/TLS modu Full (strict), beklenen kaynak HTTPS portu TCP 443&#8217;t\u00fcr; Origin Rules ile port de\u011fi\u015ftirilmemi\u015ftir. TCP 80 yaln\u0131zca HTTP kontrol\u00fc ve HTTPS y\u00f6nlendirmesi i\u00e7indir.<\/p>\n<p>Kaynak IPv4 adresi <code>192.0.2.10<\/code>, iste\u011fe ba\u011fl\u0131 IPv6 adresi <code>2001:db8::10<\/code> olarak g\u00f6sterilir. Bu adresler dok\u00fcmantasyona ayr\u0131lm\u0131\u015ft\u0131r, \u00e7al\u0131\u015f\u0131r internet hedefleri de\u011fildir; <code>example.com<\/code> da \u00f6rnek alan ad\u0131d\u0131r. Kontrollerden \u00f6nce bunlar\u0131 y\u00f6netti\u011finiz ger\u00e7ek de\u011ferlerle de\u011fi\u015ftirin.<\/p>\n<p><strong>522<\/strong> ba\u011flant\u0131 zaman a\u015f\u0131m\u0131n\u0131, <strong>523<\/strong> kayna\u011fa ula\u015f\u0131lamamas\u0131n\u0131, <strong>525<\/strong> TLS el s\u0131k\u0131\u015fmas\u0131n\u0131n ba\u015far\u0131s\u0131zl\u0131\u011f\u0131n\u0131, <strong>526<\/strong> kaynak sertifikas\u0131n\u0131n do\u011frulanamamas\u0131n\u0131 belirtir. Bunlar ayn\u0131 ar\u0131za de\u011fildir. Cloudflare&#8217;\u0131n Full (strict) belgesi, kaynakta HTTPS ve istenen ana makine ad\u0131yla e\u015fle\u015fen, g\u00fcvenilen, s\u00fcresi ge\u00e7memi\u015f bir sertifika gerektirir; fakat 521 kodu do\u011frudan sertifika de\u011fi\u015ftirmeniz gerekti\u011fini s\u00f6ylemez. \u0130nceleme notunuza yaln\u0131zca &#8220;site a\u00e7\u0131k&#8221; yazmak yerine, \u00e7al\u0131\u015fan yolun SSH, yerel HTTP veya d\u0131\u015far\u0131dan HTTPS oldu\u011funu kaydedin. \u00d6zellikle yerel TCP 80 yan\u0131t\u0131n\u0131, Cloudflare&#8217;dan kaynak TCP 443 eri\u015fiminin kan\u0131t\u0131 saymay\u0131n.<\/p>\n<h2 id=\"once-cloudflarein-hangi-kaynaga-gittigini-dogrulayin\">\u00d6nce Cloudflare&#8217;\u0131n hangi kayna\u011fa gitti\u011fini do\u011frulay\u0131n<\/h2>\n<p>Yanl\u0131\u015f kaynak adresine y\u00f6nelen bir kay\u0131t i\u00e7in Nginx&#8217;i yeniden ba\u015flatmak hi\u00e7bir \u015feyi d\u00fczeltmez. \u00d6nce hedefi do\u011frulay\u0131n. Cloudflare&#8217;\u0131n 521 hata belgesi, kaynak sunucunun Cloudflare ba\u011flant\u0131s\u0131n\u0131 reddetmesini temel sorun olarak tan\u0131mlar. Cloudflare 521 hatas\u0131 incelemesinde DNS panelindeki adresi sunucunuzun adresiyle kar\u015f\u0131la\u015ft\u0131rmadan servis veya g\u00fcvenlik duvar\u0131 ayarlar\u0131n\u0131 de\u011fi\u015ftirmeyin; yanl\u0131\u015f makinedeki do\u011fru ayar sorunu \u00e7\u00f6zmez.<\/p>\n<p>Bu varsay\u0131msal laboratuvarda tek kaynak, Ubuntu Server 24.04 LTS \u00fczerinde da\u011f\u0131t\u0131m paketlerinden Nginx 1.24.0 \u00e7al\u0131\u015ft\u0131r\u0131r. Cloudflare panelinde <code>example.com<\/code> alan\u0131n\u0131n DNS kay\u0131tlar\u0131n\u0131 a\u00e7\u0131n. <code>www.example.com<\/code> i\u00e7in A kayd\u0131n\u0131n <code>192.0.2.10<\/code> adresini g\u00f6sterdi\u011fini ve turuncu bulutla proxy edildi\u011fini do\u011frulay\u0131n. Ayn\u0131 ad alt\u0131nda eski adreslere y\u00f6nelen ba\u015fka A kay\u0131tlar\u0131 bulunmad\u0131\u011f\u0131n\u0131 da kontrol edin. Burada y\u00fck dengeleyici, Cloudflare Tunnel, Docker veya ikinci ters proxy yoktur; hedef do\u011frudan kaynak sunucudur.<\/p>\n<p>Genel DNS sorgusu ise paneldeki kaynak adresini g\u00f6stermez. Ubuntu&#8217;da <code>dig<\/code> komutunu <code>dnsutils<\/code> paketiyle edinebilirsiniz. A\u015fa\u011f\u0131daki \u00f6rnek, IPv4 ve IPv6 yan\u0131tlar\u0131n\u0131 ayr\u0131 sorgular. <code>example.com<\/code>, <code>192.0.2.10<\/code> ve <code>2001:db8::10<\/code> dok\u00fcmantasyon de\u011ferleridir; \u00e7al\u0131\u015f\u0131r internet hedefleri de\u011fildir. Komutlar\u0131 uygulamadan \u00f6nce alan ad\u0131n\u0131, panel kar\u015f\u0131la\u015ft\u0131rmalar\u0131nda da adresleri y\u00f6netti\u011finiz ger\u00e7ek de\u011ferlerle de\u011fi\u015ftirin.<\/p>\n<pre><code>dig +short www.example.com A\ndig +short www.example.com AAAA<\/code><\/pre>\n<p>Proxy etkin ger\u00e7ek bir alan ad\u0131nda ilk komutun Cloudflare u\u00e7 IPv4 adreslerini d\u00f6nd\u00fcrmesi beklenir. \u0130kinci komutta AAAA yan\u0131t\u0131 varsa bunlar u\u00e7 IPv6 adresleridir. Adresleri Cloudflare&#8217;\u0131n yay\u0131mlad\u0131\u011f\u0131 resm\u00ee IPv4 ve IPv6 aral\u0131klar\u0131yla kar\u015f\u0131la\u015ft\u0131rabilirsiniz. \u00c7\u0131kt\u0131da <code>192.0.2.10<\/code> bulunmamas\u0131 hata de\u011fildir &#8211; kaynak IP&#8217;yi buradan do\u011frulayamazs\u0131n\u0131z. Genel sorgudaki AAAA yan\u0131t\u0131 da kaynak sunucunun IPv6 kulland\u0131\u011f\u0131n\u0131 kan\u0131tlamaz; ziyaret\u00e7i ba\u011flant\u0131s\u0131yla kaynak ba\u011flant\u0131s\u0131n\u0131 birbirinden ay\u0131r\u0131n.<\/p>\n<p>Kaynak IPv6 kontrol\u00fcn\u00fc yaln\u0131zca ger\u00e7ekten yap\u0131land\u0131r\u0131lm\u0131\u015fsa yap\u0131n. Panelde <code>www.example.com<\/code> i\u00e7in AAAA kayd\u0131 varsa bu laboratuvardaki kar\u015f\u0131l\u0131\u011f\u0131 <code>2001:db8::10<\/code> olmal\u0131d\u0131r; adresin sunucuya atanm\u0131\u015f ve eri\u015filebilir olmas\u0131 gerekir. Kaynakta IPv6 kullanm\u0131yorsan\u0131z s\u0131rf genel sorgu IPv6 d\u00f6nd\u00fcr\u00fcyor diye AAAA kayd\u0131 eklemeyin. Mevcut bir kaynak AAAA kayd\u0131n\u0131 ise IPv6 kullanmad\u0131\u011f\u0131n\u0131z\u0131 d\u00fc\u015f\u00fcnerek g\u00f6rmezden gelmeyin.<\/p>\n<p>SSL\/TLS modunun <strong>Full (strict)<\/strong> oldu\u011funu do\u011frulay\u0131n. Cloudflare&#8217;\u0131n Full (strict) belgesi, kaynakta HTTPS ve do\u011frulanabilir bir sertifika gerektirir. Origin Rules i\u00e7inde hedef portunu de\u011fi\u015ftiren bir kural bulunmad\u0131\u011f\u0131n\u0131 da kontrol edin. Bu ortamda kaynak HTTPS portu TCP 443&#8217;t\u00fcr; TCP 80 yaln\u0131zca HTTP kontrol\u00fc ve HTTPS y\u00f6nlendirmesi i\u00e7indir. Ba\u011flant\u0131 kontrol\u00fcne ge\u00e7erken panelde do\u011frulad\u0131\u011f\u0131n\u0131z kaynak adresini ve TCP 443 portunu esas al\u0131n.<\/p>\n<h2 id=\"kaynak-ipye-alan-adini-koruyarak-baglanin\">Kaynak IP&#8217;ye alan ad\u0131n\u0131 koruyarak ba\u011flan\u0131n<\/h2>\n<p>Taray\u0131c\u0131ya kaynak IP&#8217;yi yazmak, do\u011fru siteyi s\u0131nad\u0131\u011f\u0131n\u0131z anlam\u0131na gelmez. Nginx&#8217;in HTTPS belgeleri, sertifika se\u00e7iminin HTTP iste\u011finden \u00f6nce ger\u00e7ekle\u015fti\u011fini ve SNI bilgisinin bu se\u00e7imde kullan\u0131ld\u0131\u011f\u0131n\u0131 a\u00e7\u0131klar. <code>https:\/\/192.0.2.10\/<\/code> iste\u011fi, sertifikadaki alan ad\u0131yla e\u015fle\u015fmeyebilir veya varsay\u0131lan sanal sunucuya d\u00fc\u015febilir. Yaln\u0131zca <code>Host<\/code> ba\u015fl\u0131\u011f\u0131n\u0131 de\u011fi\u015ftirmek TLS a\u015famas\u0131n\u0131 d\u00fczeltmez. Ad\u0131 koruyun.<\/p>\n<p>Bu varsay\u0131msal laboratuvarda kaynak, Ubuntu Server 24.04 LTS \u00fczerinde Nginx 1.24.0 \u00e7al\u0131\u015ft\u0131r\u0131r; komut curl 8.5.0 i\u00e7indir. Kaynak sunucunun d\u0131\u015f\u0131ndaki yetkili bir test noktas\u0131n\u0131 kullan\u0131n. <code>www.example.com<\/code> ve <code>192.0.2.10<\/code> dok\u00fcmantasyon de\u011ferleridir, \u00e7al\u0131\u015f\u0131r internet hedefleri de\u011fildir; uygulamadan \u00f6nce y\u00f6netti\u011finiz ger\u00e7ek alan ad\u0131 ve kaynak IPv4 adresiyle de\u011fi\u015ftirin. \u00d6rnek, turuncu bulutla proxy edilen kayd\u0131n Cloudflare adreslerine de\u011fil, do\u011frudan kaynak sunucunun TCP 443 portuna ba\u011flan\u0131r.<\/p>\n<pre><code>curl --noproxy '*' \\\n  --resolve www.example.com:443:192.0.2.10 \\\n  --connect-timeout 5 \\\n  --max-time 15 \\\n  --verbose \\\n  --dump-header - \\\n  --output \/dev\/null \\\n  https:\/\/www.example.com\/<\/code><\/pre>\n<p><code>--resolve<\/code>, belirtilen ad ve port i\u00e7in ba\u011flant\u0131 adresini de\u011fi\u015ftirir; SNI, sertifika ad\u0131 do\u011frulamas\u0131 ve HTTP <code>Host<\/code> bilgisi URL&#8217;deki alan ad\u0131n\u0131 kullanmay\u0131 s\u00fcrd\u00fcr\u00fcr. <code>--noproxy '*'<\/code>, ortamda tan\u0131ml\u0131 ileri proxy&#8217;leri devreden \u00e7\u0131kar\u0131r. Ba\u011flant\u0131 a\u015famas\u0131 5, i\u015flemin tamam\u0131 15 saniyeyle s\u0131n\u0131rl\u0131d\u0131r. Ayr\u0131nt\u0131l\u0131 ba\u011flant\u0131 bilgileri ve yan\u0131t ba\u015fl\u0131klar\u0131 g\u00f6sterilir, g\u00f6vde at\u0131l\u0131r. Y\u00f6nlendirmeler takip edilmez; ilk yan\u0131t incelenir. A\u015fa\u011f\u0131dakiler g\u00f6zlemlenmi\u015f \u00f6l\u00e7\u00fcmler de\u011fil, olas\u0131 \u00e7\u0131kt\u0131lar\u0131n yorumlar\u0131d\u0131r:<\/p>\n<ul>\n<li><code>curl: (7)<\/code> ile <code>Connection refused<\/code>: TCP ba\u011flant\u0131s\u0131 reddedilmi\u015ftir. Dinleyici yoklu\u011fu veya g\u00fcvenlik duvar\u0131n\u0131n etkin reddi ara\u015ft\u0131r\u0131l\u0131r; tek ba\u015f\u0131na hata numaras\u0131 nedeni belirlemez.<\/li>\n<li><code>curl: (28)<\/code>: S\u00fcre s\u0131n\u0131r\u0131 a\u015f\u0131lm\u0131\u015ft\u0131r. Ayr\u0131nt\u0131l\u0131 \u00e7\u0131kt\u0131da ba\u011flant\u0131n\u0131n kurulup kurulmad\u0131\u011f\u0131na bak\u0131n; paket d\u00fc\u015f\u00fcr\u00fclmesi ile ba\u011flant\u0131 sonras\u0131nda geciken yan\u0131t\u0131 ay\u0131r\u0131n.<\/li>\n<li><code>curl: (60)<\/code>: Sertifika do\u011frulamas\u0131 ba\u015far\u0131s\u0131zd\u0131r. Ad uyu\u015fmazl\u0131\u011f\u0131, ge\u00e7erlilik s\u00fcresi ve g\u00fcven zinciri incelenir. Bu, TCP ba\u011flant\u0131 reddi de\u011fildir.<\/li>\n<li><code>HTTP\/1.1 200 OK<\/code> veya <code>301<\/code>: TLS tamamlanm\u0131\u015f, HTTP yan\u0131t\u0131 al\u0131nm\u0131\u015ft\u0131r. Y\u00f6nlendirme yan\u0131t\u0131, hedef sayfan\u0131n veya uygulaman\u0131n tamam\u0131n\u0131n sa\u011fl\u0131kl\u0131 oldu\u011funu kan\u0131tlamaz.<\/li>\n<\/ul>\n<p>Cloudflare&#8217;\u0131n Full (strict) belgesi, ge\u00e7erli, g\u00fcvenilen ve istenen adla e\u015fle\u015fen kaynak sertifikas\u0131 gerektirir; <code>-k<\/code> ekleyerek do\u011frulama hatas\u0131n\u0131 gizlemeyin. Cloudflare 521 hatas\u0131 belgesi ba\u011flant\u0131 reddini vurgular. G\u00fcvenlik duvar\u0131n\u0131z yaln\u0131zca Cloudflare&#8217;\u0131n resm\u00ee IP aral\u0131klar\u0131na izin veriyorsa test noktas\u0131n\u0131n \u00e7\u0131k\u0131\u015f IP&#8217;sine TCP 443 i\u00e7in dar kapsaml\u0131, ge\u00e7ici izin gerekir. Ba\u015far\u0131l\u0131 yan\u0131t yaln\u0131zca bu noktan\u0131n eri\u015fimini g\u00f6sterir; Cloudflare eri\u015fimini kan\u0131tlamaz. Kontrol bitince ge\u00e7ici izni kald\u0131r\u0131n.<\/p>\n<div class=\"aiw-callout aiw-callout-tip\">\n<p class=\"aiw-callout-label\">\u0130pucu<\/p>\n<p>Varsay\u0131msal laboratuvar i\u00e7in curl &#8211;resolve www.example.com:443:192.0.2.10 https:\/\/www.example.com\/ komutu, ba\u011flant\u0131y\u0131 kaynak IP&#039;ye y\u00f6nlendirirken SNI ve Host bilgisini korur. example.com ve 192.0.2.10 dok\u00fcmantasyon de\u011ferleridir; \u00e7al\u0131\u015f\u0131r test hedefleri yerine ge\u00e7mez ve uygulamadan \u00f6nce y\u00f6netti\u011finiz ger\u00e7ek de\u011ferlerle de\u011fi\u015ftirilmelidir. Kaynak yaln\u0131zca Cloudflare adreslerini kabul ediyorsa test noktan\u0131za ayr\u0131ca s\u0131n\u0131rl\u0131 eri\u015fim izni gerekir.<\/p>\n<\/div>\n<h2 id=\"nginx-gercekten-443-portunu-dinliyor-mu\">Nginx ger\u00e7ekten 443 portunu dinliyor mu?<\/h2>\n<p>Servisin ye\u015fil g\u00f6r\u00fcnmesi, HTTPS ba\u011flant\u0131s\u0131 kabul etti\u011fini kan\u0131tlamaz. Nginx yaln\u0131zca TCP 80 dinliyorsa HTTP kontrol\u00fc ge\u00e7ebilir; Full (strict) kullan\u0131lan bu ortamda beklenen TCP 443 ise kapal\u0131 kal\u0131r. Cloudflare&#8217;\u0131n 521 belgesi, kaynak sunucunun \u00e7al\u0131\u015fmamas\u0131n\u0131 veya ba\u011flant\u0131lar\u0131 reddetmesini nedenler aras\u0131nda sayar; Full (strict) belgesi kaynakta HTTPS eri\u015fimi gerektirir.<\/p>\n<p>Varsay\u0131msal Ubuntu Server 24.04 LTS ve da\u011f\u0131t\u0131m paketlerinden Nginx 1.24.0 ortam\u0131nda \u015fu komutlar\u0131 kaynak sunucuda \u00e7al\u0131\u015ft\u0131rabilirsiniz. Durumu de\u011fi\u015ftirmezler; servis, soket, yap\u0131land\u0131rma ve g\u00fcnl\u00fck bilgilerini g\u00f6sterirler:<\/p>\n<pre><code>sudo systemctl status nginx --no-pager -l\nsudo ss -ltnp '( sport = :80 or sport = :443 )'\nsudo nginx -t\nls -l \/etc\/nginx\/sites-enabled\/example.com\nreadlink -e \/etc\/nginx\/sites-enabled\/example.com\nsudo nginx -T\nsudo journalctl -u nginx -n 50 --no-pager\nsudo tail -n 50 \/var\/log\/nginx\/error.log<\/code><\/pre>\n<p><code>active (running)<\/code>, s\u00fcrecin \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 g\u00f6sterir. Tek ba\u015f\u0131na yetmez. <code>ss<\/code> \u00e7\u0131kt\u0131s\u0131nda 443 i\u00e7in <code>LISTEN<\/code> ve s\u00fcre\u00e7 alan\u0131nda <code>nginx<\/code> beklenir. <code>0.0.0.0:443<\/code> b\u00fct\u00fcn yerel IPv4 adreslerini, <code>[::]:443<\/code> IPv6 adreslerini kapsar; IPv6 soketinin IPv4 ba\u011flant\u0131lar\u0131n\u0131 da kar\u015f\u0131layaca\u011f\u0131n\u0131 varsaymay\u0131n. Yaln\u0131zca <code>127.0.0.1:443<\/code> dinleniyorsa d\u0131\u015far\u0131dan eri\u015filemez. Ba\u015fka bir s\u00fcre\u00e7 portu tutuyorsa g\u00fcnl\u00fckte <code>Address already in use<\/code> g\u00f6r\u00fclebilir.<\/p>\n<p>Etkinle\u015ftirme ba\u011flant\u0131s\u0131 <code>\/etc\/nginx\/sites-available\/example.com<\/code> dosyas\u0131na \u00e7\u00f6z\u00fclmelidir. <code>readlink -e<\/code> \u00e7\u0131kt\u0131 vermiyorsa ba\u011flant\u0131y\u0131 ve hedefi inceleyin. <code>nginx -T<\/code>, diskteki yap\u0131land\u0131rmay\u0131 s\u0131nay\u0131p dahil edilen dosyalar\u0131 d\u00f6ker; \u00e7al\u0131\u015fan s\u00fcrecin ayn\u0131 i\u00e7eri\u011fi y\u00fckledi\u011fini kan\u0131tlamaz. Site dosyas\u0131n\u0131n bu \u00e7\u0131kt\u0131da bulundu\u011funu kontrol edin. Ba\u011flant\u0131 d\u00fczeni i\u00e7in <a href=\"https:\/\/www.vps.tc\/blog\/tr\/ubuntu-nginx-kurulumu-ilk-yapilandirma\/\">Ubuntu&#8217;da Nginx Kurulumu ve \u0130lk Yap\u0131land\u0131rma<\/a> yaz\u0131s\u0131na ba\u015fvurabilirsiniz.<\/p>\n<p>Nginx&#8217;in HTTPS belgesindeki d\u00fczene g\u00f6re ilgili <code>server<\/code> blo\u011funda <code>listen 443 ssl;<\/code> bulunmal\u0131d\u0131r. \u0130ste\u011fe ba\u011fl\u0131 IPv6 kullan\u0131l\u0131yorsa <code>listen [::]:443 ssl;<\/code> sat\u0131r\u0131n\u0131 da denetleyin. Ayn\u0131 blokta <code>server_name example.com www.example.com;<\/code>, <code>ssl_certificate \/etc\/letsencrypt\/live\/example.com\/fullchain.pem;<\/code> ve <code>ssl_certificate_key \/etc\/letsencrypt\/live\/example.com\/privkey.pem;<\/code> beklenir. Laboratuvar alan ad\u0131n\u0131 ve ona ba\u011fl\u0131 yollar\u0131 ger\u00e7ek ortam\u0131n\u0131za uyarlay\u0131n; \u00f6rnek de\u011ferler \u00e7al\u0131\u015f\u0131r internet hedefleri de\u011fildir.<\/p>\n<p><code>nginx -t<\/code> \u00e7\u0131kt\u0131s\u0131nda <code>syntax is ok<\/code> ve <code>test is successful<\/code> beklenir. Ba\u015far\u0131s\u0131zsa bildirilen dosya ve sat\u0131r\u0131, sertifika eri\u015fimini ve hata g\u00fcnl\u00fc\u011f\u00fcn\u00fc inceleyin. Cloudflare 521 hatas\u0131 s\u0131ras\u0131nda ba\u011flant\u0131 HTTP katman\u0131na ula\u015fmam\u0131\u015fsa <code>\/var\/log\/nginx\/access.log<\/code> kayd\u0131 olu\u015fmayabilir. Sessizlik, sa\u011fl\u0131kl\u0131 ba\u011flant\u0131 demek de\u011fildir.<\/p>\n<p>Hatalar\u0131 giderdikten sonra \u00e7al\u0131\u015fan servise do\u011frulanm\u0131\u015f yap\u0131land\u0131rmay\u0131 <code>reload<\/code> ile uygulay\u0131n; k\u00f6rlemesine yeniden ba\u015flatmay\u0131n:<\/p>\n<pre><code>sudo nginx -t &amp;&amp; sudo systemctl reload nginx<\/code><\/pre>\n<p>Servis durmu\u015fsa bunun yerine testi takiben ba\u015flat\u0131n:<\/p>\n<pre><code>sudo nginx -t &amp;&amp; sudo systemctl start nginx<\/code><\/pre>\n<p>\u0130\u015flemden sonra servis durumunu ve g\u00fcnl\u00fckleri tekrar kontrol edin; <code>ss<\/code> \u00e7\u0131kt\u0131s\u0131nda 443 soketinin beklenen adres ailesinde ger\u00e7ekten a\u00e7\u0131ld\u0131\u011f\u0131n\u0131 do\u011frulay\u0131n.<\/p>\n<div class=\"aiw-callout aiw-callout-field\">\n<p class=\"aiw-callout-label\">Sahadan not<\/p>\n<p>Varsay\u0131msal laboratuvar notu: Ubuntu Server 24.04 LTS ve Nginx 1.24.0 ortam\u0131nda curl http:\/\/127.0.0.1\/ komutunun HTTP 200 d\u00f6nd\u00fcrd\u00fc\u011f\u00fcn\u00fc, ancak ss -ltnp \u00e7\u0131kt\u0131s\u0131nda yaln\u0131zca TCP 80 dinleyicisinin bulundu\u011funu varsay\u0131n. Bu durumda yerel HTTP \u00e7al\u0131\u015fsa da Full (strict) i\u00e7in beklenen TCP 443 dinleyicisi yoktur. Bu bir ger\u00e7ek olay veya \u00f6l\u00e7\u00fcm aktar\u0131m\u0131 de\u011fil, iki kontrol\u00fcn neden ayr\u0131 yap\u0131lmas\u0131 gerekti\u011fini g\u00f6steren \u00f6rnektir.<\/p>\n<\/div>\n<h2 id=\"cloudflare-baglantisini-kesen-guvenlik-duvari-katmanlari\">Cloudflare ba\u011flant\u0131s\u0131n\u0131 kesen g\u00fcvenlik duvar\u0131 katmanlar\u0131<\/h2>\n<p>Sizin ba\u011flant\u0131n\u0131z\u0131n kabul edilmesi, Cloudflare ba\u011flant\u0131lar\u0131n\u0131n da kabul edildi\u011fini g\u00f6stermez. Yol farkl\u0131d\u0131r. Cloudflare&#8217;\u0131n 521 belgesi, kaynak sunucunun ba\u011flant\u0131y\u0131 reddetmesini ve Cloudflare adreslerinin engellenmesini olas\u0131 nedenler aras\u0131nda g\u00f6sterir. Varsay\u0131msal Ubuntu Server 24.04 LTS laboratuvar\u0131ndaki Full (strict) modu i\u00e7in, Cloudflare&#8217;\u0131n kaynak HTTPS gereksinimleri do\u011frultusunda TCP 443 yolunu inceleyin. TCP 80&#8217;in a\u00e7\u0131k olmas\u0131 yeterli de\u011fildir.<\/p>\n<p>Sunucudaki nftables kurallar\u0131n\u0131, sa\u011flay\u0131c\u0131 g\u00fcvenlik duvar\u0131n\u0131 ve varsa Fail2ban gibi otomatik engelleme ara\u00e7lar\u0131n\u0131 birlikte de\u011ferlendirin. Sa\u011flay\u0131c\u0131da durdurulan trafik sunucuya ula\u015fmayabilir. Fail2ban kullan\u0131l\u0131yorsa etkin jail&#8217;lerin engelleme listelerini kontrol edin; yaln\u0131zca Nginx ayarlar\u0131n\u0131 incelemek bu katmandaki sorunu ortaya \u00e7\u0131karmaz. Bir katmandaki izin, di\u011ferindeki engeli kald\u0131rmaz.<\/p>\n<pre><code>sudo nft -a list ruleset\nsudo timeout 20s tcpdump -i any -nn -c 50 'tcp port 443'<\/code><\/pre>\n<p>\u0130lk komut etkin kurallar\u0131 ve <code>handle<\/code> kimliklerini listeler. \u00c7\u0131kt\u0131n\u0131n <code>\/etc\/nftables.conf<\/code> ile ayn\u0131 oldu\u011funu varsaymay\u0131n; \u00e7al\u0131\u015fan yap\u0131land\u0131rma sonradan de\u011fi\u015ftirilmi\u015f olabilir. <code>hook input<\/code> zincirlerini, \u00f6ncelikleri, varsay\u0131lan politikay\u0131, adres k\u00fcmelerini ve <code>reject<\/code>\/<code>drop<\/code> kurallar\u0131n\u0131 inceleyin. Varsa saya\u00e7lar\u0131n istek s\u0131ras\u0131nda artmas\u0131 e\u015fle\u015fmeyi daralt\u0131r; saya\u00e7 bulunmamas\u0131 kural\u0131n i\u015flemedi\u011fini g\u00f6stermez.<\/p>\n<p>\u0130kinci komut <code>tcpdump<\/code> paketini gerektirir; 50 pakette veya 20 saniyede durur. S\u00fcre doldu\u011funda <code>timeout<\/code> i\u00e7in 124 \u00e7\u0131k\u0131\u015f kodu beklenebilir. Yakalama s\u00fcrerken proxy edilen <code>www.example.com<\/code> adresine ba\u015fka bir terminalden istek g\u00f6nderin. Bu dok\u00fcmantasyon alan\u0131n\u0131 uygulamadan \u00f6nce y\u00f6netti\u011finiz ger\u00e7ek alan ad\u0131yla de\u011fi\u015ftirin. Filtre di\u011fer HTTPS ba\u011flant\u0131lar\u0131n\u0131 da g\u00f6sterebilir; g\u00f6r\u00fclen kaynak adreslerini Cloudflare aral\u0131klar\u0131yla kar\u015f\u0131la\u015ft\u0131r\u0131n. Komut paketleri dosyaya yazmaz; \u00e7\u0131kt\u0131 terminalde g\u00f6r\u00fcn\u00fcr.<\/p>\n<p>Gelen SYN ard\u0131ndan sunucudan RST d\u00f6nmesi aktif reddetmeyle uyumludur; <code>reject with tcp reset<\/code> bunu \u00fcretebilir. Dinleyen servis bulunmamas\u0131 da RST olu\u015fturabilir. Yan\u0131ts\u0131z tekrarlanan SYN paketleri sessiz d\u00fc\u015f\u00fcrmeyle uyumludur ve Cloudflare 521 hatas\u0131 yerine zaman a\u015f\u0131m\u0131 belirtileri do\u011furabilir. Hi\u00e7 paket g\u00f6r\u00fcnmemesi tek ba\u015f\u0131na sa\u011flay\u0131c\u0131 engelini kan\u0131tlamaz.<\/p>\n<p>\u0130zin kapsam\u0131n\u0131 Cloudflare&#8217;\u0131n resm\u00ee IPv4 ve IPv6 adres aral\u0131klar\u0131ndan olu\u015fturun; statik, eksik liste kopyalamay\u0131n. <a href=\"https:\/\/www.vps.tc\/blog\/tr\/cidr-nedir-ip-araligi-hesaplama-rehberi\/\">CIDR g\u00f6sterimi<\/a>, tek adres yerine a\u011f aral\u0131\u011f\u0131n\u0131 e\u015fle\u015ftirmenizi sa\u011flar. Bu ortamda izinleri TCP 443 ve HTTP kontrol\u00fc ile HTTPS y\u00f6nlendirmesinde kullan\u0131lan TCP 80 \u00fczerinden de\u011ferlendirin.<\/p>\n<p>\u0130zin kural\u0131n\u0131 mevcut zincir s\u0131ras\u0131 ve varsay\u0131lan politikayla birlikte ele al\u0131n; ba\u015fka bir temel zincir, \u00f6nceki kabulden sonra paketi d\u00fc\u015f\u00fcrebilir. G\u00fcvenlik duvar\u0131n\u0131 kapatmay\u0131n. De\u011fi\u015fiklikten \u00f6nce SSH eri\u015fimini koruyun ve sa\u011flay\u0131c\u0131 konsolundan eski kurallara d\u00f6nebilece\u011finizi do\u011frulay\u0131n.<\/p>\n<div class=\"aiw-callout aiw-callout-warn\">\n<p class=\"aiw-callout-label\">Dikkat<\/p>\n<p>G\u00fcvenlik duvar\u0131n\u0131 tamamen kapatmak, te\u015fhis s\u0131ras\u0131nda ba\u015fka servisleri de internete a\u00e7abilir. nftables zincir s\u0131ras\u0131n\u0131 ve sa\u011flay\u0131c\u0131 kurallar\u0131n\u0131 birlikte inceleyin; aktif ba\u011flant\u0131 reddi ile sessiz paket d\u00fc\u015f\u00fcrme ayn\u0131 belirtiyi \u00fcretmeyebilir. De\u011fi\u015fiklikten \u00f6nce SSH eri\u015fimini, konsol eri\u015fimini ve geri d\u00f6n\u00fc\u015f ad\u0131m\u0131n\u0131 koruyun.<\/p>\n<\/div>\n<h2 id=\"full-strict-icin-https-yolunu-tamamlayin\">Full (strict) i\u00e7in HTTPS yolunu tamamlay\u0131n<\/h2>\n<p>TCP 80 \u00fczerinden yan\u0131t almak, kaynak sunucunun HTTPS ba\u011flant\u0131s\u0131n\u0131 kabul etti\u011fini g\u00f6stermez. Cloudflare&#8217;\u0131n 521 belgesi, Full (strict) kullan\u0131rken kaynakta TCP 443 eri\u015fiminin gerekti\u011fini belirtir. Dinleyici yoksa ba\u011flant\u0131 reddedilebilir. Katman\u0131 ay\u0131r\u0131n. TCP ba\u011flant\u0131s\u0131ndan sonraki TLS el s\u0131k\u0131\u015fmas\u0131 ve sertifika do\u011frulamas\u0131, farkl\u0131 hata noktalar\u0131d\u0131r.<\/p>\n<p>Varsay\u0131msal Ubuntu Server 24.04 LTS ve Nginx 1.24.0 laboratuvar\u0131nda a\u015fa\u011f\u0131daki blok, <code>\/etc\/nginx\/sites-available\/example.com<\/code> dosyas\u0131ndaki asgari HTTPS yap\u0131land\u0131rmas\u0131n\u0131 g\u00f6sterir. Nginx&#8217;in HTTPS belgesine uygun olarak dinleyici, sertifika zinciri ve \u00f6zel anahtar birlikte tan\u0131mlan\u0131r. Sabit yan\u0131t tan\u0131lama i\u00e7indir; mevcut uygulaman\u0131z\u0131n <code>location<\/code> bloklar\u0131n\u0131 bununla de\u011fi\u015ftirmeyin. TCP 80 \u00fczerindeki HTTPS y\u00f6nlendirmesini koruyun.<\/p>\n<pre><code>server {\n    listen 443 ssl;\n    server_name example.com www.example.com;\n\n    ssl_certificate \/etc\/letsencrypt\/live\/example.com\/fullchain.pem;\n    ssl_certificate_key \/etc\/letsencrypt\/live\/example.com\/privkey.pem;\n\n    access_log \/var\/log\/nginx\/access.log;\n    error_log \/var\/log\/nginx\/error.log;\n\n    location \/ {\n        return 200 \"HTTPS endpoint ready\\n\";\n    }\n}<\/code><\/pre>\n<p><code>\/etc\/nginx\/sites-enabled\/example.com<\/code> ba\u011flant\u0131s\u0131n\u0131n bu dosyay\u0131 etkinle\u015ftirdi\u011fini do\u011frulay\u0131n. \u0130ste\u011fe ba\u011fl\u0131 <code>2001:db8::10<\/code> adresi sunucuya atanm\u0131\u015fsa ve proxy edilen kay\u0131tta kullan\u0131l\u0131yorsa ayn\u0131 blo\u011fa <code>listen [::]:443 ssl;<\/code> ekleyin. Denetim ba\u015far\u0131l\u0131ysa yap\u0131land\u0131rmay\u0131 yeniden y\u00fckleyin:<\/p>\n<pre><code>sudo nginx -t &amp;&amp; sudo systemctl reload nginx<\/code><\/pre>\n<p>Denetimde <code>syntax is ok<\/code> ve <code>test is successful<\/code> ifadeleri beklenir; bunlar d\u0131\u015far\u0131dan eri\u015fimi kan\u0131tlamaz. Sertifika okunam\u0131yorsa veya anahtarla e\u015fle\u015fmiyorsa bildirilen hatay\u0131 giderin. \u00d6zel anahtar\u0131 herkese okunabilir yapmak \u00e7\u00f6z\u00fcm de\u011fildir.<\/p>\n<p>A\u015fa\u011f\u0131daki OpenSSL 3.0.x komutlar\u0131 kayna\u011fa do\u011frudan ba\u011flan\u0131r; SNI ile <code>www.example.com<\/code> ad\u0131n\u0131 g\u00f6nderir. Alan adlar\u0131 ve IP adresleri dok\u00fcmantasyon de\u011ferleridir, \u00e7al\u0131\u015f\u0131r internet hedefleri de\u011fildir. \u00c7al\u0131\u015ft\u0131rmadan \u00f6nce y\u00f6netti\u011finiz ger\u00e7ek de\u011ferlerle de\u011fi\u015ftirin.<\/p>\n<pre><code>openssl s_client -connect 192.0.2.10:443 \\\n  -servername www.example.com \\\n  -verify_hostname www.example.com \\\n  -verify_return_error -CApath \/etc\/ssl\/certs \\\n  -showcerts &lt;\/dev\/null\n\nopenssl s_client -connect 192.0.2.10:443 \\\n  -servername www.example.com -showcerts &lt;\/dev\/null |\n  openssl x509 -noout -subject -issuer -dates -ext subjectAltName<\/code><\/pre>\n<p>\u0130lk komutta ba\u015far\u0131l\u0131 do\u011frulama i\u00e7in <code>Verify return code: 0 (ok)<\/code> beklenir; zincir, istenen ad ve ge\u00e7erlilik yerel g\u00fcven deposuyla denetlenir. <code>-showcerts<\/code> sunucunun g\u00f6nderdi\u011fi sertifikalar\u0131 listeler. \u0130kinci komut yaln\u0131zca yaprak sertifikan\u0131n ayr\u0131nt\u0131lar\u0131n\u0131 g\u00f6sterir, ba\u011f\u0131ms\u0131z do\u011frulama yapmaz. <code>subjectAltName<\/code> i\u00e7inde <code>example.com<\/code> ve <code>www.example.com<\/code> adlar\u0131n\u0131, <code>notBefore<\/code> ve <code>notAfter<\/code> alanlar\u0131nda tarih aral\u0131\u011f\u0131n\u0131 kontrol edin.<\/p>\n<p>Cloudflare&#8217;\u0131n Full (strict) belgesi; s\u00fcresi ge\u00e7erli, istenen adla e\u015fle\u015fen, genel g\u00fcvenilir bir otoritenin veya Cloudflare Origin CA&#8217;n\u0131n verdi\u011fi sertifikay\u0131 \u015fart ko\u015far. Buradaki Let&#8217;s Encrypt zinciri yerel CA deposuyla do\u011frulanabilir; Origin CA varsay\u0131lan olarak ayn\u0131 depoda g\u00fcvenilir de\u011fildir.<\/p>\n<p>Cloudflare 521 hatas\u0131 ile TLS el s\u0131k\u0131\u015fmas\u0131 ba\u015far\u0131s\u0131zl\u0131\u011f\u0131n\u0131 belirten 525&#8217;i veya sertifika do\u011frulama sorununu belirten 526&#8217;y\u0131 e\u015fitlemeyin. Flexible&#8217;a ge\u00e7mek ya da do\u011frulamay\u0131 kapatmak yerine, Full (strict) i\u00e7in 443 dinleyicisini ve sunulan sertifika zincirini d\u00fczeltin.<\/p>\n<div class=\"aiw-callout aiw-callout-warn\">\n<p class=\"aiw-callout-label\">Dikkat<\/p>\n<p>Flexible moduna ge\u00e7mek, kaynak HTTPS sorununu d\u00fczeltmez; Cloudflare ile kaynak aras\u0131ndaki ba\u011flant\u0131y\u0131 HTTP&#039;ye \u00e7evirir. TCP 443 dinleyicisinin bulunmamas\u0131 ile TLS el s\u0131k\u0131\u015fmas\u0131 veya sertifika do\u011frulama hatas\u0131n\u0131 ayr\u0131 de\u011ferlendirin. Full (strict) i\u00e7in sertifikan\u0131n istenen alan ad\u0131n\u0131 kapsamas\u0131n\u0131, ge\u00e7erli olmas\u0131n\u0131 ve kabul edilen bir sertifika otoritesine dayanmas\u0131n\u0131 do\u011frulay\u0131n.<\/p>\n<\/div>\n<h2 id=\"duzeltmeyi-cloudflare-uzerinden-dogrulayin\">D\u00fczeltmeyi Cloudflare \u00fczerinden do\u011frulay\u0131n<\/h2>\n<p>Sayfan\u0131n a\u00e7\u0131lmas\u0131 tek ba\u015f\u0131na yeterli de\u011fildir. \u00d6nbellek yan\u0131ltabilir. Cloudflare&#8217;\u0131n 521 belgesi, hatay\u0131 kaynak sunucunun Cloudflare ba\u011flant\u0131s\u0131n\u0131 reddetmesiyle ili\u015fkilendirir; do\u011frulama bu nedenle hem do\u011frudan kayna\u011f\u0131 hem Cloudflare \u00fczerinden ge\u00e7en iste\u011fi kapsamal\u0131d\u0131r. \u00d6nbellekteki ba\u015far\u0131l\u0131 yan\u0131t, ba\u011flant\u0131 sorunu devam ederken de g\u00f6r\u00fcnt\u00fclenebilir.<\/p>\n<p>Varsay\u0131msal Ubuntu Server 24.04 LTS laboratuvar\u0131nda turuncu bulut a\u00e7\u0131k, mod <code>Full (strict)<\/code>, kaynak portu TCP 443 olarak kal\u0131r. Cloudflare&#8217;\u0131n Full (strict) belgesi, kaynak sertifikas\u0131n\u0131n do\u011frulanmas\u0131n\u0131 gerektirir. Do\u011frudan testte de sertifika denetimini koruyun; <code>curl<\/code> komutuna <code>-k<\/code> eklemeyin. Dok\u00fcmantasyon de\u011ferleri <code>www.example.com<\/code> ve <code>192.0.2.10<\/code> \u00e7al\u0131\u015f\u0131r hedefler de\u011fildir; komutlardan \u00f6nce y\u00f6netti\u011finiz ger\u00e7ek de\u011ferlerle de\u011fi\u015ftirin.<\/p>\n<p>Ge\u00e7ici bir Cloudflare Cache Rule ile ana makinesi <code>www.example.com<\/code>, yolu <code>\/<\/code>, sorgu dizesi <code>cf521check=<\/code> i\u00e7eren isteklerde \u00f6nbelle\u011fi atlay\u0131n. \u00c7ak\u0131\u015fan kurallar\u0131 kontrol edin. Yaln\u0131zca sorgu parametresi eklemek yeterli de\u011fildir; \u00f6nbellek anahtar\u0131 sorgu dizesini yok sayabilir. Do\u011frudan testi, kaynak g\u00fcvenlik duvar\u0131n\u0131n izin verdi\u011fi bir noktadan y\u00fcr\u00fct\u00fcn; do\u011frulama u\u011fruna eri\u015fimi herkese a\u00e7may\u0131n.<\/p>\n<pre><code>date -u +'%Y-%m-%dT%H:%M:%SZ'\ntoken=$(date -u +%Y%m%dT%H%M%SZ)\n\ncurl -sS --connect-timeout 5 --max-time 20 \\\n  --resolve www.example.com:443:192.0.2.10 \\\n  -D - -o \/dev\/null \\\n  \"https:\/\/www.example.com\/?cf521check=${token}-origin\"\n\ncurl -sS --connect-timeout 5 --max-time 20 \\\n  -D - -o \/dev\/null \\\n  \"https:\/\/www.example.com\/?cf521check=${token}-cloudflare\"\n\ncurl -sS --connect-timeout 5 --max-time 20 \\\n  -D - -o \/dev\/null https:\/\/www.example.com\/<\/code><\/pre>\n<p>\u0130lk GET iste\u011fi, alan ad\u0131n\u0131 ve TLS SNI bilgisini koruyarak kayna\u011fa ba\u011flan\u0131r. \u0130kincisi Cloudflare \u00fczerinden \u00f6nbelle\u011fi atlamas\u0131 beklenen kontrol\u00fc, \u00fc\u00e7\u00fcnc\u00fcs\u00fc normal adresi sorgular. <code>-D -<\/code> ba\u015fl\u0131klar\u0131 g\u00f6sterir; <code>-o \/dev\/null<\/code> g\u00f6vdeyi gizler. Sa\u011fl\u0131kl\u0131 ana sayfa i\u00e7in beklenen \u00e7\u0131kt\u0131 \u00f6rne\u011fin <code>200<\/code> durum kodudur; uygulaman\u0131z y\u00f6nlendiriyorsa hedefi ayr\u0131ca denetleyin.<\/p>\n<p><code>CF-Cache-Status: HIT<\/code> kaynak sa\u011fl\u0131\u011f\u0131n\u0131 kan\u0131tlamaz. Kontrol yan\u0131t\u0131ndaki <code>BYPASS<\/code> veya <code>DYNAMIC<\/code> de\u011ferini, kaynakta <code>\/var\/log\/nginx\/access.log<\/code> i\u00e7inde ayn\u0131 zaman belirtecini ta\u015f\u0131yan <code>-cloudflare<\/code> iste\u011fiyle e\u015fle\u015ftirin. Ba\u015fl\u0131\u011f\u0131n yoklu\u011fu da kan\u0131t de\u011fildir. \u00d6nbelle\u011fin atland\u0131\u011f\u0131n\u0131 ve iste\u011fin kayna\u011fa ula\u015ft\u0131\u011f\u0131n\u0131 birlikte do\u011frulamadan d\u00fczeltmeyi tamamlanm\u0131\u015f saymay\u0131n.<\/p>\n<p>\u0130zlemeyi ay\u0131r\u0131n: d\u0131\u015f HTTPS kontrol\u00fc Cloudflare \u00fczerinden beklenen durum kodunu ve i\u00e7eri\u011fi denetlesin; kaynakta <code>systemctl is-active nginx<\/code> servis durumunu izlesin. <code>active<\/code>, d\u0131\u015f eri\u015fimin sa\u011fl\u0131kl\u0131 oldu\u011funu g\u00f6stermez. <a href=\"https:\/\/www.vps.tc\/blog\/tr\/vpste-prometheus-grafana-kurulumu\/\">VPS&#8217;te Prometheus ve Grafana ile \u0130zleme<\/a> yakla\u015f\u0131m\u0131nda bu iki sinyal i\u00e7in ayr\u0131 alarmlar tan\u0131mlayabilirsiniz.<\/p>\n<p>Cloudflare 521 hatas\u0131 s\u00fcrerse destek kayd\u0131na UTC zaman damgas\u0131n\u0131, hata kodunu, varsa <code>CF-Ray<\/code> de\u011ferini, hedef TCP 443 portunu ve hassas bilgilerden ar\u0131nd\u0131r\u0131lm\u0131\u015f ilgili <code>access.log<\/code>\/<code>error.log<\/code> kesitlerini ekleyin. Ge\u00e7ici kural\u0131 kald\u0131rd\u0131ktan sonra normal URL&#8217;nin de\u011fi\u015fiklik sonras\u0131 kulland\u0131\u011f\u0131 ger\u00e7ek kaynak IP ve port yolunu yeniden kontrol edin.<\/p>\n<h2 id=\"degisiklikten-once-ve-sonra-kontrol-edin\">De\u011fi\u015fiklikten \u00d6nce ve Sonra Kontrol Edin<\/h2>\n<ul class=\"aiw-checklist\">\n<li>Cloudflare panelindeki proxy durumunu, A hedefini ve kullan\u0131l\u0131yorsa AAAA hedefini ger\u00e7ek kaynak yap\u0131land\u0131rmas\u0131yla kar\u015f\u0131la\u015ft\u0131r\u0131n.<\/li>\n<li>SSL\/TLS modunun Full (strict) oldu\u011funu ve Origin Rules ile hedef portun de\u011fi\u015ftirilmedi\u011fini do\u011frulay\u0131n.<\/li>\n<li>Yetkili bir d\u0131\u015f noktadan curl &#8211;resolve ile alan ad\u0131n\u0131 koruyarak kayna\u011fa ba\u011flan\u0131n ve ba\u011flant\u0131, TLS ve HTTP sonu\u00e7lar\u0131n\u0131 ayr\u0131 kaydedin.<\/li>\n<li>systemctl status nginx, ss -ltnp, nginx -t ve journalctl -u nginx \u00e7\u0131kt\u0131lar\u0131yla servis durumunu ve TCP 443 dinleyicisini denetleyin.<\/li>\n<li>Sunucu ve sa\u011flay\u0131c\u0131 g\u00fcvenlik duvarlar\u0131nda Cloudflare&#039;\u0131n resm\u00ee adres aral\u0131klar\u0131n\u0131, kural s\u0131ras\u0131n\u0131 ve SSH i\u00e7in geri d\u00f6n\u00fc\u015f eri\u015fimini kontrol edin.<\/li>\n<li>Etkin sanal sunucu ba\u011flant\u0131s\u0131n\u0131, sertifika adlar\u0131n\u0131, zincirini ve ge\u00e7erlilik s\u00fcresini do\u011frulay\u0131n; \u00e7al\u0131\u015fan Nginx&#039;e de\u011fi\u015fikli\u011fi yaln\u0131zca ba\u015far\u0131l\u0131 yap\u0131land\u0131rma testinden sonra reload ile uygulay\u0131n.<\/li>\n<li>Cloudflare \u00fczerinden \u00f6nbelle\u011fe al\u0131nmad\u0131\u011f\u0131 do\u011frulanan yan\u0131t\u0131 s\u0131nay\u0131n; hata s\u00fcrerse UTC zaman\u0131, varsa Ray ID, hedef port ve hassas bilgilerden ar\u0131nd\u0131r\u0131lm\u0131\u015f loglarla destek kayd\u0131 a\u00e7\u0131n.<\/li>\n<\/ul>\n<div class=\"aiw-cta\">\n<p>521 devam ediyorsa destek kayd\u0131n\u0131za UTC zaman\u0131n\u0131, varsa Ray ID&#039;yi, hedef portu ve hassas bilgilerden ar\u0131nd\u0131r\u0131lm\u0131\u015f test \u00e7\u0131kt\u0131lar\u0131n\u0131 ekleyin. Son de\u011fi\u015fikli\u011fin ard\u0131ndan yaln\u0131zca ana sayfan\u0131n a\u00e7\u0131lmas\u0131n\u0131 de\u011fil, Cloudflare&#039;\u0131n ger\u00e7ekten kulland\u0131\u011f\u0131 kaynak HTTPS yolunu yeniden do\u011frulay\u0131n.<\/p>\n<p class=\"aiw-cta-action\"><a href=\"https:\/\/www.vps.tc\/tr\/vps\">VPS paketlerini inceleyin<\/a><\/p>\n<\/div>\n<h2 id=\"sik-sorulan-sorular\">S\u0131k Sorulan Sorular<\/h2>\n<div class=\"aiw-faq\">\n<details class=\"aiw-faq-item\" open>\n<summary>Cloudflare 521 hatas\u0131 ne anlama gelir?<\/summary>\n<p>Cloudflare 521 hatas\u0131, Cloudflare&#039;\u0131n kaynak web sunucusuna ba\u011flant\u0131 kurmaya \u00e7al\u0131\u015f\u0131rken ba\u011flant\u0131n\u0131n reddedilmesiyle ili\u015fkilidir. Nginx&#039;in durmu\u015f olmas\u0131, beklenen portta dinleyici bulunmamas\u0131 veya Cloudflare adreslerinin g\u00fcvenlik duvar\u0131nca engellenmesi buna yol a\u00e7abilir. Taray\u0131c\u0131da g\u00f6r\u00fcnen kod, nedeni tek ba\u015f\u0131na belirlemez; kaynak adresini, servis durumunu ve a\u011f kurallar\u0131n\u0131 birlikte kontrol etmeniz gerekir.<\/p>\n<\/details>\n<details class=\"aiw-faq-item\">\n<summary>Siteye SSH ile ba\u011flanabiliyorken neden 521 al\u0131yorum?<\/summary>\n<p>SSH ve web trafi\u011fi farkl\u0131 servisleri ve portlar\u0131 kullan\u0131r; SSH \u00e7o\u011funlukla TCP 22 \u00fczerinden \u00e7al\u0131\u015f\u0131rken bu senaryodaki kaynak HTTPS ba\u011flant\u0131s\u0131 TCP 443 kullan\u0131r. SSH eri\u015fiminin a\u00e7\u0131k olmas\u0131, 443 dinleyicisinin veya Cloudflare izinlerinin do\u011fru oldu\u011funu kan\u0131tlamaz. Yerel HTTP yan\u0131t\u0131 da yeterli de\u011fildir; d\u0131\u015far\u0131dan HTTPS eri\u015fimini ayr\u0131ca s\u0131nay\u0131n.<\/p>\n<\/details>\n<details class=\"aiw-faq-item\">\n<summary>Cloudflare 521 ile 522, 523, 525 ve 526 aras\u0131ndaki fark nedir?<\/summary>\n<p>521 genellikle ba\u011flant\u0131n\u0131n reddedilmesiyle, 522 kaynak ba\u011flant\u0131s\u0131n\u0131n zaman a\u015f\u0131m\u0131na u\u011framas\u0131yla ili\u015fkilidir. 523 kayna\u011fa eri\u015filemedi\u011fini, 525 kaynakla TLS el s\u0131k\u0131\u015fmas\u0131n\u0131n ba\u015far\u0131s\u0131z oldu\u011funu belirtir. 526 ise Full (strict) modunda kaynak sertifikas\u0131n\u0131n do\u011frulanamad\u0131\u011f\u0131n\u0131 g\u00f6sterir. Bu ayr\u0131m incelemeye y\u00f6n verir; kesin neden i\u00e7in a\u011f davran\u0131\u015f\u0131n\u0131 ve ilgili loglar\u0131 do\u011frulaman\u0131z gerekir.<\/p>\n<\/details>\n<details class=\"aiw-faq-item\">\n<summary>Cloudflare&#039;\u0131 kapatmadan kaynak sunucuyu nas\u0131l test ederim?<\/summary>\n<p>Yetkili bir d\u0131\u015f test noktas\u0131nda curl &#8211;resolve ile alan ad\u0131n\u0131n TCP 443 ba\u011flant\u0131s\u0131n\u0131 kaynak IP&#039;ye y\u00f6nlendirebilirsiniz. HTTPS URL&#039;sinde alan ad\u0131 kald\u0131\u011f\u0131 i\u00e7in SNI ve Host bilgisi korunur. Kaynak yaln\u0131zca Cloudflare adreslerine a\u00e7\u0131ksa test IP&#039;nize s\u0131n\u0131rl\u0131 izin gerekir. Ba\u015far\u0131l\u0131 yan\u0131t, test noktas\u0131n\u0131n eri\u015fimini g\u00f6sterir; Cloudflare&#039;\u0131n eri\u015febildi\u011fini tek ba\u015f\u0131na kan\u0131tlamaz.<\/p>\n<\/details>\n<details class=\"aiw-faq-item\">\n<summary>Cloudflare 521 hatas\u0131 i\u00e7in hangi IP adreslerine izin vermeliyim?<\/summary>\n<p>Cloudflare&#039;\u0131n resm\u00ee IP listesinde yay\u0131mlanan g\u00fcncel IPv4 ve IPv6 aral\u0131klar\u0131n\u0131 esas al\u0131n. Tek bir g\u00f6zlemlenen Cloudflare adresine izin vermek yeterli de\u011fildir. \u0130zinleri kaynak HTTPS portu ve mevcut g\u00fcvenlik politikas\u0131yla s\u0131n\u0131rland\u0131r\u0131n; nftables yan\u0131nda sa\u011flay\u0131c\u0131 g\u00fcvenlik duvar\u0131n\u0131 da kontrol edin. Listeleri g\u00fcncellerken y\u00f6netim eri\u015fimini ve geri d\u00f6n\u00fc\u015f yolunu koruyun.<\/p>\n<\/details>\n<details class=\"aiw-faq-item\">\n<summary>SSL modunu Flexible yapmak 521 hatas\u0131n\u0131 \u00e7\u00f6zer mi?<\/summary>\n<p>Flexible, Cloudflare ile kaynak aras\u0131ndaki ba\u011flant\u0131y\u0131 HTTP&#039;ye ge\u00e7irir; eksik HTTPS dinleyicisini veya bozuk TLS yap\u0131land\u0131rmas\u0131n\u0131 onarmaz. Belirti de\u011fi\u015fse bile kaynak ba\u011flant\u0131s\u0131ndaki \u015fifreleme kald\u0131r\u0131lm\u0131\u015f olur ve y\u00f6nlendirme d\u00f6ng\u00fcs\u00fc olu\u015fabilir. Full (strict) kullan\u0131yorsan\u0131z \u00f6nce TCP 443 eri\u015fimini, ard\u0131ndan sertifika ad\u0131n\u0131, g\u00fcven zincirini ve ge\u00e7erlilik s\u00fcresini do\u011frulayarak HTTPS yolunu d\u00fczeltin.<\/p>\n<\/details>\n<\/div>\n<h2 id=\"kaynaklar\">Kaynaklar<\/h2>\n<ul class=\"aiw-sources\">\n<li><a href=\"https:\/\/developers.cloudflare.com\/support\/troubleshooting\/http-status-codes\/cloudflare-5xx-errors\/error-521\/\" target=\"_blank\" rel=\"noopener\">Cloudflare &#8211; Error 521: Web server is down<\/a> \u2014 developers.cloudflare.com<\/li>\n<li><a href=\"https:\/\/www.cloudflare.com\/ips\/\" target=\"_blank\" rel=\"noopener\">Cloudflare &#8211; Resm\u00ee IPv4 ve IPv6 adres aral\u0131klar\u0131<\/a> \u2014 cloudflare.com<\/li>\n<li><a href=\"https:\/\/developers.cloudflare.com\/ssl\/origin-configuration\/ssl-modes\/full-strict\/\" target=\"_blank\" rel=\"noopener\">Cloudflare &#8211; Full (strict) kaynak HTTPS gereksinimleri<\/a> \u2014 developers.cloudflare.com<\/li>\n<li><a href=\"https:\/\/nginx.org\/en\/docs\/http\/configuring_https_servers.html\" target=\"_blank\" rel=\"noopener\">Nginx &#8211; HTTPS sunucular\u0131n\u0131n yap\u0131land\u0131r\u0131lmas\u0131<\/a> \u2014 nginx.org<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>SSH ba\u011flant\u0131s\u0131n\u0131n \u00e7al\u0131\u015fmas\u0131, Cloudflare&#8217;\u0131n sitenize ula\u015fabildi\u011fini g\u00f6stermez. 521 hatas\u0131n\u0131 ara\u015ft\u0131r\u0131rken kaynak adresini, TCP 443 dinleyicisini ve Cloudflare ba\u011flant\u0131lar\u0131na uygulanan g\u00fcvenlik duvar\u0131 kurallar\u0131n\u0131 ayr\u0131 ayr\u0131 do\u011frulay\u0131n.<\/p>\n","protected":false},"author":2,"featured_media":1160,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[157],"tags":[],"class_list":["post-1162","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hosting"],"lang":"tr","translations":{"tr":1162,"en":1163},"pll_sync_post":[],"_links":{"self":[{"href":"https:\/\/www.vps.tc\/blog\/wp-json\/wp\/v2\/posts\/1162","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.vps.tc\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.vps.tc\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.vps.tc\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.vps.tc\/blog\/wp-json\/wp\/v2\/comments?post=1162"}],"version-history":[{"count":1,"href":"https:\/\/www.vps.tc\/blog\/wp-json\/wp\/v2\/posts\/1162\/revisions"}],"predecessor-version":[{"id":1164,"href":"https:\/\/www.vps.tc\/blog\/wp-json\/wp\/v2\/posts\/1162\/revisions\/1164"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.vps.tc\/blog\/wp-json\/wp\/v2\/media\/1160"}],"wp:attachment":[{"href":"https:\/\/www.vps.tc\/blog\/wp-json\/wp\/v2\/media?parent=1162"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.vps.tc\/blog\/wp-json\/wp\/v2\/categories?post=1162"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.vps.tc\/blog\/wp-json\/wp\/v2\/tags?post=1162"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}