redirect example.com:3000 to example.com - node.js

Question

redirect (301) https://example.com:3000 to https://example.com, while 3000 port accessible only through IP:3000 and NOT through example.com:3000
Using Express.js app on port 3000.
Using nginx to proxy localhost:3000 with example.com.
And now https://example.com:3000 is not accessible (in chrome:
ERR_CONNECTION_CLOSED), but IP:3000 is accessible.
The problem is - search engines indexed almost all
https://example.com:3000 pages and these pages aren't accessible.
As 3000 port is already taken by nodejs, in nginx I cannot write:
server {
listen 3000;
server_name example.com;
return 301 https://example.com$request_uri;
}
nginx conf:
upstream nodejs {
ip_hash;
server localhost:3000;
}
server {
listen 80 default_server;
listen [::]:80 default_server;
server_name example.com;
return 301 https://$server_name$request_uri;
}
server {
listen 443 ssl default_server;
server_name example.com;
listen [::]:443 ssl default_server;
include snippets/ssl-example.com.conf;
include snippets/ssl-params.conf;
include /etc/nginx/snippets/letsencrypt-acme-challenge.conf;
location = /robots.txt {
root /root;
allow all;
log_not_found off;
access_log off;
}
location ~* \.(?:css|js)$ {
root /root;
expires 9d;
add_header Cache-Control "public, max-age=7200";
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none;
add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none;
# Optional: Don't log access to assets
access_log off;
}
location ~* ^.+\.(jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|pdf|txt|tar|wav|bmp|rtf|flv|swf)$
{
root /root;
expires 365d;
access_log off;
}
# #nodejs
location / {
add_header Cache-Control "private";
add_header Vary "Cookie, User-Agent";
proxy_redirect off;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_cache_bypass $http_upgrade;
include /etc/nginx/proxy_params;
proxy_pass http://nodejs;
}
}
How https://example.com:3000 => https://example.com
and restrict outer access to 3000 port (remain only localhost:3000)?

Answer 1

Add one more server block like the following:
server {
listen EXTERNAL_IP:3000 ;
server_name example.com;
include snippets/ssl-example.com.conf;
include snippets/ssl-params.conf;
include /etc/nginx/snippets/letsencrypt-acme-challenge.conf;
return 301 https://$server_name$request_uri;
}
Note, that application should listen to the only 127.0.0.1:3000, or you may face "address already in use".
In this case all incoming connections will be established with nginx, which redirects users accordingly to your rule.
In case you want to restrict access to port 3000, you may use any firewall. Example for iptables:
iptables -I INPUT -p tcp -i eth1 --dport 3000 -j DROP
But this will close access to https://example.com:3000 too.