> (I guess you either removed the INPUT DROP rule; or added an explicit
> "allow 443" beside the "allow 80" rule that was already there.
> Whichever
> it was, it was "make the local firewall allow the traffic get to
> nginx".)

Right, the allow 443 actually existed but there was a rule above it that was routing traffic such that it didn't even get to my allow rule. Using iptables -nvL I was able to see the packet count and see that 0 packets were getting to my allow rule.