1

I have load balancing nginx server 192.168.2.168 with the following nginx config:

upstream balancer {
server 192.168.2.165;
server 192.168.2.166 backup;
}
server {
listen 80;
server_name 192.168.2.168;
error_log /var/log/nginx/balancer-error_log;

location /something {
proxy_pass http://balancer;
}
}

Then I try 192.168.2.168/something it gives 403 Forbiden

tailf /var/log/error.log on the 192.168.2.165 shows: 

*47 directory index of "/usr/share/nginx/html/glpi/" is forbidden, client: 192.168.2.168, server: localhost, request: "GET /glpi/ HTTP/1.0", host: "balancer"

But if I replace http://balancer with http://192.168.2.165 it works fine.

proxy_pass http://192.168.2.165;

What am I doing wrong and how to make upsream servers work?

montag451F
  • 11
  • 1
  • What does the access log on 192.168.2.165 have regarding both the good and the bad response? The main difference is the Host header used to access 192.168.2.165 - the working one has a Host header of 192.168.2.165. – Richard Smith Sep 19 '18 at 21:19
  • Maybe related to https://stackoverflow.com/a/24830777/3399504 – ErvalhouS Sep 20 '18 at 15:30

1 Answers1

0

The problem is solved using server_name balancer.home; instead of server_name 192.168.2.168; + I added some headers.

Here is my config:

upstream backend {
server 192.168.2.165;
server 192.168.2.166;
server 192.168.2.167 backup;
}

server {
    listen 80;
    server_name balancer.home;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name balancer.home;

    ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt;
    ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;

    error_log /var/log/nginx/balancer-error_log;
    access_log /var/log/nginx/balancer-access_log;

    location / {
            proxy_pass_header   Server;
            proxy_set_header    Host $host;
            proxy_set_header    X-Real-IP $remote_addr;
            proxy_set_header    X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header    X-Forwarded-Proto $scheme;

    proxy_pass http://backend;
}
}

PS: On upstream servers, the same server_name as on the balance server (domain name) should be specified.

montag451F
  • 11
  • 1