0

Due to a mess of work networks i need to setup an NGINX reverse proxy to an external website that goes via the company MPLS proxy.

This is so other apps can point to an internal DNS address via HTTPS and then that address can either point to an internal STUB App which does not go through a proxy, or it's pointed to and ALB Listening on HTTPS that is pointed to the Reverse Proxy EC2 running listening on HTTP which sends it out to the External Host as a NGINX Transparent Reverse Proxy via HTTPS.

On the EC2 Instance if i do curl -x http://111.222.333.444:1234 https://external.host.name:5678 i get back an expected result from hitting the external host but i cannot get the same responce back from my nginx x host the upstream proxy seems to be denied access "Access Denied (policy_denied)"

Since i am not on my work computer i have to manually type out my current configuration so sorry if i make a mistake (Ip Addresses and Hosts obscured for obvious security reasons)

Also to rule out SELINUX issues i've set setenforce 0 for the moment untill i can get a working connection.

There are HTTP_PROXY and HTTPS_PROXY variables on the box set to another broxy, but i don't believe NGINX is using them, though i could be wrong.

My current configs after several hours of playing around:

under /etc/nginx/conf.d/proxy.conf

upstream proxy {
  server 111.222.333.444:1234
}

under /etc/nginx/default.d/reverse-proxy.conf

location / {
  proxy_buffering off;
  proxy_pass http://proxy;  
  proxy_redirect http://proxy https://external.host.name:5678;

  proxy_set_header Host external.host.name;
  proxy_set_header Referer $http_referer;
  proxy_set_header X-Real-IP $remote_addr;
  proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  proxy_set_header X-Forwarded-For $scheme;
  proxy_set_header X-Forwarded-Host $host:$server_port;
  proxy_set_header X-Forwarded-Server $host;
}

I believe that's the whole config at current, Sorry if i've forgotten anything. Does anyone have a working config for this type of setup or show me where i'm going wrong please?

Edit:

Further Info, if i do curl http://111.222.333.444:1234/https://external.host.name:5678 I get the same error as the NGINX result

The only difference i can see is the Host Header

on the failed one the Header is "Host: 111.222.333.444:1234"

on the success the Header is "Host: external.host.name:5678" and there's an additional header "X-Forwarded-For: 555.666.777.888"

I have not been able to figure out what the ip in the X-Forwarded-For is as it's not the box i am on

I have tried the following but all i get back from the proxy is Network Error (dns_server_failure)

location / {
  proxy_buffering off;
  proxy_pass http://111.222.333.444:1234/https://external.host.name:5678;

  proxy_set_header Host external.host.name:5678;
  proxy_set_header X-Forwarded-For 555.666.777.888;
}
Cyber Axe
  • 176
  • 3
  • 7

0 Answers0