Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is it possible to use nginx as ordinal http/https proxy? (not reverse http proxy)

UPDATE: Yes, i know about squid/oops/tinyproxy/etc. Please do not answer if you dont know answer to question (or just for rating score).

share|improve this question

closed as off-topic by Michael Hampton Jan 29 at 15:53

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must be relevant to professional system administration. Server Fault is dedicated to professional system and network administrators. End user and enthusiast questions are off-topic (contact your system administrator or hire a professional to help you out). Please see the Help Center for more information." – Michael Hampton
If this question can be reworded to fit the rules in the help center, please edit the question.

3 Answers 3

i think the short answer is no, it was not written for forward proxying

UPDATE

to clarify my statement above:

NGINX was never written with forward proxying in mind - while its remotely possible to somehow jerry rig the config to do what you want it to do you will have to understand the following limitations:

  • Cache support almost non-existant (one of the main reasons for using a proxy)
  • Cant use for anything other than port 80 traffic (ie no logging into cpanel boxes through it)
  • No support for SSL based traffic
  • No support for standard proxy headers and http cache headers (my understanding is that these just get passed through
  • No support for other protocols that support proxy servers - eg VPN etc

Possible other considerations that are unknown at this time:

  • Possible to DoS your proxy as no real ability to fine grained access control/authentication (nginx has support for differing methods of access control but its unclear how this might behave in the forward proxy context)
  • Possible security risks to the machine that nginx is installed on because there might be possible security holes not considered because of using in an manner it wasnt designed to run
share|improve this answer
    
Counterexample, see: ef.gy/using-nginx-as-a-proxy-server –  kkurian Dec 27 '13 at 20:25
    
perhaps my answer should have been clearer it wasnt designed to do forward proxying - monkey patch efforts will not offer full proxy support like proxying requests to non standard (port 80) ports –  anthonysomerset Jan 29 at 11:30
up vote 3 down vote accepted

After some expiriments, i've found working for me configuration.

server {

  server_name ~^(www\.)?(?<domain>.+)$;
  access_log /var/log/nginx/proxy.access.log main;
  error_log /var/log/nginx/proxy.error.log crit;
  listen 10.255.1.13:8080;
  resolver 8.8.8.8;
  location / {
    proxy_pass http://$domain;
    proxy_redirect off;
    proxy_set_header Host $host;
    # Optional headers 
    # proxy_set_header X-Real-IP $remote_addr;
    # proxy_set_header X-Forwarded-For
    # $proxy_add_x_forwarded_for;
  }
}

This configuration works only for HTTP, not for HTTPS

share|improve this answer
2  
Good job! Few hints. 1: listen ... default_server. 2: server_name "" or server_name _. 2: proxy_pass $scheme://$http_host. The limitations: poxying to upstreams with port 80 only; does not process redirects itself. –  Alexander Azarov Aug 8 '11 at 14:00
    
$scheme is only useful if the vhost listens on https also - but then you have man in the middle risks and https certificate errors to contend with... both are big security issues to consider –  anthonysomerset Jan 29 at 11:40

If you want to use an HTTP/HTTPS proxy, you should use Squid. It was written to do exactly that. Nginx was written to act as a reverse proxy and load balancer, but not a forward proxy.

share|improve this answer
    
I know about squid/oops/tinyproxy/etc. I just ask this question for the sake of academic interest –  vlad Aug 8 '11 at 11:33

Not the answer you're looking for? Browse other questions tagged or ask your own question.