Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a CCTV server running on a local IP address. When our staff want to login remotely they first need to connect via VPN to gain access. I would like to allow access without the need for a VPN but without giving the server itself a public IP as it's used for other purposes aswell.

I also have another server on the same LAN that hosts a couple of small Rails applications using NGINX and Unicorn. It occurred to me that I could use the NGINX upstream option to forward requests from the 'rails' server to the CCTV server.

One of the other reasons for doing this is that I would like to use the wildcard SSL certificate and it's easier, in my opinion, to use an existing server with this setup than installing the certificate onto the CCTV server which is running Windows Server 2008.

I have tried with the following configuration to forward requests but it's not working. I basically duplicated a working NGINX configuration file and altered it slightly.

What do I need to do to get this working? Here is the configuration file:

    upstream cctv {
  server 192.168.1.52:7443;
}

server {
  listen 80;
  server_name cctv.domain.io;
  client_max_body_size 4G;
  keepalive_timeout 5;
  root /;

  location / {
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_redirect off;
    proxy_read_timeout 300s;
    if (-f $request_filename) {
      add_header Cache-Control max-age=3600;
    }
    if (!-f $request_filename) {
      proxy_pass http://cctv;
      break;
    }
  }
}

server {
  listen 443 default ssl;
  ssl_certificate /etc/ssl/STAR_domain_io.crt;
  ssl_certificate_key /etc/ssl/domainio.key;
  server_name cctv.domain.io;
  client_max_body_size 4G;
  keepalive_timeout 5;
  root /;

  location / {
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_set_header X-Forwarded-Proto https;
    proxy_redirect off;
    proxy_read_timeout 300s;
    if (-f $request_filename) {
      add_header Cache-Control max-age=3600;
    }
    if (!-f $request_filename) {
      proxy_pass http://cctv;
      break;
    }
  }
}

I would imagine that a lot of the configuration could be removed, I'm just not sure what. If it helps, the CCTV software is Ubiquiti Airvision.

share|improve this question

2 Answers 2

To meet your goal I would considering using SSH tunnels. One end of a tunnel would on the desktop of a remote work, and the other end would be on the machine where the CCTV server. From the perspective of the CCTV server, the access to it is now "local". Likewise, the remote users would appear to be connecting to a port on their local machine.

There are a number of SSH tunnelling (port forwarding) tutorials out there you could use to follow through which are easily found by searching. Here's a reference to the official related Ubuntu docs as a starting point.

Each remote worker could use an SSH tunnel instead of a VPN connection.

share|improve this answer

Maybe I'm underthinking this, but wouldn't you be able to use nginx as a forward proxy like so:

server {
    listen       9001;

    location / {
        proxy_pass http://$cctv_host$uri$is_args$args;
    }
}
share|improve this answer
    
And... Just realized you have this alongside all your other configuration options. Are you able to bring your conf down to a small file to try see if something smaller will work before fleshing it out? –  Kyle Kelley Jul 22 '13 at 2:22

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.