2

There is a function using TCP pass through like this:

stream {
    upstream web_server {
        # the site to be visited is https://whatismyip.com, below is its real address
        server 104.27.194.88:443;
    }

    server {
        listen 443;
        ssl_preread on;
        proxy_pass web_server;
    }
}

reference

Therefore, if I type the public IP address of that nginx server after "https://" on my browser, given all the firewalls allowed, can I in fact reach the target site?

Actually what I got is whether to allow the ssl certificate from nginx server, then allowed, but got 403 forbidden by cloudflare.

If something went wrong, how to improve? Thanks.

1 Answer 1

4

First you need to change in your hosts file (or your DNS if you have access to your DNS server configuration) and add an entry similar with:

192.168.1.10 whatismyip.com

Or for DNS:

whatismyip.com IN A 192.168.1.10

Where 192.168.1.10 is the IP where Nginx is listening. In the browser use https://whatismyip.com and don't connect with the IP.

The config should use a hostname, because the whatismyip.com's IP address might change:

stream {
    upstream web_server {
        server whatismyip.com:443;
    }

    server {
        listen 443;
        ssl_preread on;
        proxy_pass web_server;
    }
}
7
  • I know you are trying to cheat the machine with internet browser to think whatismyip.com as 192.168.1.10 (as my nginx server ip). But the problem is that in no way I can even telnet 192.168.1.10 443 at first while telnet 104.27.194.88 443 is affirmative.
    – George Y
    May 15, 2021 at 14:27
  • It's not cheating. It is how host name resolution works. You need to make sure you have something listening on 192.168.1.10:443 You can check this on a Linux machine with: sudo ss -tlnp | grep :443 May 15, 2021 at 14:33
  • Yes, thanks. What is interesting is that I was able to telnet the 443 port (in fact 445) on that nginx server. But as I try to open the page by a Linux internet browser via links https://127.0.0.1:445 it negotiates the ssl protocol and then failed with 403 forbidden.
    – George Y
    May 15, 2021 at 14:50
  • You need to use the proper hostname, not the IP, that is why you need to change hosts file. See Name Based Virtual Hosting: en.wikipedia.org/wiki/Virtual_hosting#Name-based May 15, 2021 at 15:01
  • The hostname is used both for SSL certificate validation and for HTTP name based virtual hosting. May 15, 2021 at 15:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .