I am trying to access my switch through my Nginx reverse proxy. I can access the switch fine using the local ip over http, but when I try with the domain name through my reverse proxy with over https, I can get the login page, but when I enter my credentials and click login the page times out (error 502). The issue seems to be with the logon.cgi page.

Would anyone know how to correctly configure a reverse proxy for this switch? (I have similar configuration working for my TP-Link router and many other services)

Here is my simple reverse proxy configuration:

server {    
    listen 80 default_server;
    listen [::]:80 default_server;
    return 301 https://$host$request_uri;

server {
    listen 443 ssl http2;
    server_name switch.example.com

    ssl_certificate ...
    ssl_certificate_key ...

    access_log            /var/log/nginx/switch.access.log;
    error_log            /var/log/nginx/switch.error.log;

    location / {

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_buffering off;
        client_max_body_size 0;
        proxy_connect_timeout  3600s;
        proxy_read_timeout  3600s;
        proxy_send_timeout  3600s;
        send_timeout  3600s;

        proxy_set_header X-NginX-Proxy true;


      proxy_redirect https://switch.example.com;

I have tried to debug using the browser dev tools but I really don't understand what is wrong. Using hard DNS mapping from switch.example.com to works, and here is what I see in the dev tools for the login script:

Request URL: http://switch.example.com/logon.cgi
Request Method: POST
Status Code: 200 OK
Remote Address:
Referrer Policy: strict-origin-when-cross-origin
Connection: close
Content-Type: text/html
Transfer-Encoding: chunked
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cache-Control: max-age=0
Connection: keep-alive
Content-Length: 53
Content-Type: application/x-www-form-urlencoded
Host: switch.example.com
Origin: http://switch.example.com
Referer: http://switch.example.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.67 Safari/537.36 OPR/87.0.4390.45

But when I try to access the switch through my reverse proxy (setting a CNAME that points to my nginx server), here's what I see:

Request URL: https://switch.example.com/logon.cgi
Referrer Policy: strict-origin-when-cross-origin
:authority: switch.example.com
:method: POST
:path: /logon.cgi
:scheme: https
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
accept-encoding: gzip, deflate, br
accept-language: en-US,en;q=0.9
cache-control: max-age=0
content-length: 53
content-type: application/x-www-form-urlencoded
origin: https://switch.example.com
referer: https://switch.example.com/
sec-ch-ua: " Not A;Brand";v="99", "Chromium";v="101", "Opera";v="87"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
sec-fetch-dest: document
sec-fetch-mode: navigate
sec-fetch-site: same-origin
sec-fetch-user: ?1
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.67 Safari/537.36 OPR/87.0.4390.45

Also, I have used WireShark to capture the request when I successfully login using the local ip address ( Wireshark screenshot (Sorry for the link, not enough rep)

Looking at the Nginx error log, I see it is a timeout error:

the error from the Nginx reverse proxy is a timeout error:

2022/06/10 16:53:54 [error] 3630#3630: *29 upstream timed out (110: Unknown error) while reading response header from upstream, client:, server: switch.example.com, request: "POST /logon.cgi HTTP/2.0", upstream: "", host: "switch.example.com", referrer: "https://switch.example.com/"
  • There is no "generic reverse proxy configuration for a managed switch". Each of them could require own unique quirks. My suggestion would be to enable developer tools in the browser and look to the "network" page see what requests it sends when it works correctly and what it is different with the reverse proxy. Jun 10, 2022 at 7:51
  • Thanks for the suggestion @NikitaKipriyanov, I have updated my post with that information
    – Remz1337
    Jun 10, 2022 at 17:08
  • @NikitaKipriyanov did you find a solution to this? If you did I'd appreciate you're sharing it.
    – aug70co
    Sep 10 at 5:18
  • I ended up setting local DNS with pihole to point directly to my switch's IP. not ideal but good enough for my needs
    – Remz1337
    Sep 11 at 15:17

1 Answer 1


If your use case is similar to mine. This was my solution to put the TP-Link switch behind Nginx proxy. You can quickly try it out using the docker-compose file in that project.

Below is a quick view of the configuration;

        gzip off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header Cookie $http_cookie;
        proxy_set_header Referer https://switch1.my.home/;
  • Thanks for sharing. With your config, the errors have disappeared, but when I click the Login button nothing happens (the tab spins indefinetly)
    – Remz1337
    Sep 19 at 3:23
  • Hmm, I'm sorry it didn't work for you. It worked for me pretty god. You might want to try it out with dev tab open and "Disable Cache" on the Network tab checked. I used this on my Kubernetes cluster as an Ingress with nginx.ingress.kubernetes.io/configuration-snippet annotations. My PoC location stanza also had proxy_read_timeout (value 300s) and proxy_connect_timeout (value 75s) properties. Maybe add those too?
    – aug70co
    Sep 19 at 3:48
  • Yea I actually copied the whole config you have in your repo. I'm not using Docker so I don't run it as you do, but config should be the same anyway. Maybe a difference in model revision? my switch revision is 2.0 (hardware) running firmware 1.0.0 Build 20191218 Rel.49932
    – Remz1337
    Sep 21 at 0:16
  • My firmware is upgraded to the latest "Firmware Version 1.0.0 Build 20230218 Rel.50633", "Hardware Version TL-SG108E 6.0"
    – aug70co
    Sep 21 at 12:46

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .