I am using nginx right now for our production sites with the reverse proxy to apache that's on the same server and it works fantastic.

I'm wondering if I can do this:

Install nginx on box #1 in say Canada and have it reverse proxy http requests to box #2 in a datacenter in the USA. I know there may be some latency or delays in loading the page etc but that would probably be not noticable to the end user especially if both servers have 100mb ports. Box #2 only does the apache requests, all images are served from box #1 via nginx.

Now, would the end visitor be able to tell in any which way that there are 2 boxes being used? Box #2 has sensitive data which we can't have stolen in the event of hacking etc, so this method helps keep things a bit more secure.

Anyone know if this is possible or have done something similar?


If the connection to box #2 fails, nginx will display an error page ("502 Bad Gateway" with nginx signature). You can replace this page with your own, served from box #1.

  • ok great, so to the user though they will never be able to find out about box #2 via IP's or anything? – user56572 Oct 26 '10 at 6:29
  • I think so, unless box #2 exposes its IP somehow in a generated page. – sendmoreinfo Oct 26 '10 at 10:46

no the users will think that the server is only in canada, since the box#2 is a backend.

..check out also haproxy !


I think you should set proxy_intercept_errors on server #1 to make sure no error pages generated on #1 reach the user. They can contain information about the backend behind the proxy.

syntax: proxy_intercept_errors [ on|off ];
default: proxy_intercept_errors off;
context: http, server, location 
This directive decides if nginx will intercept responses with HTTP status codes of 400 and higher.
By default all responses will be sent as-is from the proxied server.

Read on on http://wiki.nginx.org/HttpProxyModule.

Also check your apache config on #2 and make sure you're providing the least information possible about that host on error pages. For example:

ServerTokens ProductOnly
ServerSignature Off

This avoids apache providing the version number, etc. on the footer on error pages (in case one gets through for whatever reason). It would still say 'Apache', though. If you want to get rid of that I think you have to edit httpd.h (in the source distribution) and recompile.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy