18

Is it possible to use Nginx as a HTTP/HTTPS proxy?

15

After some testings, I've found working for me the following configuration.

server {
  server_name ~^(www\.)?(?<domain>.+)$;
  access_log /var/log/nginx/proxy.access.log main;
  error_log /var/log/nginx/proxy.error.log crit;
  listen 10.255.1.13:8080;
  resolver 8.8.8.8;
  location / {
    proxy_pass http://$domain;
    proxy_redirect off;
    proxy_set_header Host $host;
    # Optional headers 
    # proxy_set_header X-Real-IP $remote_addr;
    # proxy_set_header X-Forwarded-For
    # $proxy_add_x_forwarded_for;
  }
}

This configuration works only for HTTP, not for HTTPS.

| improve this answer | |
  • 4
    Good job! Few hints. 1: listen ... default_server. 2: server_name "" or server_name _. 2: proxy_pass $scheme://$http_host. The limitations: poxying to upstreams with port 80 only; does not process redirects itself. – Alexander Azarov Aug 8 '11 at 14:00
  • $scheme is only useful if the vhost listens on https also - but then you have man in the middle risks and https certificate errors to contend with... both are big security issues to consider – anthonysomerset Jan 29 '14 at 11:40
9

i think the short answer is no, it was not written for forward proxying

UPDATE

to clarify my statement above:

NGINX was never written with forward proxying in mind - while its remotely possible to somehow jerry rig the config to do what you want it to do you will have to understand the following limitations:

  • Cache support almost non-existant (one of the main reasons for using a proxy)
  • Cant use for anything other than port 80 traffic (ie no logging into cpanel boxes through it)
  • No support for SSL based traffic
  • No support for standard proxy headers and http cache headers (my understanding is that these just get passed through
  • No support for other protocols that support proxy servers - eg VPN etc

Possible other considerations that are unknown at this time:

  • Possible to DoS your proxy as no real ability to fine grained access control/authentication (nginx has support for differing methods of access control but its unclear how this might behave in the forward proxy context)
  • Possible security risks to the machine that nginx is installed on because there might be possible security holes not considered because of using in an manner it wasnt designed to run
| improve this answer | |
  • Counterexample, see: ef.gy/using-nginx-as-a-proxy-server – kkurian Dec 27 '13 at 20:25
  • perhaps my answer should have been clearer it wasnt designed to do forward proxying - monkey patch efforts will not offer full proxy support like proxying requests to non standard (port 80) ports – anthonysomerset Jan 29 '14 at 11:30
4

If you want to use an HTTP/HTTPS proxy, you should use Squid. It was written to do exactly that. Nginx was written to act as a reverse proxy and load balancer, but not a forward proxy.

| improve this answer | |
  • I know about squid/oops/tinyproxy/etc. I just ask this question for the sake of academic interest – vlad Aug 8 '11 at 11:33

Not the answer you're looking for? Browse other questions tagged or ask your own question.