4

I have a node application running on port 8443. My nginx handles the web requests on port 80 and 443 and should redirect the user to 8443.

here's my /etc/nginx/sites-enabled/default config:

upstream my_upstream {
   server 127.0.0.1:8443;
   keepalive 64;
}

server {
    listen 80;
    server_name myapp.com;
    rewrite ^/(.*) https://myapp.com/$1 permanent;
}

server {
    listen 443 ssl;
    server_name 12.34.12.34 www.myapp.com myapp.com *.myapp.com;
    ssl_certificate /path/to/my/cert.crt;
    ssl_certificate_key /path/to/my/private.key
    // other ssl params

    location / {
        proxy_redirect off;
        proxy_pass https://my_upstream;
        // other params 
    }
}

with this config I can access my app via

http(s)://myapp.com:8443

only when I add the following iptables

iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-ports 8443
iptables -t nat -A OUTPUT -p tcp --dport 443 -o lo -j REDIRECT --to-port 8443

I can access

http(s)://myapp.com

Questions:

It seems kinda silly to me to redirect from port 80 to 443 to 8443 using iptables. Is there a way to do this with nginx only (or is this the way to go?).

Is this approach (having the application on a non standard port like 8443) a good idea at all?

  • Why do you want to redirect in this way? I've answered a very similar question over on SO which might be of interest: stackoverflow.com/questions/33333269/nodejs-instead-of-apache/… – Barry Pollard Oct 26 '15 at 13:46
  • aren't you suggesting what I'm trying to do? Having node run on a specific port (in my example 8443) and run nginx as the webserver on port 80/443 – Markus Oct 26 '15 at 19:32
  • I thought you were also asking SHOULD you do that. To answer your last two questions in your original question: 1) yes there is a way to do this in Nginx (as others have answered) and yes this is the way to go (as per my link). 2) it's fine to have apps on non-standard ports if there is a front end process (like Nginx) on standard ports which are how the app is accessed by outside world (and don't allow direct access to the service). Personally I don't think you need https between Nginx and Node if on same server so I wouldn't use 8443 as the port number as that would imply https. Make sense? – Barry Pollard Oct 26 '15 at 19:50
  • maybe I'm missing something, but I don't see how any of the given answers are different from my solution. I have the nginx running on 80/443 and node on 8443 (could be any port). The problem is that I can't access my app via http(s)://myapp.com without the iptables rules – Markus Oct 26 '15 at 20:14
  • Apologies I completely missed the fact you already had proxy_redirects in place in your originally question! Hmmm that should work. Is Nginx definitely running? If you go to myapp.com does it redirect? Anything in error logs? Also I'd remove the https from proxy_redirect for now as that will add extra complications so try with just a http call. Do you see that hitting your node app at all in its logs? – Barry Pollard Oct 26 '15 at 20:30
2

Easy. Since your node.js is running on port 8443, and as far as I understood, you don't have any other service listening for requests in other ports, you can simply do this in your nginx configuration:

server {
    # here comes the rest of your nginx configuration
    location / {
        proxy_pass http://127.0.0.1:8443;
    }
}

You don't have to use any iptables rules, nor create an upstream section in your nginx configuration. nginx can (and should) do all the port redirect out of the box (as normally any reverse proxy does).

I could be wrong, but the reason your application starts working after the iptables rules is because your clients start to access your node.js server directly, because of the port redirect, which is similar to when we use Squid as a transparent proxy.

This article can help you. Ignore the fact the it was addressed to Apache:

Good luck and best regards!

  • unfortunately it didn't help. From what I understand I don't see much difference to my original config though? Thanks for the article, but I still don't really know why my original solution doesn't work – Markus Oct 10 '15 at 7:52
1

It's a bit pointless and wasteful to be doing encryption on 127.0.0.1 between nginx and your upstream, when your upstream is running at 127.0.0.1.

If anything, your solution with iptables redirect would actually be much more efficient than simply getting nginx into the mix, without any changes to the upstream.

But we have to ask -- if you're not using any extra cool features of nginx, why do you want to add it into the mix in the first place?

The proper approach would be to run your upstream without https, and redirect both the http and https to the upstream with nginx. The reason your present config doesn't work likely has to do with some configuration error, which is not obvious from the snippets you've pasted so far.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.