1

Here's my basic setup:

Router forwarding port's 80 and 443 to Ubuntu Server 14.04 running apache. Works great.

Running several virtual machines (QEMU/KVM) on Ubuntu server. VM's are in bridged mode so they have their own internal IP address.

I would like to redirect all traffic for subdomain to the VM's for handling.

Ex:

sub1.example.com -> VM1

sub2.example.com -> VM2

sub3.example.com -> VM3

I would like this to forward ssl requests to the VM for handling.

Currently I'm getting redirect loops or ssl errors, regardless of what I try. I can get non-ssl to work, but I'm not sure how to setup the Ubuntu server to handle and forward requests for HTTP and HTTPS.

Edit:

Here are my current virtual hosts files:

<VirtualHost *:80>
    ServerName sub1.example.com
    ProxyPreserveHost On
    ProxyPass / http://192.168.1.78/
    ProxyPassReverse / http://192.168.1.78/
</VirtualHost>

<VirtualHost *:443>
    ServerName sub1.exmaple.com
    ProxyPreserveHost On    
    ProxyPass / http://192.168.1.78/
    ProxyPassReverse / http://192.168.1.78/
</VirtualHost>

I know this isn't correct, but not sure how to do it. The main server will receive request from http://sub1.example.com and https://sub1.example.com

Edit 2:

I forgot to mention that I have this working for non-ssl using this:

<VirtualHost *:80>
  ServerName zab.example.com # this forwards to my zabbix VM
  ProxyPreserveHost on
  ProxyPass / http://192.168.1.64/
  ProxyPassReverse / http://192.168.1.64/
</VirtualHost>

This takes incoming requests for zab.example.com and forwards them to my Zabbix VM at 192.168.1.64. So port 80 redirects to VM's are working well.

Thanks for any help!

Edit 3:

I'm still missing something (again, I'm a novice :) )

Here are all my virtual hosts:

WAN -> 192.168.1.66 (Main Server)

<VirtualHost *:80>
   ServerName file.example.com
   redirect permanent / https://file.example.com/
</VirtualHost>

<VirtualHost *:443>
 ServerName file.example.com
 SSLEngine On
 SSLCertificateFile /home/js/Seafile/file_ws_ee.crt
 SSLCertificateKeyFile /home/js/Seafile/file.example.com.key
 SSLCertificateChainFile /home/js/Seafile/GeoTrustDVSSLCAG4.cer
 SSLProxyEngine On
 ProxyPreserveHost off
 ProxyRequests off
 ProxyPass / http://file.example.com/
 ProxyPassReverse / http://file.example.com/
</VirtualHost>

Internal VM 192.168.1.78 (running Seafile)

<VirtualHost *:80>
   ServerName file.example.com
   redirect permanent / https://file.example.com/
</VirtualHost>

<VirtualHost *:443>
  ServerName file.example.com
  DocumentRoot /var/www
  Alias /media  /home/js/Seafile/seafile-server-latest/seahub/media

  SSLEngine On
  SSLCertificateFile /home/js/Seafile/file_ws_ee.crt
  SSLCertificateKeyFile /home/js/Seafile/file.example.com.key
  SSLCertificateChainFile /home/js/Seafile/GeoTrustDVSSLCAG4.cer

  RewriteEngine On

    <Location /media>
        Require all granted
    </Location>

  #
  # seafile fileserver
  #
  ProxyPass /seafhttp http://127.0.0.1:8082
  ProxyPassReverse /seafhttp http://127.0.0.1:8082
  RewriteRule ^/seafhttp - [QSA,L]

  #
  # seahub
  #
  RewriteRule ^/(media.*)$ /$1 [QSA,L,PT]
  RewriteCond %{REQUEST_FILENAME} !-f
  RewriteRule ^(.*)$ /seahub.fcgi/$1 [QSA,L,E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
</VirtualHost>

Running wget file.example.com results in:

HTTP request sent, awaiting response... 301 Moved Permanently
Location: https://file.example.com/ [following]
20 redirections exceeded.

Thoughts?

  • How are you currently attempting to set this up ? – user9517 Jan 17 '16 at 18:11
  • Edited to include my config in apache. Long story is I'm running a file server currently on the main server, which is working fine using a subdomain. I want to move it to a VM, so all incoming requests are forwarded to the VM on 192.168.1.78. I don't want any auth to happen on the main server. Thoughts? Thanks! – Jon S. Jan 17 '16 at 18:32
1

Trying to have apache pass SSL to another server serving SSL is more trouble than it's worth. You're better off having it handled at the main apache server. It's just easier that way. Here's an example of what I've done for one of my five subdomains. I've taken out any extra configuration options that aren't relevant to your question.

<VirtualHost *:80>
    ServerAdmin example@gmail.com
    ServerName sentinel.example.net
    ServerAlias sentinel
    RewriteEngine On
    RewriteRule ^(.*) https://%{HTTP_HOST}/$1
</VirtualHost>

<VirtualHost *:443>
    # SSL
    SSLEngine On
    SSLCertificateFile /etc/pki/tls//web/sentinel.pem
    SSLCertificateKeyFile /etc/pki/tls/web/sentinel.key
    SSLCertificateChainFile /etc/pki/tls/startssl/startssl.pem
    # Basics
    ServerAdmin example@gmail.com
    ServerName sentinel.example.net
    ServerAlias sentinel
    # Proxy
    ProxyPreserveHost Off
    ProxyRequests off
    SSLProxyEngine On
    ProxyPass / http://sentinel.example.net/ timeout=60
    ProxyPassReverse / http://sentinel.example.net/ timeout=60
</VirtualHost>
  • Thanks. I can see the rewrite from http to https for *.80, but how is it forwarding it to another internal IP address (VM). So the main server is running apache at 192.168.1.66 (WAN IP forwards both 80 and 443 here). I have a virtual machine running at 192.168.1.78 and I want all requests for sub1.example.com forwarded here. I can get subdomain redirects working if they're all running on the main server, or even VM redirects as long as it's all port 80 (no SSL). – Jon S. Jan 17 '16 at 18:37
  • This is what I do. protocol convert then proxy - works like a charm. – user9517 Jan 17 '16 at 18:53
  • @JonS. It's the same concept. I'm forcing SSL because I don't want clear text on that subdomain. Look at my 443 virtual host. I'm doing a proxypass to do the redirect. You can do the same thing through non-SSL without issues. I have one single web server that holds on site and redirects to the other subdomains. – Sokel Jan 17 '16 at 21:30
  • Thanks for the help, I really appreciate it, but I don't get it. I'll admit that I'm sort of a novice. What I see your example doing is taking incoming http and rewriting it to https. Then processing the ProxyPass and ProxyPassReverse against that URL for the local virtual path '/'. Where do i define '/' as 192.168.1.78? Do I share the webserver folder to the host and map it that way? I fear I would have broken links, as not all links are relative to the main path. I'm thinking I might need authoritative named or dnsmasq to handle ssl redirects? – Jon S. Jan 17 '16 at 23:34
  • You don't have to define "/" in any way, on the main web server nor the backend VM. There's no need. The only time you need to define something like that is if you're doing something special on the VM you are redirecting to, or if you are only planning to redirect a specific link/folder to another web server. – Sokel Jan 18 '16 at 0:55
0

You need to replace the hostname by the ip address of your virtual machine, if you don't have your own dns server. If you use a hostname then apache will resolve and replace the hostname at startup by its ip address. If there is no local dns server, then this will create a loop, as apache will use a public dns server which resolves the hostname to your public ip and send the http request back to itself.

If you don't have a local dns server and don't want to set up one, just replace the hostname by the ip address of the virtual machine. This will also speed up apache on start up, as it does not need to resolve dns names.

So your virtual host should somehow look like this

<VirtualHost *:80>
    ServerName file.example.com
    redirect permanent / https://file.example.com/
</VirtualHost>

<VirtualHost *:443>
   ServerName file.example.com
   SSLEngine On
   SSLCertificateFile /home/js/Seafile/file_ws_ee.crt
   SSLCertificateKeyFile /home/js/Seafile/file.example.com.key
   SSLCertificateChainFile /home/js/Seafile/GeoTrustDVSSLCAG4.cer
   SSLProxyEngine On
   ProxyPreserveHost on
   ProxyRequests off
   ProxyPass / http://192.168.1.78/
   ProxyPassReverse / http://192.168.1.78/
</VirtualHost>

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.