Reverse proxy redirect traffic ssl “ex: openvpn”

With netscaler, I can redirect all traffic SSL to specific host which depending their subdomains.

Example:

                                             +-------------+
+-------> |webserver 443|
|         +-------------+
+----------+        +--------------+       www.example.com:443
| internet | +----> | reverseproxy |
+----------+        +--------------+
|         +-----------+
+-------> |openvpn 443|
+-----------+
vpn.example.com:443


The traffic is just redirected and it not unencrypted because we have not configure any certificate on Netscaler. We have just one certificate "wildcard" for the reverse proxy.

I want to say that I have not configured NetScaler. So, it is possible I'm wrong on the configuration.

Question:

1. I would to know if it is possible to do the same with an opensource software like Nginx or Squid?
2. How does it work this configuration?
• Your question isn't particularly clear. What traffic are you redirecting to where, and why? Context is important if you want an answer. In general nginx is quite flexible with regards to being a reverse proxy, but I don't understand what you're trying to achieve so I can't say if it'll work for you. – Tim Jan 21 '16 at 22:54
• Well, the context is I want to share the port 443 for multiples applications with only ip address public. So, for example, I have two servers that are behind a proxy and each of them host one application which run on the port 443. The proxy redirect the traffic from subdomain to good server. vpn.example.com -> 10.100.1.5 example.com -> 10.100.1.6 but the domains resolve the same IP address public which is the proxy/firewall – Body Jan 22 '16 at 9:45

This is fairly trivial to do on nginx. Define a server for the domain (or each domain), set up locations that tell it what maps to where, and use a proxy_pass to pass the request through to the correct back end server. I believe this is exactly what nginx is designed for.

In this case since one is on a subdomain you define two servers and probably only one location per server, one that passes everything through. If you want to serve static resources directly from nginx you can, which may be slightly faster, but could be more effort.

Read up on Nginx as a reverse proxy.

You could do also this with haproxy. Example config snippet:

 use_backend server1 if { ssl_fc_sni_reg ^domain1\.com\$ } 

This would proxy traffic to server1 if during the SSL handshake the client used SNI to indicate it was expecting to talk to domain1.com.