0

Here's my problem. I have 3 physical servers behind the same IP address, using a reverse nginx proxy (running on a fast pfsense box) to direct the http/https traffic (2 of the servers host > 1 site). I have set up all my encryption keys on nginx, with simple unencrypted traffic on the LAN. All incoming port 80 traffic has been redirected with a NAT rule to port 9999, while all incoming port 443 traffic has been redirected to port 444. All of my sites work well, including both http and https connections... except site3. My DNS has been set to redirect all 'site3.com' traffic to 'www.site3.com', and to redirect all http to https bound for site3. The proxy is supposed to redirect to 10.0.0.98:80, but it keeps redirecting to 10.0.0.99:80. Even typing in https://www.site3.com redirects me on http://site4.com. There are no .htaccess rules on site3, which is the only site on 10.0.0.98. SSL has been disabled on 10.0.0.98, as it has on all my upstream servers. Here is my simplified nginx.conf file. Thanks.

    server {
                listen 9999;
                listen 444 ssl;
                server_name www.site3.com;

                ssl_certificate      /etc/nginx/ssl/site3.com/server-nginx.crt;
                ssl_certificate_key  /etc/nginx/ssl/site3.com/nophrase.key;

                location / {
                        proxy_set_header X-Real-IP $remote_addr;
                        proxy_set_header X-Forwarded-Host $server_name;
                        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                        proxy_set_header X-Forwarded-Proto $scheme;
                        proxy_set_header X-Real-IP $remote_addr;
                        proxy_set_header Host $host;
                        proxy_pass http://10.0.0.98:80;
                        }
        }
        server {
                listen 9999;
                server_name www.site2.com;

                location / {
                        proxy_set_header X-Real-IP $remote_addr;
                        proxy_set_header Host $host;
                        proxy_pass http://10.0.0.99:80;
                }
        }
        server {
                listen 9999;
                server_name site4.com;

                location / {
                        proxy_set_header X-Real-IP $remote_addr;
                        proxy_set_header Host $host;
                        proxy_pass http://10.0.0.99:80;
                }
        }
        server {
                listen 9999;
                server_name blog.site4.com;

                location / {
                        proxy_set_header X-Real-IP $remote_addr;
                        proxy_set_header Host $host;
                        proxy_pass http://10.0.0.99:80;
                }
        }
        server {
            listen 444 ssl;
            listen 9999;
            server_name www.ultrasoundoftheweek.com;

            ssl_certificate      /etc/nginx/ssl/ultrasoundoftheweek.com/server-nginx.crt;
            ssl_certificate_key  /etc/nginx/ssl/ultrasoundoftheweek.com/nophrase.key;

            location / {
                    proxy_set_header X-Real-IP $remote_addr;
                    proxy_set_header Host $host;
                    proxy_pass http://10.0.0.99:80;
            }
    }

Here's the reverse proxy nginx log when trying to access site3:

108.162.237.66 - - [24/Aug/2016:15:54:21 -0400] "GET / HTTP/1.1" 301 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7"
10.0.1.5 - - [24/Aug/2016:15:54:21 -0400] "GET / HTTP/1.1" 200 9513 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7"
10.0.1.5 - - [24/Aug/2016:15:54:22 -0400] "GET /?action=display_custom_css_code HTTP/1.1" 200 216 "http://site4.com/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7"

The nginx log running on the site3 server was empty. No errors thrown on either nginx log.

If I run curl -v "https://www.site3.com" here's the output.

* Rebuilt URL to: https://www.site3.com/
*   Trying 104.28.17.97...
* Connected to www.site3.com (104.28.17.97) port 443 (#0)
* found 173 certificates in /etc/ssl/certs/ca-certificates.crt
* found 696 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
* SSL connection using TLS1.2 / ECDHE_ECDSA_AES_128_GCM_SHA256
*    server certificate verification OK
*    server certificate status verification SKIPPED
*    common name: sni53799.cloudflaressl.com (matched)
*    server certificate expiration date OK
*    server certificate activation date OK
*    certificate public key: EC
*    certificate version: #3
*    subject: OU=Domain Control Validated,OU=PositiveSSL Multi-Domain,CN=sni53799.cloudflaressl.com
*    start date: Mon, 22 Aug 2016 00:00:00 GMT
*    expire date: Sun, 26 Feb 2017 23:59:59 GMT
*    issuer: C=GB,ST=Greater Manchester,L=Salford,O=COMODO CA Limited,CN=COMODO ECC Domain Validation Secure Server CA 2
*    compression: NULL
* ALPN, server accepted to use http/1.1
> GET / HTTP/1.1
> Host: www.site3.com
> User-Agent: curl/7.47.0
> Accept: */*
> 
< HTTP/1.1 301 Moved Permanently
< Date: Wed, 24 Aug 2016 20:09:32 GMT
< Content-Type: text/html; charset=UTF-8
< Transfer-Encoding: chunked
< Connection: keep-alive
< Set-Cookie: __cfduid=d80824d4f3a3b4e60454b09f99c8d75fc1472069372; expires=Thu, 24-Aug-17 20:09:32 GMT; path=/; domain=.site3.com; HttpOnly
< Location: http://site4.com/
< Server: cloudflare-nginx
< CF-RAY: 2d7971497bd337c8-ATL

verbose error log from proxy sonoclipshare (site3) conf file:

016/08/24 16:43:26 [info] 51553#0: *329 client sent invalid method while reading client request line, client: 180.97.106.162, server: sonoclipshare.com, request: "^D^A^@P\xb4\xa3qR^@"
2016/08/24 17:00:13 [info] 51553#0: *551 client closed connection while waiting for request, client: 67.11.47.233, server: 0.0.0.0:444
  • Please post all applicable logs - Nginx and whatever you're proxying to, even if one of the logs just shows nothing hit. Suggest you also include the curl or similar you do to trigger the log entry. – Tim Aug 24 '16 at 18:36
  • The 301 code is saying there's a permanent redirect being issued to another website, site4.com (which I assume you edited manually). A browser should then make another request to that site. Suggest you follow this up. If you want further help you need to stop obfuscation of your domains. – Tim Aug 24 '16 at 20:48
  • I see that, but I'm unaware of any permanent redirect issued. The site being redirected (site3) is sonoclipshare.com and is being redirected to 5minsono.com . I added a line to my site3 server block error_log /var/log/scc.com.error.log debug;, will post the log above - picked up 2 errors. – user255406 Aug 24 '16 at 21:21
0

When I click on the link to http://5minsono.com/ I see the second website appear http://5minsono.com/. I think this is your issue.

The 301 redirect is being issued by whatever the proxy_pass for site3.com is pointing at, on http://10.0.0.98:80. You need to look into whatever that application is to work out why it's issuing a redirect. Nginx is just passing it through. You haven't provided any information on what's behind the proxy, or it's logs, as far as I can see, so no further help is possible with the information provided.

  • behind the proxy on 10.0.0.98:80 is a web server running nginx and php (LEMP stack) listening on port 80 with a simple hand written php index page. On the lan if I type 10.0.0.98 I get the page without redirects. When I visit sonoclipshare.com, nothing gets logged on the 10.0.0.98 server - in either the access or error logs. – user255406 Aug 24 '16 at 22:04
  • The log above "108.162.237.66 - - [24/Aug/2016:15:54:21 -0400] "GET / HTTP/1.1" 301 0" shows that a 301 is being returned. You'll have to do some problem solving to work out why it's working when you do it manually and not through Nginx. I might start by simplifying the block with proxy_pass in it, adding the lines back only as required and if they cause no harm. – Tim Aug 24 '16 at 22:18
  • That's a decent approach. Thanks for the advice. I'm used to debugging code, not servers. Obfuscate is one of my fav words BTW... – user255406 Aug 24 '16 at 22:21
  • removed all the extra lines, simplified it down to minimum config, sans SSL. Started working! My mistake, I failed to mention that cloudflare is the DNS host/proxy, so I made sure that all traffic was encrypted with cloudflare. Redirected all traffic to https and then re-enabled a minimal SSL config. Works. Guess I just threw too much in that config at the start. Need to start adding some stuff back (looks like all traffic is from my proxy at 10.0.0.1), but I have a working solution. Thanks for helping me work through it, @Tim. – user255406 Aug 25 '16 at 0:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.