Redirect in nginx port not showing up

Question

I have the following configuration. I'm trying to redirect the http traffic to port 8443.

I'm running gogs on different ports and am using some tricks to get to it.

Now our main portal is guarded by IIS 7.5 which I cannot change because of some office applications that need to stay available.

I installed the ARR/3.0 module and have a proxy pass in IIS for my application on my subdomain.

port 8080 and 8443 lead to my nginx server. port 80 and 443 lead to the IIS server and these I cannot change due to applications that need to load from the IIS server.

The only problem is, when I try to access my domain via port 80(the IIS port), the redirect rule from nginx gets stripped of port numbers and protocol change. I suspect IIS doing this, because when I access via 8080 it redirects to HTTPS properly as it should.

General
Request URL: http://subdomain.example.com/
Request Method: GET
Status Code: 302 Moved Temporarily
Remote Address: 82.161.204.120:80
Referrer Policy: no-referrer-when-downgrade
Response Headers
Content-Length: 170
Content-Type: text/html
Date: Mon, 20 Aug 2018 12:22:28 GMT
Location: http://subdomain.example.com/
Server: Microsoft-IIS/7.5
X-Powered-By: ARR/3.0
X-Powered-By: ASP.NET
Request Headers
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: nl-NL,nl;q=0.9,en-US;q=0.8,en;q=0.7,de;q=0.6
Cache-Control: no-cache
Connection: keep-alive
Cookie: _ga=GA1.2.1536444328.1523437334; lang=nl-NL; i_like_gogits=9a86afa5ec7597c8; _csrf=P9KjWDXD-yzc5aRkXRto54cExJ46MTUzNDc1NjUwOTYyODU1NjQzMQ%3D%3D; redirect_to=%252Ffavicon.ico
Host: subdomain.example.com
Pragma: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/68.0.3440.106 Safari/537.36

My IIS 7.5 config

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>      
        <rewrite>
            <rules>
                <rule name="ReverseProxyInboundRule1" stopProcessing="true">
                    <match url="(.*)" />
                    <action type="Rewrite" url="http://192.168.0.37/{R:1}" />
                </rule>
            </rules>
        </rewrite>
    </system.webServer>
</configuration>

My nginx config. I tried several settings I found in answers around stack overflow, but IIS keeps rewriting it to http://subdomain.example.com without https instead of the desired https://subdomain.example.com:8443

server {
   listen 443 ssl;
   listen [::]:443 ssl;
   listen 8443 ssl;
   listen [::]:8443 ssl;

   server_name subdomain.example.com;
    ssl_certificate /etc/letsencrypt/live/subdomain.example.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/subdomain.example.com/privkey.pem; # managed by Certbot
   proxy_set_header X-Forwarded-Proto $scheme;

   location /.well-known {
       proxy_set_header X-Forwarded-Proto $scheme;
       alias /var/www/repo.exit-reizen.nl/.well-known;
   }
   location / {
      proxy_set_header Host $http_host;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_pass http://localhost:6000;
   }
   client_max_body_size 50M;

}
server {
   listen 80;
   listen [::]:80;
   listen 8080;
   listen [::]:8080;
   port_in_redirect on;
   server_name subdomain.example.com;
   proxy_set_header X-Forwarded-Proto $scheme;
   proxy_set_header Host $http_host;
   location /.well-known {
       proxy_set_header X-Forwarded-Proto $scheme;
       alias /var/www/subdomain.example.com/.well-known;
   }
   return 302 https://subdomain.example.com:8443$request_uri;
}

Is there a way to set up IIS to accept all redirect parameters as nginx pushes them without rewriting them itself to what it thinks is good?

Answer 1

I solved my immedeate issue by using a traditonal redirect rule and excluding the .well-known for for certbot.

With this anything that's not in the .well-known will be redirected to https, which works, but it would be nicer still to have IIS obeying without question or modification the things nginx throws back.

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>

        <rewrite>
            <rules>
                <rule name="ReverseProxyInboundRule1" patternSyntax="Wildcard" stopProcessing="true">
                    <match url=".well-known*" />
                    <action type="Rewrite" url="http://192.168.0.37/{R:0}" />
                </rule>
                <rule name="redirect to https" patternSyntax="Wildcard" stopProcessing="true">
                    <match url="*" />
                    <conditions logicalGrouping="MatchAny">
                        <add input="{URL}" negate="true" pattern="*.well-known*" />
                        <add input="{HTTPS}" pattern="off" />
                    </conditions>
                    <action type="Redirect" url="https://{HTTP_HOST}:8443{REQUEST_URI}" redirectType="Found" />
                </rule>

            </rules>
        </rewrite>
    </system.webServer>
</configuration>