Hot answers tagged

4

The reason here is that when you make the request to IP address, TLS Server Name Indication field contains the IP address of the host, not the domain. The server you are connecting has different virtual hosts defined for IP address and different domain names. The virtual host defined for the IP address does not provide the service you are looking for. In ...


3

I did some investigation on this subject. I think I found some valuable info on GitHub discussion in Yichun Zhang (author of OpenResty nginx fork) reply: I'd suggest the following options: Cache both compressed and uncompressed responses, and add (a canonical-ized) value of the Accept-Encoding to your cache key. So that clients which do not expect ...


3

You are using http.proxy but trying to clone the repository with SSH. you should use the https GitLab link.


2

It is possible to direct connections based on the SNI header using the nginx ssl preread module. This depends on the client specifying an SNI header when opening the connection. In the example below, nginx listens for connections on port 443. A connection to presence.myglance.org:443 is forwarded to port 4443 (that's an http server, not shown). A ...


2

Communication with CGI scripts is done using the Common Gateway Interface. It is a sort of calling convention, where HTTP headers and the requested URL are passed through environment variables, whereas the request data are passed on stdin. This is a local communication as the web server must run the CGI script as a process on the same machine. FastCGI is a ...


2

Services that offer dedicated IPs have exactly that: Dedicated IPs that is in use by only 1 customer. Your solutions don't offer dedicated IPs. You can proxy and tunnel all you want, but if the end result is that the email is going through your dedicated box with a single dedicated IP, the IP is no longer dedicated. (I assume your email project is multi-...


2

The way you chose the random values, the probability to select each IP address follows a geometric distribution. If you want to choose them uniformly, the probability of selecting an IP address (knowing the previous ones were discarded) must be 1/9 for the second, 1/8 for the third and so on: acl random1 random 1/10 acl random2 random 1/9 acl random3 random ...


2

I got same error but it was because of DISPLAY environment variable set to some value. Once you unset that environment variable, the error went away.


2

If you want to set the Terrafrom proxy with password setting, create the following environment variables in windows HTTP_PROXY=http://<username>:<password>@<proxy>:<port> HTTPS_PROXY=http://<username>:<password>@<proxy>:<port> Note: HTTPS_PROXY (HTTPS_PROXY=http://username:password@proxy:port)also set the ...


2

If you are using Apache on foo.com, you can use mod_proxy to set up a reverse proxy to reroute /blog to another server: ProxyPass "/blog" "http://backend.foo.com/blog" ProxyPassReverse "/blog" "http://backend.foo.com/blog" Be careful to make sure you do not enable the forward proxy (ProxyRequests should be off) at the same time, because then the server can ...


2

The Classic ELB doesn't support Websockets. Why it doesn't is not something AWS publishes. From the chart in the reference below it specifically calls out, as you pointed out, that the ALB and NLB support Websockets. Why the Classic does not support them is not disclosed. Bottom line, if you want to use an ELB with Websockets use an ALB or ELB ...


2

As per siproxd FAQ ( http://siproxd.sourceforge.net/index.php?op=faq ) ensure that PC-Linux host has packet forwarding enabled ant that iptables is doing masquerading between the two nets. If PC-Linux host is not PC-Windows default gateway, you would also need to setup static routes to be able to reach the Asterisk network.


2

I don't know if there is a perfect match for this scenario, however as a more general note I think it seems clear that this is a 400-series error rather than a 500-series error. 4xx are errors where the server for whatever reason considers the request invalid. (Ie, the client did something wrong) 5xx are errors where the server had no complaint about the ...


2

you would have to create MYCHAIN before, hint: try TPROXY target (in PREROUTING / mangle ). ( only valid in the mangle table, in the PREROUTING chain and user-defined chains which are only called from this chain) . they have a good example : iptables -t mangle -A PREROUTING -p tcp --dport 80 -j TPROXY --tproxy-mark 0x1/0x1 --on-port 50080 from the ...


2

This automated config by Certbot isn't very suitable for your needs. Change HTTP to HTTPS redirection block to this one: server { listen 80; listen [::]:80; server .domain.com; return 301 https://$http_host$request_uri; } Make the following changes to your HTTPS block: use server .domain.com; instead of server domain.com; (this ...


2

HTTP headers are part of the actual request payload, therefore when HTTP is run over TLS (https), the payload is encrypted. If you want to intercept https traffic, you need to install your own certificate on the proxy and browser system. This way the proxy can act as a man-in-the middle entity, seeing all the encrypted traffic between browser and server.


1

You can try to change proxy_pass http://0.0.0.0:5000/; into proxy_pass http://0.0.0.0:5000;. nginx will pass $request_uri to your reverse proxy. http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass


1

Yes. You can always have a "legal man in the middle" (a.k.a. proxy). If the tool that you are using doesn't give you the ability to enter both, a proxy and a destination, then the easiest is indeed to install a server on a computer which has Internet access to the 3rd party and redirect HTTP requests as required. You do not say which server(s) you're using....


1

Using HAProxy, You may specify different ciphers for bind and servers at the global section, which could look like this: global # modern bind configuration, Only TLS1.3 enabled. ssl-default-bind-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256 ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11 no-tlsv12 ...


1

In my case the Bastion/Jumpbox host was not able to resolve the Hostname (I used hostnames and not IP), so in my case that was a bad DNS entry in my DNS setup, so just make sure the Bastion host can resolve to the same name you are using in your ssh config file.


1

Okay, I figured it out. Actually the problem is Chrome and Firefox are caching 301 - permanent redirects indefinitely. Clearing those caches solved it. My apache settings and configs where okay. At some point localhost had pointed somewhere else, but that is gone now.


1

Theoretically, you can, but not without a lot of effort. Supposedly, you are running an HTTP/2 capable website. Detecting proxy_pass to your website can build upon the fact that these connections will always originate over HTTP/1.x and never via HTTP/2. Then you can match that up with browser capabilities. So, essentially, if you see an HTTP/2 capable ...


1

Solved it myself ... rolleyes Environment="no_proxy="localhost,127.0.0.1,::1,*.domain.name" is not properly escaped


1

Your problem sums up to rewriting the absolute request URIs, which come from the application server. This can be done twofold: Apache2 can rewrite all URIs in the proxied content. It is rather difficult to catch all locations where an URI can occur. Tomcat7 can use the same absolute request URIs as the Apache server. I would suggest the second way, since ...


1

If the API host has changed, its likely that the owner has implemented a newer SSL configuration which is now longer compatible with your Charles proxy. I would suspect SNI support may be the issue here. A lot of people rely on SNI now to allow them use multiple SSL certificates on the same infrastructure, but that means support for non-SNI implementations ...


1

It seems that your ISP is blocking the Squid HTTPS CONNECT tunnel. See https://superuser.com/a/529061/936854 I found a solution for CentOS 7 but unfortunately you will have to leave Squid and use 3proxy because it uses alternatives of the CONNECT tunnel. The solution is: Step 1: Install the following (the most important step because Development Tools ...


1

You are confusing technologies. You can't use iptables for tunnelling. Tunneling implies encapsulating a packet inside another - iptablea does not do this. What IPtables can do is manipulate and track the source and/or destination addresses of packets which may or may not do what you want - depending on protocol and exact gaming server requirements. You ...


1

If your host doesn't support GRE tunneling, then just use vxlan, which runs over UDP. Or set up a point-to-point VPN using e.g. openvpn between the two hosts.


1

You have hard coded a permanent (cached indefinitely by browsers) redirect for not only the example.com domain name but, since there are no other other servers defined for plain http on port 80, every (sub-) domain and all HTTP requests gets redirected to https://example.com you probably want something like server { listen 80 default_server; ...


1

weight=1 is default configuration, so specifying it explicitly, or removing and having it implicitly won't make any difference. Overall you config looks correct. Try removing the working server from upstream list and leaving just one which doesn't work. I suspect it won't work at all because of routing or firewall issues.


Only top voted, non community-wiki answers of a minimum length are eligible