nginx reverse proxy only redirecting when a port is specified

[natepichler]

Hi all,

I have configured nginx in a jail with all the proper certificates and configuration files. Ngnix redirects all http requests to https.

The issue I'm having is that I can only seem to redirect to urls that have ports specified.

For example, in my vdomain config file, proxy_pass http://192.168.0.100; will not redirect to my apps web ui from outside my network. However, on my local network, http://192.168.0.100 redirects properly. For another app though, proxy_pass http://192.168.0.200:8081; will redirect properly to that web ui. Both of the config files are identical other than the proxy_pass IP.

Let's say my truenas machine IP is 192.168.0.50. Nginx wont redirect to the web ui with that address, but if I change the https port for the web interface from 443 to something else like 9000 and change the config file to proxy_pass http://192.168.0.50:9000;, it redirects to the web ui.

Any insight on this? I want to make sure I'm accessing my jails in a secure way.

Thanks :)

TrueNAS Version: 12.0-U8
Reverse Proxy: 12.3-RELEASE-p2

 

[sretalla]

Any insight on this?

When you don't specify a port, can you try specifying the port for that protocol? (in your case, that would be http=80)

Like this:
proxy_pass http://192.168.0.100:80;

 

[natepichler]

When you don't specify a port, can you try specifying the port for that protocol? (in your case, that would be http=80)

Like this:
proxy_pass http://192.168.0.100:80;

Using port 443, i get a redirect error in the browser.

Port 80 breaks access to everything behind the reverse proxy

 

[natepichler]

I was able to get it to work by using proxy_pass https://192.168.0.100;.

For some reason, the HTTPS works for the addresses without ports, and HTTP works for those with ports.

 

[sretalla]

For some reason, the HTTPS works for the addresses without ports, and HTTP works for those with ports.

Evidently the services you're talking about have internal redirects from port 80 to 443, which the reverse proxy won't follow, so that explains it.

You could probably run those services in non-SSL mode internally and only have SSL done by the reverse proxy if you're not worried about the security of your internal network... entirely your choice.