Is it possible to configure Nginx to accept requests both with and without proxy protocol to the same URL?












1















I have a set of applications behind a proxy server which forwards request appropriately and uses the proxy protocol to preserve the request's origin data. The apps also make requests amongst each other so I want them to accept requests with and without the proxy protocol. Is it possible to configure Nginx to do this in some way without using a different server_name or port?






nginx reverse-proxy







share|improve this question



























    1















    I have a set of applications behind a proxy server which forwards request appropriately and uses the proxy protocol to preserve the request's origin data. The apps also make requests amongst each other so I want them to accept requests with and without the proxy protocol. Is it possible to configure Nginx to do this in some way without using a different server_name or port?






    nginx reverse-proxy







    share|improve this question

























      1












      1








      1








      I have a set of applications behind a proxy server which forwards request appropriately and uses the proxy protocol to preserve the request's origin data. The apps also make requests amongst each other so I want them to accept requests with and without the proxy protocol. Is it possible to configure Nginx to do this in some way without using a different server_name or port?






      nginx reverse-proxy







      share|improve this question














      I have a set of applications behind a proxy server which forwards request appropriately and uses the proxy protocol to preserve the request's origin data. The apps also make requests amongst each other so I want them to accept requests with and without the proxy protocol. Is it possible to configure Nginx to do this in some way without using a different server_name or port?






      nginx reverse-proxy




      nginx reverse-proxy






      share|improve this question













      share|improve this question











      share|improve this question




      share|improve this question










      asked 6 hours ago









      Calum HalpinCalum Halpin

      154




      154






















          1 Answer
          1






          active

          oldest

          votes


















          2














          Without using a different server block, the only way to do this is with different listen directives. This means the server running nginx must have different IP addresses for connecting to the server from the external proxy and from the internal server farm.



          For example, you might have an internal network 10.87.239.0/24 for your internal apps, and the server running nginx is on 10.87.239.3. Then you have an external network 10.87.238.0/24 which your external proxy server uses to reach nginx, and the server has address 10.87.238.3. In this case you can configure nginx as:



          server {
          
    # PROXY protocol connections
          
    listen 10.87.238.3:443 ssl http2 proxy_protocol;
          
    set_real_ip_from 10.87.238.2;  # The address(es) of the proxies
          
    real_ip_header proxy_protocol;
          

          
    # Direct connections
          
    listen 10.87.239.3:443 ssl http2;
          
    listen [::]:443 ssl http2;
          

          
    # everything else for this block
          
}


          On a related note, you should have already deployed IPv6 within your organization, even without global IPv6 connectivity. You can use that for your internal communications if you haven't got a separate internal IPv4 network.






          share|improve this answer























            Your Answer








            StackExchange.ready(function() {
            var channelOptions = {
            tags: "".split(" "),
            id: "2"
            };
            initTagRenderer("".split(" "), "".split(" "), channelOptions);

            StackExchange.using("externalEditor", function() {
            // Have to fire editor after snippets, if snippets enabled
            if (StackExchange.settings.snippets.snippetsEnabled) {
            StackExchange.using("snippets", function() {
            createEditor();
            });
            }
            else {
            createEditor();
            }
            });

            function createEditor() {
            StackExchange.prepareEditor({
            heartbeatType: 'answer',
            autoActivateHeartbeat: false,
            convertImagesToLinks: true,
            noModals: true,
            showLowRepImageUploadWarning: true,
            reputationToPostImages: 10,
            bindNavPrevention: true,
            postfix: "",
            imageUploader: {
            brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
            contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
            allowUrls: true
            },
            onDemand: true,
            discardSelector: ".discard-answer"
            ,immediatelyShowMarkdownHelp:true
            });


            }
            });














            draft saved

            draft discarded


















            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f958608%2fis-it-possible-to-configure-nginx-to-accept-requests-both-with-and-without-proxy%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown

























            1 Answer
            1






            active

            oldest

            votes








            1 Answer
            1






            active

            oldest

            votes









            active

            oldest

            votes






            active

            oldest

            votes









            2














            Without using a different server block, the only way to do this is with different listen directives. This means the server running nginx must have different IP addresses for connecting to the server from the external proxy and from the internal server farm.



            For example, you might have an internal network 10.87.239.0/24 for your internal apps, and the server running nginx is on 10.87.239.3. Then you have an external network 10.87.238.0/24 which your external proxy server uses to reach nginx, and the server has address 10.87.238.3. In this case you can configure nginx as:



            server {
            
    # PROXY protocol connections
            
    listen 10.87.238.3:443 ssl http2 proxy_protocol;
            
    set_real_ip_from 10.87.238.2;  # The address(es) of the proxies
            
    real_ip_header proxy_protocol;
            

            
    # Direct connections
            
    listen 10.87.239.3:443 ssl http2;
            
    listen [::]:443 ssl http2;
            

            
    # everything else for this block
            
}


            On a related note, you should have already deployed IPv6 within your organization, even without global IPv6 connectivity. You can use that for your internal communications if you haven't got a separate internal IPv4 network.






            share|improve this answer




























              2














              Without using a different server block, the only way to do this is with different listen directives. This means the server running nginx must have different IP addresses for connecting to the server from the external proxy and from the internal server farm.



              For example, you might have an internal network 10.87.239.0/24 for your internal apps, and the server running nginx is on 10.87.239.3. Then you have an external network 10.87.238.0/24 which your external proxy server uses to reach nginx, and the server has address 10.87.238.3. In this case you can configure nginx as:



              server {
              
    # PROXY protocol connections
              
    listen 10.87.238.3:443 ssl http2 proxy_protocol;
              
    set_real_ip_from 10.87.238.2;  # The address(es) of the proxies
              
    real_ip_header proxy_protocol;
              

              
    # Direct connections
              
    listen 10.87.239.3:443 ssl http2;
              
    listen [::]:443 ssl http2;
              

              
    # everything else for this block
              
}


              On a related note, you should have already deployed IPv6 within your organization, even without global IPv6 connectivity. You can use that for your internal communications if you haven't got a separate internal IPv4 network.






              share|improve this answer


























                2












                2








                2







                Without using a different server block, the only way to do this is with different listen directives. This means the server running nginx must have different IP addresses for connecting to the server from the external proxy and from the internal server farm.



                For example, you might have an internal network 10.87.239.0/24 for your internal apps, and the server running nginx is on 10.87.239.3. Then you have an external network 10.87.238.0/24 which your external proxy server uses to reach nginx, and the server has address 10.87.238.3. In this case you can configure nginx as:



                server {
                
    # PROXY protocol connections
                
    listen 10.87.238.3:443 ssl http2 proxy_protocol;
                
    set_real_ip_from 10.87.238.2;  # The address(es) of the proxies
                
    real_ip_header proxy_protocol;
                

                
    # Direct connections
                
    listen 10.87.239.3:443 ssl http2;
                
    listen [::]:443 ssl http2;
                

                
    # everything else for this block
                
}


                On a related note, you should have already deployed IPv6 within your organization, even without global IPv6 connectivity. You can use that for your internal communications if you haven't got a separate internal IPv4 network.






                share|improve this answer













                Without using a different server block, the only way to do this is with different listen directives. This means the server running nginx must have different IP addresses for connecting to the server from the external proxy and from the internal server farm.



                For example, you might have an internal network 10.87.239.0/24 for your internal apps, and the server running nginx is on 10.87.239.3. Then you have an external network 10.87.238.0/24 which your external proxy server uses to reach nginx, and the server has address 10.87.238.3. In this case you can configure nginx as:



                server {
                
    # PROXY protocol connections
                
    listen 10.87.238.3:443 ssl http2 proxy_protocol;
                
    set_real_ip_from 10.87.238.2;  # The address(es) of the proxies
                
    real_ip_header proxy_protocol;
                

                
    # Direct connections
                
    listen 10.87.239.3:443 ssl http2;
                
    listen [::]:443 ssl http2;
                

                
    # everything else for this block
                
}


                On a related note, you should have already deployed IPv6 within your organization, even without global IPv6 connectivity. You can use that for your internal communications if you haven't got a separate internal IPv4 network.







                share|improve this answer












                share|improve this answer



                share|improve this answer










                answered 4 hours ago









                Michael Hampton♦Michael Hampton

                172k27315642




                172k27315642






























                    draft saved

                    draft discarded




















































                    Thanks for contributing an answer to Server Fault!


                    • Please be sure to answer the question. Provide details and share your research!

                    But avoid …



                    • Asking for help, clarification, or responding to other answers.

                    • Making statements based on opinion; back them up with references or personal experience.


                    To learn more, see our tips on writing great answers.




                    draft saved


                    draft discarded














                    StackExchange.ready(
                    function () {
                    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f958608%2fis-it-possible-to-configure-nginx-to-accept-requests-both-with-and-without-proxy%23new-answer', 'question_page');
                    }
                    );

                    Post as a guest















                    Required, but never shown





















































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown

































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown







                    -

                    Popular posts from this blog

                    Olav Thon

                    Image
                    Olav Thon Fødd 29. juni 1923 Ål Yrke forretningsdrivande Olav Thon på Commons Olav Thon (fødd 29. juni 1923) er ein norsk, stort sett sjølvlært forretningsmann, fødd i Ål i Hallingdal, som har gjort store pengar på særleg kjøp, bygging og utvikling av fast eigedom, mellom anna kjøpesentre, hotell og restaurantar, i både Noreg og somme andre land. Han vart Ridder av 1. klasse av St. Olavs Orden i 2003, og er som ivrig friluftsmann æresmedlem i Den Norske Turistforening etter å ha ytt store økonomiske bidrag til foreininga sine hytter og ruter i fjellet. Han er kjend for alltid å gå med ei karakteristisk strikkelue. Olav Thon i samtale med Trond Helleland på sentralbanksjefens årstale i februar 2016 I ung alder reiste Olav Thon til Newcastle for å lære seg engelsk, og han var seinare ei tid i Sveits, der han gjorde forretningar i import og eksport. Deretter tok han til å kjøpe faste eigedomar i Noreg med stor økonomisk suksess, verksemda voks snøgt og v
                    Read more

                    Waikiki

                    Image
                    Denne artikkelen kan ha godt av ein språkvask , som reinskar opp målføringa og/eller innfører same språkstilen overalt. Denne artikkelen kan ha godt av ei opprydding for å nå ein høgare standard og/eller for å verta i tråd med standardoppsettet. Sjå korleis du redigerer ei side og stilmanualen for hjelp. Waikiki Land   USA Stat Hawaii Stad Honolulu Wikimedia Commons: Waikiki Utsyn over Waikiki Waikīkī er ein bydel i Honolulu, sør på øya Oahu, som er ei av Hawaii-øyane. Waikīkīstranda er ein av dei meste berømte strendene i verda. Waikīkī strekkjer seg langs stillehavskysten og har ei rekkje velrenommerte hotell. Bydelen er Hawaii-turismens høyborg. På Waikīkī Beach står ei statue av den lokale sportsstjerna Duka Kahanamoku. Kjelder | Denne artikkelen bygger på «Waikiki» frå Wikipedia på bokmål, den 4. november 2018. Denne artikkelen manglar kjelder eller referansar . Hjelp Wikipedia med å finna truverdige kjelder
                    Read more

                    Hudsonelva

                    Image
                    Hudson elv Land   USA Område New York Sideelvar Mohawk Lengd 507 km Middelvassføring 606 m³/s Munning Upper New York Bay i Atlanterhavet Elvene Hudson og Mohawk med nedbørsområdet markert med gult. Wikimedia Commons: Hudson River Hudsonelva ( Hudson River ) mohikansk Muh-he-kun-ne-tuk ) er ei elv i USA. Ho renn hovudsakleg gjennom delstaten New York, men markerer også ein del av grensa mellom New York og New Jersey. Hudsonelva har namn etter Henry Hudson, ein engelskmann som utforska elva i 1609. Hudsonelva sett frå Bear Mountain Bridge. Kjelda til elva er Tear-of-the-Clouds-sjøen i Adirondackfjella. Ved Albany renn Mohawk-elva saman med henne, og deretter renn ho nesten rett sørover til ho munnar ut i Atlanterhavet mellom Manhattan i New York og New Jersey. Eriekanalen, som blei opna den 26 oktober 1825, bind saman Hudsonelva og Eriesjøen, slik at byane ved Dei store sjøane fekk vasstilgang til A
                    Read more