Score:0

How to do IP canonicalization with Nginx and Certbot

cn flag

I have multiple services running on my server which will be accessed via nginx and encrypted by certbot. If i want to acess my service with my http://example.com, I get redirected to http(s)://example.com, which is great.

However, if I type in my IpAdress:Port I wont get redirected to my domain. This is my abc.com file in /etc/nginx/sites-enabled

server {
server_name abc.com; #example: mysite.xyz
#access_log /var/log/nginx/<servicename>.access.log;
#error_log /var/log/nginx/<servicename>.error.log;

location / {
        proxy_pass http://127.0.0.1:9000; # here you define the address, which is used by nginx to access your service
        proxy_http_version  1.1;
        proxy_cache_bypass  $http_upgrade;
        proxy_set_header Upgrade           $http_upgrade;
        proxy_set_header Connection        "upgrade";
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host  $host;
        proxy_set_header X-Forwarded-Port  $server_port;
} # this is the port you use to access the proxied service

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/abc.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/abc.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}
server {
    if ($host = abc.com) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

server_name abc.com;

listen 80;
    return 404; # managed by Certbot

}

Can someone tell me or point me into a direction what I need to change in my abc.com file in order to redirect also requests via IpAdress:Port to https://example.com

I am grateful for any help!

Edit: I have made my services reachable via localhost which solved my problem. Thank you all for your contributions!

Michael Hampton avatar
cz flag
Don't try to do this. Requests to your IP address as HTTP host should be ignored, not redirected. Virtually all of them are malicious. The default configuration serves a 403 error to such requests, and this should be left in place.
sergeantSalty avatar
cn flag
Ignoring would be indeed the best option. However my default dont ignore such requests. If I type in my ip:port adress I get acess to my services. What exactly can I do to ignore such requests ? Thank you for your contribution!
Michael Hampton avatar
cz flag
Put back the default `server` block that came with the nginx distribution package.
sergeantSalty avatar
cn flag
Oh I must have understand you wrong, actually I didnt delete the default server block that came with nginx.
Score:0
sv flag

Welcome to ServerFault.

Can someone tell me or point me into a direction what I need to change in my abc.com file in order to redirect also requests via IpAdress:Port to https://example.com

You don't have to edit the existing file that may be modified by Certbot in the future.

Instead, in /etc/nginx/sites-enabled, please create another file (for example, with the name ip.conf), with the following content...

server {
    listen 80;
    server_name 127.0.0.1;
    return 301 https://example.com$request_uri;
}

In the above code, please replace 127.0.0.1 with the actual IP address of your server and then replace example.com too.

sergeantSalty avatar
cn flag
Hi and thank your for your help. I tried your approach but sadly it doesnt work. I still get directed to my unsecured service. :/
Score:0
za flag

Change one of the last lines to

listen 80 default;
sv flag
Since OP used an if statement to redirect based on host, the above solution wouldn't work for the specific use case. So, the above solution would result in 404.
sergeantSalty avatar
cn flag
Pothi is right, it doesnt work out that way, but thank you anyway.
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.