Score:0

nginx 4xx when proxying pubblic websites

in flag

Goal: I wish to build a simple reverse proxy with nginx that can takes any public domain as an input and outputs the same website just fully proxied, similar to this website.

Problem: Most websites will return a forbidden or some other 4xx or 5xx error. I currently suspect it has something to do with the headers, specially the host header. I noticed that removing it, causes a 301 to the original website.

The road so far, aka my full conf

site.conf

    server {
    listen                  443 ssl http2;
    listen                  [::]:443 ssl http2;
    server_name             mydomain.com;
    root                    /var/www/mydomain.com/public;

    # SSL
    ssl_certificate         /etc/letsencrypt/live/mydomain.com/fullchain.pem;
    ssl_certificate_key     /etc/letsencrypt/live/mydomain.com/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/mydomain.com/chain.pem;

    # security
    include                 nginxconfig.io/security.conf;

    # index.php
    index                   index.php;

    # reverse proxy
    location / {
        proxy_pass https://somedomain.com:443;
        include    nginxconfig.io/proxy.conf;
    }

    # additional config
    include nginxconfig.io/general.conf;
}

security.conf

# security headers
add_header X-XSS-Protection          "1; mode=block" always;
add_header X-Content-Type-Options    "nosniff" always;
add_header Referrer-Policy           "no-referrer-when-downgrade" always;
add_header Content-Security-Policy   "default-src 'self' http: https: data: blob: 'unsafe-inline'; frame-ancestors 'self';" always;
add_header Permissions-Policy        "interest-cohort=()" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

# . files
location ~ /\.(?!well-known) {
    deny all;
}

proxy.conf

proxy_http_version                 1.1;
proxy_cache_bypass                 $http_upgrade;
proxy_ssl_server_name              on;

# Proxy headers
proxy_set_header Upgrade           $http_upgrade;
proxy_set_header Connection        $connection_upgrade;
proxy_set_header Host              $host;
proxy_set_header X-Real-IP         $remote_addr;
proxy_set_header Forwarded         $proxy_add_forwarded;
proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Host  $host;
proxy_set_header X-Forwarded-Port  $server_port;

# Proxy timeouts
proxy_connect_timeout              60s;
proxy_send_timeout                 60s;
proxy_read_timeout                 60s;

and finally nginx.conf

# favicon.ico
location = /favicon.ico {
    log_not_found off;
    access_log    off;
}

# robots.txt
location = /robots.txt {
    log_not_found off;
    access_log    off;
}

# assets, media
location ~* \.(?:css(\.map)?|js(\.map)?|jpe?g|png|gif|ico|cur|heic|webp|tiff?|mp3|m4a|aac|ogg|midi?|wav|mp4|mov|webm|mpe?g|avi|ogv|flv|wmv)$ {
    expires    7d;
    access_log off;
}

# svg, fonts
location ~* \.(?:svgz?|ttf|ttc|otf|eot|woff2?)$ {
    add_header Access-Control-Allow-Origin "*";
    expires    7d;
    access_log off;
}

# gzip
gzip            on;
gzip_vary       on;
gzip_proxied    any;
gzip_comp_level 6;
gzip_types      text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;

As you can see the configuration is generated by nginxconfig.io and seems pretty legit. Any ideas about what may be wrong?

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.