Multi service with different ports how configure nginx proxy

I have the following structure:

public ip <-> vm host <-> vms

There are two vms: vm1_proxy_nginx vm2_service_docker_vm (using ports 9000-9005)

Service_VM is a dashboard server working on exposed ports 9001,9002 and 9005 for authentification, login, and data logging communication between the users and the vm.

Now I redirected in nginx reverse proxy http and https to /9001 for login.

Then I found out that this configuration leads to problems because the communication back is not given (after successfull login, server redirect to 9002 dashboard service)

https://ip.ip.ip.io:9002/?token=

Does someone have an idea how to handles this problem without losting security and ssl problems?

I know the reimplement the service not to use exposed ports like this, but I need meanwhile a solution....

The easiest way to solve this is to preserve all the standard ports and just create 2 server blocks in your configuration, one for every port, acting as reverse proxies forwarding all traffic to the target port. For example:

server {
        listen 9001 ssl http2;
        ssl_certificate         *path-to-certificate*;
        ssl_certificate_key     *patch-to-private-key;
        server_name xyz.yourdomain.com;

              proxy_set_header Host $host;
              proxy_set_header X-Real-IP $remote_addr;
              proxy_pass      http://*ipofupstreamserver*:9001;
}

server {
        listen 9002 ssl http2;
        ssl_certificate         *path-to-certificate*;
        ssl_certificate_key     *patch-to-private-key;
        server_name xyz.yourdomain.com;

              proxy_set_header Host $host;
              proxy_set_header X-Real-IP $remote_addr;
              proxy_pass      http://*ipofupstreamserver*:9002;
}

server {
        listen 9005 ssl http2;
        ssl_certificate         *path-to-certificate*;
        ssl_certificate_key     *patch-to-private-key;
        server_name xyz.yourdomain.com;

              proxy_set_header Host $host;
              proxy_set_header X-Real-IP $remote_addr;
              proxy_pass      http://*ipofupstreamserver*:9005;
}

You may have to adjust to whether you want to use http or https for upstream communication of course or you could put the frontend that will present the login interface onto a standard port 443 if it should be public facing and there are tons of other options to tweak but this should get you started.