Issue with NGINX passthough TLS
-
If you are just passing through, what is the point of Nginx? Just use HA-Proxy and set to TCP mode and TLS will pass through flawlessly.
Nginx' purpose is to tear the connection apart and inspect it, breaking TLS pass through.
-
@scottalanmiller said in Issue with NGINX passthough TLS:
If you are just passing through, what is the point of Nginx? Just use HA-Proxy and set to TCP mode and TLS will pass through flawlessly.
Nginx' purpose is to tear the connection apart and inspect it, breaking TLS pass through.
I didn't know that.
-
@dashrender said in Issue with NGINX passthough TLS:
@scottalanmiller said in Issue with NGINX passthough TLS:
If you are just passing through, what is the point of Nginx? Just use HA-Proxy and set to TCP mode and TLS will pass through flawlessly.
Nginx' purpose is to tear the connection apart and inspect it, breaking TLS pass through.
I didn't know that.
At its core, Nginx is a web server. If you do TCP pass through, you are bypassing the core functionality.
Nginx has TCP pass through capability, so you CAN do this. But it is really intended to be a piece of a bigger picture. WHereas with HA-Proxy, this is its bread and butter and is way simpler.
https://fedingo.com/how-to-configure-ssl-tls-passthrough-in-nginx/
-
@scottalanmiller
Thanks for the reply, correct i was using before HAproxy on pfSense to do the TLS passthough but moving to NGINX as this server is later on going to manage all the SSL but because i need to migrate exactly the same way i have it currently as HAproxybut i have configured to pass though but not passing the real IP
-
@killmasta93 said in Issue with NGINX passthough TLS:
@scottalanmiller
Thanks for the reply, correct i was using before HAproxy on pfSense to do the TLS passthough but moving to NGINX as this server is later on going to manage all the SSL but because i need to migrate exactly the same way i have it currently as HAproxybut i have configured to pass though but not passing the real IP
If you have to mix workloads on a single IP/Port combo, then yeah, Nginx would be the way to go. HA-Proxy can do it, too, but Nginx is more robust for the other workloads.
-
@scottalanmiller
so in my case how would i solve this issue so the backend can see the real IP? -
@killmasta93 said in Issue with NGINX passthough TLS:
@scottalanmiller
so in my case how would i solve this issue so the backend can see the real IP?Backend can't see the real IP because the request comes from IP of the proxy.
But the proxy can put the IP address of the client (originating) into the http headers. For example using the
Forwardedheader. Look atproxy_set_headeron nginx.The backend must then have support for looking at the http headers to determine the actual originating IP address.
But if you passthrough TLS then I don't believe you can insert any headers and it's not possible to see the originating IP from the headers. But why does the backend need to see the originating IP?
-
@pete-s
correct, whats odd is that it works perfectly fine on HA proxy on pfSense its just that i want to move better to a virtual machine and not depend on pfSense
Im not sure howcome it works on HA proxy and not on NGINX -
@killmasta93 said in Issue with NGINX passthough TLS:
@pete-s
correct, whats odd is that it works perfectly fine on HA proxy on pfSense its just that i want to move better to a virtual machine and not depend on pfSense
Im not sure howcome it works on HA proxy and not on NGINXI don't know but why not install HAproxy instead of nginx in your VM?
You could access pfsense over ssh and look at the HAproxy config files directly for inspiration.BTW, it's quite possible that haproxy uses the tcp session just as a router would. Not looking at it as a series of http requests but as a series of packets. That means the backend will get the IP.
Since haproxy is a load balancer it makes sense that it can work on the router layer (L4) while nginx works at the application layer (L7).
-
@pete-s yeah i guess im going to have to do that, it just bugs me that NGINX wont pass though the real IP
