0

Scenario

I have a DDNS subdomain sub1.dom1.com with static IP of (fictional IP) 99.88.77.66.55.

I have a domain, dom2.com hosted off-site with a DNS CNAME entry pointing sub2.dom2.com and sub3.dom2.com to the same IP (again, fictional), 99.88.77.66.55.

At 99.88.77.66.55, I have a LAN sitting behind my firewall. On this LAN, I have three servers:

  1. A web server with local FQDN of www.local.lan at 192.168.1.3:80
  2. An application server with local FDQN of app.local.lan at 192.168.1.4:8069
  3. A file server with local FQDN of fs.local.lan at 192.168.1.5:2430

See the diagram below for clarification. All three servers are running as virtual servers within jails on the same freeBSD (freeNAS) system.

Network Diagram

What I Want to Accomplist

As per the above diagram, I want to add a reverse proxy server to run within a jail on the above-mentioned system. Requests from the WAN need to be directed to the appropriate server based on the name of the host supplied in the HTTP header.

Considerations

  1. Standard Port Fordwarding: Currently, I access these servers through simple port-forwarding on the LAN Router. This is usually an acceptable solution, however, when the need arises to trouble the network remotely, it becomes a challenge keeping straight WAN-to-LAN port relationships. Also, for users other than myself, who need to access these servers, it is easier for them not to have to remember port numbers.
  2. DD-WRT Application: Since my router is running DD-WRT firmware with a 4 GiB USB drive mounted, I looked into installing and running a reverse proxy server on the router, using Pound or something similar. I have done extensive web searching looking for ways to this. The problem I encounter is that most of the guides or tutorials are old and contain broken links to the resources required.
  3. Apache/Nginx: Either of these two seem like a viable solution. However, like the DD-WRT solutions I researched, many of the guides either provide broken links or no links at all to the required resources. The other hurdle before me with either the Apache or Nginx options is that most of the guides and tutorials assume I already know everything there is to know about Apache or Nginx. I am starting out with no prior experience with either platform, and am willing to learn, and experiment to get things to work. The guides and tutorials mostly only show the server sections of the required code. Also, assumptions are made that you already know the dependencies required, and how to implement them.

Steps I've Already Taken

Nginx: Sample from my nginx.conf file. It is only a portion. There are other server sections for the other servers with the pertinent details changed.

#nginx.conf

events {
  worker_connections 1024;
}

http {
  server {
    listen 80;
    server_name sub1.dom1.com #I've also tried www.lan.lan, here.
    access_log off;
    error_log off;
    location / {
      proxy_pass http://192.168.1.3:80/;
      proxy_redirect off;
      proxy_set_header Host $host;
      proxy_set_header X-Real-IP $remote_addr;
      proxy_set_header X-Forwarded-For $proxy_ass_x_forwarded_for;
      proxy_max_temp_file_size 0;
      client_max_body_size 10m;
      client_body_buffer_size 128k;
      proxy_connect_timeout 90;
      proxy_send_timeout 90;
      proxy_ready_timeout 90;
      proxy_buffer_size 4k;
      proxy_buffers 4 32k;
      proxy_busy_buffers_size 64k;
      proxy_temp_file_write_size 64k;
    }
  }
}

This, however; returns a 502 - Bad Gateway error when trying to connect.

Apache: Important to note that I was trying this with Apache22. My latest httpd.conf file looks like this:

LoadFile /usr/local/bin/libxml2.so
LoadModule proxy_html_module libexec/apache22/mod_proxy_html.so
LoadModule xml2enc_module libexec/apache22/mod_xl2enc.so

<VirtualHost *:80>
  ServerName sub1.dom1.com
  ServerAlias sub1.dom.com
  ProxyPass / http://192.168.1.3:80/
  ProxyPassReverse / http://192.168.1.3:80
</VirtualHost>

<VirtualHost *:80>
  ServerName sub2.dom2.com
  ServerAlias sub2.dom2.com
  ProxyPass / http://192.168.1.4:8069/
  ProxyPassReverse / http://192.168.1.4:8069
</VirtualHost>

<VirtualHost *:80>
  ServerName sub3.dom2.com
  ServerAlias sub3.dom2.com
  ProxyPass / http://192.168.1.5:2430/
  ProxyPass / http://192.168.1.5:2430
</VirtualHost

When I try to start Apache22, using:

service apache22 start

I get the following:

Invalid command 'ProxyPass', perhaps misspelled or defined by a module not included in the server configuration

After much research, I know this is more than likely caused by the fact that I only one of many of the required mod_proxy modules loaded, the mod_proxy_html module. The reason is that after extensive searching, I could only find a working link for this specific module.

Pound: I ran into problems when trying to install ipkg on DD-WRT. This might be due to the atheos architecture of my particular router. I also ran into many broken links as previously mentioned.

How You Can Help

Ok, so with the long-winded explanation out of the way, here is what I'm looking for from the community.

Given that I've gotten closest using Nginx, how can I properly setup my nginx.conf file to do what I am attempting to do? What is causing the 502 error, and how do I fix it?

0

For the nginx solution:

server_name should always be the hostname requested (in the http header).

  • You could put a * here to make the content available on any domain/host.

proxy_pass should not end with a /, except especially needed.

I've seen 502 Bad gateway most commonly when nginx can't connect to the upsteam (proxy_pass).

  • Did you check your firewall policy for DMZ->LAN?
  • Did you check the error.log for hints?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.