Nginx reverse proxy server(AWS) --> nginx server for static page(homeip)

I have a nginx server which is serving static files at my home ip behind pfsense. If I hit the home IP, I see the website I'm hosting. Im trying to put this behind another nginx reverse proxy server so my home IP is not public. So I have a ec2 instance just running nginx docker with reverse proxy server.

here is my nginx.conf:

  worker_processes 1;

  events { worker_connections 1024; }

   http {

         sendfile on;

         upstream docker-nginx {
         server <homeip>;

         server {
               listen 80;

          location / {
           proxy_pass         http://docker-nginx;
           proxy_redirect     off;
           proxy_set_header   Host $host;
           proxy_set_header   X-Real-IP $remote_addr;
           proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
          proxy_set_header   X-Forwarded-Host $server_name;

and my docker file:

   FROM nginx:alpine

   COPY nginx.conf /etc/nginx/nginx.conf

Docker Run command after build: docker run -p 80:80 reverseproxy

It is very straight forward. I have http to https redirect in my home nginx server.

Now, if i hit my domain name, i get server cant be reached. If i hit the IP address of the ec2 instance directly which of course has 80 and 443 open, I get the server not found.

and curl my home ip address from the container gives me

<html> <head><title>301 Moved Permanently</title></head> <body bgcolor="white"> <center><h1>301 Moved Permanently</h1></center> <hr><center>nginx/1.10.0 (Ubuntu)</center> </body> </html>

What am I doing wrong? Is this setup right? I would really appreciate your help. I tried the same setting with no docker but running natively as reverse proxy server, still not working :-(

  • 1
    Not commenting on docker as I am unfamiliar with it, but... listen 8080? If you're listening on 8080 instead of 80, then you won't be able to access it via 80...
    – Bob
    Jun 13, 2017 at 5:26
  • @Bob, Good catch, I have edited it above and my conf file. Its listening on 80 now. I tried this config with both native nginx and docker container. Still not luck
    – Jauyzed
    Jun 13, 2017 at 6:33
  • Now that you are listening on the correct port, what happens when you try connecting to it? Make sure you have restarted the process/service. Please stick with native for now - IMO that's much easier to debug. Also, double-check your DNS configuration - make sure you're pointing to the right place, keeping in mind that DNS can take a while to update and check with dig or nslookup - and take a screenshot of the error.
    – Bob
    Jun 13, 2017 at 8:08
  • Running natively now with same nginx.conf file. dig and nslookup show me my domain is pointing to public ip of the EC2 instance. Do you think I have to do anything on my pfsense config?
    – Jauyzed
    Jun 14, 2017 at 4:44
  • Mind hopping into chat? This is getting a bit too complex for troubleshooting in comments.
    – Bob
    Jun 14, 2017 at 5:01

1 Answer 1


When troubleshooting this kind of issue, you generally want to go one step at a time. I'll try to summarise here, as the entire process has been followed via chat already (transcript).

  1. Check that you can connect from the proxy to the upstream host. In this case, you already tried curl, which shows it can connect but hit a redirect (we'll get to this later). curl -L to follow redirects may be helpful here, but if you've already pointed the DNS name to the reverse proxy then this can get you stuck in a loop.

  2. Check the reverse proxy is listening on the correct ports. netstat -apnt4 is useful here (remove the 4 to show IPv6). In this case, because you wanted HTTPS too, you'll need to make sure both 80 and 443 are listening.

  3. Check that you can connect to the reverse proxy. If the proxy is listening on the correct port, and you still get a connection refused error, it's time to check firewall configs (don't forget the server provider's firewall, e.g. via the AWS control panel). It might also be useful to use the brower's developer console's network tab to see if you are successfully completing the initial request but are being redirected to a broken link.

  4. At this point, hopefully you can at least connect to the reverse proxy and you know the server has connectivity to your upstream. If it still doesn't work, maybe you're getting a 502 Bad Gateway response - this typically means nginx cannot successfully talk to upstream for some reason. Check your logs: /var/log/nginx/error.log is the default location.

  5. Use google, and search for the relevant error. There are two common ones:

    • Permission denied while connecting to upstream. This might be because SELinux is blocking nginx from making outgoing network requests. You will need to allow it.

    • SSL_do_handshake() with a SSL23_GET_SERVER_HELLO:unknown protocol is commonly because you are trying to connect with HTTPS to a HTTP port (80). Nginx upstreams default to port 80 -- you'll need to explicitly specify 443 if you want to use HTTPS to connect to upstream.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.