This is probably pretty simple but I just can't wrap my head around it.

I set up a subdomain, let's say it's nc.example.com. Set up my DNS and all to point the subdomain to a remote server, which runs Nginx which reverse proxies the request to port 3123.

Then, I listen for requests using netcat on the remote server, like this:

nc -l 3123

So that I can receive HTTP requests from nc.example.com.

Next, on my local machine, I use netcat to connect to an unrelated server (Google's public DNS), like this:

$ nc 80
GET / HTTP/1.1
Host: nc.example.com

(with extra 2 newlines so that it completes the HTTP request, but can't be displayed here)

I receive the connection on my remote server as follows:

$ nc -l 3123
GET / HTTP/1.1
Connection: upgrade
Host: nc.example.com
X-Real-IP: <redacted_1>
X-Forwarded-Host: nc.example.com
X-Forwarded-Server: nc.example.com
X-Forwarded-For: <redacted_2>, <redacted_1>

Now, I'm not sure why this happens, because I thought that nc will connect to, rather than my server's IP address. Is forwarding the request to my server on my behalf? Are there any security implications as a result of this?


I just realised that <redacted_2> is a private IP address ( assigned to my "home" network (accessing it brings me to my router's homepage). I am doing this within my college's network.

Does this mean that the upstream router is proxying the request for me, based on the Host header? It's understandable because my college recently implemented some sort of network filtering though there's not much details about it. Though I don't understand why it behaves this way?


What IP address does your Nginx server receive the connection from?

It looks like there is a "transparent proxy" intercepting all HTTP requests that your local computer sends, and forwarding them based on the Host header. (Might be a virus, an antivirus, a caching proxy, a parental filter, etc.)

Especially because your X-Forwarded-For header has two IP addresses, even though Nginx should only have added one.

The Google DNS servers certainly don't perform such forwarding – they do not even accept connections on port 80. (In fact, "open proxies" behaving like that would be widely considered a security problem...)

  • You're right, I tried to connect to the same server from a different machine and it didn't work. I edited the question to add additional details, I realised that redacted_2 is a private IP address. My upstream router is probably doing the proxying, but why would it forward requests based on the Host header? – Irvin Lim Jul 30 '17 at 3:31
  • That's how "transparent" proxies work. The firewall quietly redirects all TCP:80 connections to the proxy, at which point the 'original' destination IP is lost. So the proxy must guess the real destination based on the HTTP request itself. /// As for why your router is doing the proxying… that's a question for its owners/administrators. – grawity Jul 30 '17 at 9:00
  • Thanks, I actually just figured that out as well. There's probably some filtering and caching going on, since it's a university network. – Irvin Lim Jul 30 '17 at 9:02

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.