Reverse Proxy (Nginx) - Revision history

Nick: /* What About A Forward Proxy? (Squid) */

2026-03-27T12:04:57Z

What About A Forward Proxy? (Squid)

Nick at 09:32, 27 March 2026

2026-03-27T09:32:27Z

Nick: /* Next Steps */

2026-03-25T11:42:31Z

Next Steps

Nick: /* Prerequisites */

2026-03-25T11:40:05Z

Prerequisites

Nick at 09:51, 25 March 2026

2026-03-25T09:51:09Z

Nick at 09:40, 25 March 2026

2026-03-25T09:40:38Z

Nick: Creating page

2026-03-25T08:47:45Z

Creating page

New page

Placeholder Text

← Older revision		Revision as of 12:04, 27 March 2026
Line 146:		Line 146:
	If the command executes normally, it's likely working. If it times out or hangs for a long time, additional troubleshooting of the Squid forward proxy, firewalls, and network configs may be required.		If the command executes normally, it's likely working. If it times out or hangs for a long time, additional troubleshooting of the Squid forward proxy, firewalls, and network configs may be required.

		+	'''Helpful tip:''' If hosting these services in the cloud, be sure to triple check any provided firewall settings of the cloud hosting service to make sure that even if the firewalls of the hosts are accurate, there's not a firewall interfering between them. Ask me how I know...

	== Next Steps ==		== Next Steps ==

← Older revision		Revision as of 09:32, 27 March 2026
Line 95:		Line 95:
	And to start it manually to verify that it's working:		And to start it manually to verify that it's working:
	<nowiki>sudo systemctl start nginx</nowiki>		<nowiki>sudo systemctl start nginx</nowiki>
		+
		+
		+	== What About A Forward Proxy? (Squid) ==
		+
		+	Create a new shell script in /etc/profile.d/ that sets the variables when a user logs in here:
		+	<nowiki>/etc/profile.d/http_proxy.sh</nowiki>
		+
		+	The script should contain the following, be sure to replace PROXY_IP:PORT with your actual Proxy's IP:Port Number, i.e. 1.1.1.1:9000:
		+	<nowiki>
		+	# System-wide HTTP/HTTPS Proxy Settings
		+	export http_proxy="http://PROXY_IP:PORT"
		+	export https_proxy="http://PROXY_IP:PORT"
		+	export HTTP_PROXY="http://PROXY_IP:PORT"
		+	export HTTPS_PROXY="http://PROXY_IP:PORT"</nowiki>
		+
		+	You may want to exclude local network traffic from being routed via the proxy, include the below to do so (you will need to specify your local network/subnet):
		+	<nowiki>
		+	export no_proxy="localhost,127.0.0.1,LOCALNETWORK_IP/SUBNET"
		+	export NO_PROXY="localhost,127.0.0.1,LOCALNETWORK_IP/SUBNET"</nowiki>
		+
		+	You have two options to apply this immediately:
		+
		+	Option A: Re-login Simply log out and log back in (or reboot the server).
		+	Option B: Source the file manually (Immediate) Run this command to load the variables into your current session:
		+
		+	<nowiki>source /etc/profile.d/http_proxy.sh</nowiki>
		+
		+	Then to verify that it's working:
		+
		+	<nowiki>echo $http_proxy</nowiki>
		+
		+	And you should get an output like this:
		+	<nowiki>http://PROXY_IP:PORT i.e. 1.1.1.1:9000</nowiki>
		+
		+
		+	Now dnf has to be configured to route via the proxy as well. In order to do so, create the config file (if it doesn't already exist):
		+	<nowiki>/etc/dnf/dnf.conf</nowiki>
		+
		+	And add the following lines, again with the actual IP and Port for your proxy, below the [main] section (if it doesn't already exist):
		+
		+	<nowiki>[main]
		+	proxy=http://PROXY_IP:PORT
		+	proxy_username=None
		+	proxy_password=None</nowiki>
		+
		+
		+	Now to confirm that it's working:
		+	<nowiki>sudo dnf check-update</nowiki>
		+
		+	If the command executes normally, it's likely working. If it times out or hangs for a long time, additional troubleshooting of the Squid forward proxy, firewalls, and network configs may be required.

@@ Line 101: / Line 101: @@
 Once the reverse proxy is up and running and redirecting HTTP traffic successfully, you may want to encrypt that traffic by changing the protocol to HTTPS using SSL/TLS and certificates from Let's Encrypt.
-Instructions to do so can be found [https://nlear.xyz/wiki/index.php/Certbot here] with special instructions for doing so on a reverse proxy [https://nlear.xyz/wiki/index.php/Certbot#Reverse-Proxy_Setup here.]
+Instructions to do so can be found [[Certbot|here]] with special instructions for doing so on a reverse proxy [[Certbot#Reverse-Proxy Setup|here.]]
 == Additional Resources ==
 [https://docs.nginx.com/nginx/admin-guide/web-server/web-server/ Nginx Documentation Site]

@@ Line 8: / Line 8: @@
 You will need a server running either locally or in the cloud that you can access locally or via SSH.
-Assistance setting up a cloud instance can be [https://nlear.xyz/wiki/index.php/Creating_And_Configuring_A_Remote_Server here.]
+Assistance setting up a cloud instance can be [[Creating And Configuring A Remote Server|here.]]
 == Installing Nginx ==

← Older revision		Revision as of 09:51, 25 March 2026
Line 1:		Line 1:
−	~~Placeholder Text~~	+	A reverse proxy is a server that sits between clients (like web browsers) and your servers. When someone visits your website, for example, they connect to the reverse proxy and not directly to your server. The proxy then forwards the request to the appropriate server/service and returns the response to the client.
		+
		+	This is a high level guide on how to install Nginx on a server and configure Nginx (and adjacent services), so that traffic can be routed via the proxy instead of directly to the content-providing servers themselves.
		+

	== Prerequisites ==		== Prerequisites ==

← Older revision		Revision as of 09:40, 25 March 2026
Line 1:		Line 1:
	Placeholder Text		Placeholder Text
		+
		+	== Prerequisites ==
		+
		+	You will need a server running either locally or in the cloud that you can access locally or via SSH.
		+
		+	Assistance setting up a cloud instance can be [https://nlear.xyz/wiki/index.php/Creating_And_Configuring_A_Remote_Server here.]
		+
		+
		+	== Installing Nginx ==
		+
		+	=== RHEL 9+ ===
		+
		+	To install the Nginx package:
		+	<nowiki>sudo dnf install nginx</nowiki>
		+
		+	=== RHEL <9 ===
		+
		+	You may need to include the EPEL (Extra Packages for Enterprise Linux) repo beforehand:
		+	<nowiki>sudo dnf install epel-release
		+	sudo dnf install nginx</nowiki>
		+
		+
		+	== Configuring The Firewall ==
		+
		+	Below are a couple basic commands to configure Firewalld to accommodate HTTP/HTTPS traffic, but much more information regarding Firewalld can be found [https://nlear.xyz/wiki/index.php/Firewalld here.]
		+
		+	=== Adding Firewall Rules (Firewalld) ===
		+	In order for the reverse proxy to accept incoming/outgoing HTTP/HTTPS traffic, the firewall will need to be updated to whitelist those protocols.
		+	<nowiki>sudo firewall-cmd --permanent --add-service=http
		+	sudo firewall-cmd --permanent --add-service=https</nowiki>
		+
		+
		+	To view the rules that are in place and confirm that the changes are the correct changes:
		+	<nowiki>sudo firewall-cmd --list-all</nowiki>
		+
		+	Once these rules are added and confirmed to be correct, the firewall can be reloaded via:
		+	<nowiki>sudo firewall-cmd --reload</nowiki>
		+
		+
		+	== SELinux Configuration Changes ==
		+
		+	On RHEL systems, SELinux is enforced by default. As a result, these SELinux policies '''may''' need to be adjusted to allow the Nginx reverse proxy service to function.
		+
		+	To allow Nginx to connect to backend services like a database:
		+	<nowiki>sudo setsebool -P httpd_can_network_connect on</nowiki>
		+
		+	To allow Nginx to serve content from non-standard directories:
		+	<nowiki>sudo chcon -R -t httpd_sys_content_t /path/to/non-standard/content
		+	sudo restorecon -R /path/to/non-standard/content</nowiki>
		+
		+
		+	== Reverse Proxy Configuration File ==
		+
		+
		+	Typically this configuration file, which may be (and can be) named something different, is located here:
		+	<nowiki>/etc/nginx/conf.d/reverse-proxy.conf</nowiki>
		+
		+	An example reverse-proxy.conf file for a very basic HTTP reverse proxy serving a static site (SiteA) on a second host (10.0.0.1) that is hosting a web server:
		+	<nowiki>server {
		+	listen 80;
		+	server_name example.com;
		+
		+	location /siteA {
		+	proxy_pass http://10.0.0.1/siteA #Forwards requests for siteA
		+	proxy_set_header Host $host;
		+	proxy_set_header X-Real-IP $remote_addr;
		+	proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		+	proxy_set_header X-Forwarded-Proto $scheme;
		+	}
		+	}</nowiki>
		+
		+	This example works like this...
		+
		+	Susan's laptop requests example.com/siteA.
		+
		+	The reverse proxy receives this request on port 80 (HTTP), and passes it along to 10.0.0.1 also on port 80 (HTTP).
		+
		+	10.0.0.1 then serves the contents of the /siteA directory to the proxy server.
		+
		+	The proxy server then delivers that content to Susan's laptop as example.com/siteA.
		+
		+	When all is completed, Susan was delivered the contents of /siteA without ever having directly accessed the server hosting those contents.
		+
		+
		+	== Starting The Service ==
		+
		+	The proxy will not reroute traffic until the relevant services are up and running.
		+
		+	To enable the nginx service so that it starts automatically on every boot:
		+	<nowiki>sudo systemctl enable nginx</nowiki>
		+
		+	And to start it manually to verify that it's working:
		+	<nowiki>sudo systemctl start nginx</nowiki>
		+
		+
		+	== Next Steps ==
		+
		+	Once the reverse proxy is up and running and redirecting HTTP traffic successfully, you may want to encrypt that traffic by changing the protocol to HTTPS using SSL/TLS and certificates from Let's Encrypt.
		+
		+	Instructions to do so can be found [https://nlear.xyz/wiki/index.php/Certbot here] with special instructions for doing so on a reverse proxy [https://nlear.xyz/wiki/index.php/Certbot#Reverse-Proxy_Setup here.]
		+
		+
		+	== Additional Resources ==
		+	[https://docs.nginx.com/nginx/admin-guide/web-server/web-server/ Nginx Documentation Site]