Hi

I've just set up an OpenVPN internally using TCP 443 as a port. Now I wondered if it were possible to use Nginx as a reverse proxy to connect to the OpenVPN, as I can't connect OpenVPN to the internet.

If it's possible: Anything special to configure, or would a normal SSL site forwarding to the OpenVPN Server suffice?

Regards

nginx supports tcp proxy, http://nginx.org/en/docs/stream/ngx_stream_core_module.html

Which could work for this setup.

---
nginx for Windows http://nginx-win.ecsds.eu/

Hm, okey :-) I will try that and give feedback!

Many thanks

So, finally can give feedback. Stream works very well for the OpenVPN (using TCP).
Only thing I had to change was
proxy_conenct_timeout
proxy_timeout

Set both values to 300s, otherwise the OpenVPN client keeps disconnecting.

So the config looks as follows now:

stream{
upstream backend {
hash $remote_addr consistent;

server 10.50.40.1:8443;
}

server {
listen 10.50.39.123:443 so_keealive=on;
proxy_connect_timeout 300s;
proxy_timeout 300s;
proxy_pass backend;
}
}

Only thing I wonder now:
Can I still use the same instance of NGINX to also handle HTTPS requests on 443 (apart from the stream module handling stream)? I have no clue how NGINX would be able to tell them apart, but,...maybe that works. Would save me another proxy cluster :-)

inzanez Wrote:
-------------------------------------------------------
> So, finally can give feedback. Stream works very well for the OpenVPN

Good !

> Only thing I wonder now:
> Can I still use the same instance of NGINX to also handle HTTPS
> requests on 443 (apart from the stream module handling stream)? I have
> no clue how NGINX would be able to tell them apart, but,...maybe that
> works. Would save me another proxy cluster :-)

stream {} and http {} are two different blocks which can be in one file where nginx can handle both, so yes.

---
nginx for Windows http://nginx-win.ecsds.eu/

wow, ok...that's amazing!

Thanks for the answer :-)

Hi Inzanez,

I'm interresting with your use-case.

I'm looking for a solution to proxy vpn traffic:
- on the same host, I want to run several openvpn servers using the same port (443/tcp)
- I want to access each vpn servers by hostname

Do you think it's possible?

Thanks,
Ben

Sure, get our Windows version and look at \conf\nginx-sslh-v1.0.conf

---
nginx for Windows http://nginx-win.ecsds.eu/

Thanks, I'll have a look...

Does SSLH support some sort of SNI then?

inzanez Wrote:
-------------------------------------------------------
> Does SSLH support some sort of SNI then?

Yes (ssl_preread)

---
nginx for Windows http://nginx-win.ecsds.eu/

I'm still trying to access several vpn servers by hostname using the same port on the same host.

I looked at the \conf\nginx-sslh-v1.0.conf file for Windows version and here:
http://stackoverflow.com/questions/34741571/nginx-tcp-forwarding-based-on-hostname/40135151

But I don't manage to make it work :-(

Does anybody have an example?

tmtben Wrote:
-------------------------------------------------------
> I'm still trying to access several vpn servers by hostname using the
> same port on the same host.
>
> I looked at the \conf\nginx-sslh-v1.0.conf file for Windows version
> and here:
> http://stackoverflow.com/questions/34741571/nginx-tcp-forwarding-based
> -on-hostname/40135151
>
> But I don't manage to make it work :-(
>
> Does anybody have an example?

That example works fine, the problem must be that a vpn request is not sending a vpn (ssl) SNI hostname, check the logfiles because the SNI names are in there when detected.

If this is the case ssl_preread may need a patch to handle vpn names.

---
nginx for Windows http://nginx-win.ecsds.eu/

> That example works fine, the problem must be that a vpn request is not
> sending a vpn (ssl) SNI hostname, check the logfiles because the SNI
> names are in there when detected.
>
> If this is the case ssl_preread may need a patch to handle vpn names.

My nginx logs (using ssl_preread) do not show sni names for vpn traffic.
But I'm not sure my vpn is well setup...

Hi, I am trying to setup nginx for both https and TCP application but it is not working, could you please check here what is wrong in my configuration.

server {

listen 443;
server_name nginx.external.pcpc.com;
ssl_password_file /etc/nginx/ssl/nginx.pass;
ssl_certificate /etc/nginx/ssl/external.pcpc.cert.txt;
ssl_certificate_key /etc/nginx/ssl/external.pcpc.pkey.txt;


ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4;
ssl_prefer_server_ciphers on;

access_log /var/log/nginx/jenkins.access.log;
location /service {
proxy_pass http://service.s3-website-us-east-1.amazonaws.com/service;
}

location / {
proxy_pass https://nginx-36775c5588ec6e89.elb.us-east-1.amazonaws.com;
proxy_ssl_session_reuse off;
proxy_ssl_server_name on;

}
}