[Help] Reverse Proxying ZNC
reddit / irc

----------------------------------------------------------------------
b6-redacted · 2020-11-26 19:55

I'm not sure if this is the right subreddit but let's give it a shot.
I'm trying to reverse proxy ZNC with nginx so that I can access it
from wherever I am. Proxying the admin page is fine, it works like any
other site, but I can't connect with IRC clients. I've tried both
Hexchat and Revolution on my phone.

The firewall is setup correctly, I'm able to connect, but nginx gives
me a 400 bad request error when I try to connect.

    * Connected. Now logging in.
    * HTTP/1.1 400 Bad Request
    * Server: nginx
    * Date: Thu, 26 Nov 2020 19:37:21 GMT
    * Content-Type: text/html
    * Content-Length: 166
    * Connection: close
    *
    * <html>
    * <head><title>400 Bad Request</title></head>
    * <body bgcolor="white">
    * <center><h1>400 Bad Request</h1></center>
    * <hr><center>nginx</center>
    * </body>
    * </html>
    * Disconnected (Remote host closed socket)

My listen config in `/var/lib/znc/...`

    <Listener listener0>
            AllowIRC = true
            AllowWeb = false
            IPv4 = true
            IPv6 = true
            Port = 7000
            SSL = false
            URIPrefix = /
    </Listener>

    <Listener listener1>
            AllowIRC = false
            AllowWeb = true
            IPv4 = true
            IPv6 = true
            Port = 8001
            SSL = false
            URIPrefix = /znc/
    </Listener>

I've added the following to `/etc/nginx/conf.d/znc.conf`:

    upstream znc {
        server 192.168.1.5:7000;
        # For IPv4 loopback (there's almost no reason to do this)
        # server 127.0.0.1:7000;
    }

    server {

        listen      9000 ssl;
        listen      [::]:9000 ssl;
        server_name <redacted> 192.168.1.10;
        # To listen on a specific address only:
        # listen      192.0.2.1:7000 ssl;
        # listen      [2001:db8::192:0:2:1]:7000 ssl;

        # SSL options
        ssl_certificate <redacted>;
        ssl_certificate_key <redacted>;
        ssl_trusted_certificate <redacted>;
        ssl_dhparam <redacted>;

    location / {
       proxy_pass http://znc;
       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    }

It's pretty much just modified from the ZNC wiki, [https://wiki.znc.in
/Reverse\_Proxy](https://wiki.znc.in/Reverse_Proxy), but their version
has the proxy\_pass directive inside the server block which seemed
incorrect to me (and fails nginx self test). The nginx logs are
silent, it's like a connection was never made which seems very
strange.

Accessing at example.com:9000 in a web browser returns `Web Access is
not enabled`, so it appears everything is running properly with ZNC
but IRC clients and nginx aren't able to communicate properly?

----------------------------------------------------------------------
MachinaExDeo · 2020-11-26 20:59

You're confusing reverse-proxying ZNC HTTP traffic (ie. the web
module) with reverse-proxying ZNC IRC stream traffic.

What you probably want to do is this:

    upstream znc {
        server 192.168.1.5:7000;
        # For IPv4 loopback (there's almost no reason to do this)
        # server 127.0.0.1:7000;
    }

    server {

        listen      9000 ssl;
        listen      [::]:9000 ssl;

        # SSL options
        ssl_certificate <redacted>;
        ssl_certificate_key <redacted>;
        ssl_trusted_certificate <redacted>;
        ssl_dhparam <redacted>;

        proxy_pass znc;

    }

This will allow you to point your IRC client to nginxhost:9000 and
should forward the stream to ZNC.

----------------------------------------------------------------------
b6-redacted · 2020-11-26 21:15

Thanks for your reply. That setup was still failing because of the
location of the proxy\_pass directive, but it pointed me in the right
direction.

I moved znc.conf outside of `/etc/conf.d` and it now looks like this:

    stream {

      upstream znc {
          server 192.168.1.5:7000;
      }

      server {

          listen      9000 ssl;
          listen      [::]:9000 ssl;

          # SSL options
          ssl_certificate <redacted>;
          ssl_certificate_key <redacted>;
          ssl_trusted_certificate <redacted>;
          ssl_dhparam <redacted>;

          proxy_pass znc;
      }
    }

Doing it this way allowed me to use the proper proxy\_pass but I had
to move it outside conf.d because the `stream` directive must be at
the same level as the `http` directive in the regular
`/etc/nginx/nginx.conf`  file (and the include for conf.d is inside
http by default). Then I just added an include directive in nginx.conf
at the same level as http:

    ...
    include /etc/nginx/znc.conf;

    http {
    ...

Edit: typo

----------------------------------------------------------------------
DoctorReis · 2020-11-26 21:51

Can’t you access your server from anywhere with IRC client? What is
the benefit of the reverse proxy (honest question)?

----------------------------------------------------------------------
b6-redacted · 2020-11-26 22:14

I'm not hosting an IRC server, I'm running the IRC bouncer ZNC on my
home server which stays connected to all my  usual networks 24/7. That
way instead of connecting to each IRC server with a client
individually I just connect to the self-hosted bouncer.

The reverse proxy setup allows me to connect to the bouncer outside my
LAN. So instead of setting up everything separately on all my devices
I just do it once in ZNC.

----------------------------------------------------------------------
iseethesharp · 2021-01-27 19:04

Nginx is an http server.  IRC client use the irc protocol.  You
probably need to port forward instead.

----------------------------------------------------------------------
b6-redacted · 2021-01-27 19:14

With the stream module nginx can reverse proxy any traffic, not just
http. Anyway it's working now with the changes I put in another
comment.