Nginx proxy shows login page for my switch but returns 403 when i enter credentials reddit / selfhosted ---------------------------------------------------------------------- domanpanda · 2023-11-19 14:04 I want to setup proxy for my netgear router. Everything works with ip: both with http and https. But when i try to enter the site through nginx proxy it returns 403. It doesnt make sense because login page shows up correctly. I tried to set Origin header like they advise here but it just doesnt work. [https://www.reddit.com/r/nginx/comments/g7a6da/comment/fogiil0/](http s://www.reddit.com/r/nginx/comments/g7a6da/comment/fogiil0/) log from nginx: 192.168.5.2 - - [19/Nov/2023:12:46:02 +0000] "GET /base/images/Registration_on.gif HTTP/1.1" 403 25 "https://netgear.mysite.com/base/cheetah_login.html" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" 192.168.5.2 - - [19/Nov/2023:12:46:02 +0000] "GET /base/images/TurnOff_on.gif HTTP/1.1" 403 25 "https://netgear.mysite.com/base/cheetah_login.html" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" 192.168.5.2 - - [19/Nov/2023:12:46:02 +0000] "GET /base/images/TurnOff_off.gif HTTP/1.1" 403 25 "https://netgear.mysite.com/base/cheetah_login.html" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36" my config. I use very similar one for other things like vaultwarden, proxmox, edgerouter and many other ones and it works ok. server { server_name netgear.mysite.com; listen 80; return 301 https://netgear.mysite.com$request_uri; } server { set $DN netgear.mysite.com; server_name netgear.mysite.com; #listen 80; listen 443 ssl; ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2; ssl_ciphers HIGH:!aNULL:!MD5; ssl_certificate /etc/letsencrypt/live/mysite.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/mysite.com/privkey.pem; access_log /var/log/nginx/netgear.mysite.com.access; error_log /var/log/nginx/netgear.mysite.com.error error; location / { proxy_http_version 1.1; proxy_request_buffering off; proxy_buffering off; # proxy_set_header Host $host:$server_port; # proxy_set_header X-Real-IP $remote_addr; # proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; # proxy_set_header X-Forwarded-Proto $scheme; proxy_pass https://192.168.5.10:443; # tried with http too proxy_set_header Origin https://192.168.5.10/; # tried with http too } } ​ ---------------------------------------------------------------------- thekrautboy · 2023-11-19 19:05 Try /r/Nginx or if youre using NPM then /r/NginxProxyManager ---------------------------------------------------------------------- floydhwung · 2023-11-20 02:06 what is at 5.2 and what is at 5.10？ ---------------------------------------------------------------------- Lick_A_Brick · 2023-11-20 10:25 I would like to mention that is not very good practice to open up your internal network devices to the internet, even when using HTTPS. ---------------------------------------------------------------------- domanpanda · 2023-11-20 11:47 5.2 - my laptop 5.10 - netgear switch address ---------------------------------------------------------------------- domanpanda · 2023-11-20 11:49 They are not exposed to internet. Its only for internal use. ---------------------------------------------------------------------- floydhwung · 2023-11-20 13:50 are you also using your hosts file to direct requests to localhost? ---------------------------------------------------------------------- domanpanda · 2023-11-20 14:31 You mean does /etc/hosts on my laptop contain '127.0.0.1 localhost'? Yeah it does. But netgear.mysite.com is set to my proxy ip in cloudflare (globally), not in /etc/hosts. And as i said, such config does work for other services. ---------------------------------------------------------------------- floydhwung · 2023-11-20 15:45 Just trying to help. First off, when you are seeing 403, are you accessing externally (ie outside of your home LAN), or internally (inside your LAN)? If outside, did you set port forwarding to forward the requests made to 80/443, to your laptop at 5.2? If inside, then what is your network like? For example, when you make a request to \[[router.com](https://router.com)\], your computer look for the ip address first, which means it needs a dns record. Do you have a standalone DNS server running to resolve \[[router.com](https://router.com)\] internally and pointing to where your nginx is (assuming your laptop is running the nginx)? If not then you would edit the hosts file to include \[[router.com](https://router.com)\] and point this domain at \[[127.0.0.1](https://127.0.0.1)\] to let nginx to handle the request. ---------------------------------------------------------------------- domanpanda · 2023-11-20 20:02 Im using it internally. Again: cloudflare has 'A' record netgear.mysite.com pointing to 192.168.5.250 which is my nginx proxy. When im in my network, i open netgear.mysite.com, request goes to my nginx (192.168.5.250) -> nginx resolves this according to config -> forwards the request to 192.168.5.10 -> netgear login shows up. I dont understand what /etc/hosts has to do with 403 code? It already opens the netgear's login page so all this request works properly right? ---------------------------------------------------------------------- floydhwung · 2023-11-20 20:54 "cloudflare has 'A' record netgear.mysite.com pointing to 192.168.5.250 which is my nginx proxy." Do you mean you have a public IP and that record is forwarding the request to the machine with internal IP address of [192.168.5.250](https://192.168.5.250)? Just to make sure you are not putting an internal IP on cloudflare because that would not have worked. Normally when accessing custom domain names inside a network, you wouldn't have to setup a DNS record at cloudflare. You would use a local DNS to handle this internally. I don't know what your requirements are but that isn't very common. Do you need to access it outside of your network when out and about in the public or something? Try this: edit your hosts file on whatever machine you are using, add an entry for [netgear.mysite.com](https://netgear.mysite.com) for the ip address of your router. See if it redirects to your router and you are able to login. It bypasses nginx completely. If this works, then we know it is nginx not properly handling the request, or the router is actively blocking the request. ---------------------------------------------------------------------- domanpanda · 2023-11-20 22:05 'Just to make sure you are not putting an internal IP on cloudflare because that would not have worked' YES i put my internal IP in cludflare, YES it DOES work for me FOR YEARS for COUPLE of services. Its just simple nameip mapping so ok it wont work externally(*) but why it would not work when im inside my network??? The only thing is that cloudflare proxy is disabled for each record. But i dont need it anyway because (AGAIN! ) i use it internally. And AFAIK many homelabbers does that as well. * - why i use cloudflare instead of dns in my network? For few reasons, one is that i use Zerotier to access some services from outside my network and then i set vpn (zerotier) ip (10.10.10.x) in cloudflare. And inside my network its being overwriten by internal DNS to 192.168.5.x. And this also works perfectly well (well maybe not exactly as recently added VLAN and somehow overwrite does not work there) . ---------------------------------------------------------------------- floydhwung · 2023-11-20 22:27 Yes, if you are just using it internally the request will resolve back to your internal IP. I am trying to figure out why you'd have a origin header at the router. Origin header is used to define the client requesting, not the destination. So if this is getting through nginx, nginx will say to the router that this request originates from the router, which does not make sense.