Nginx IP address www redirection happening on LEMP server without having a c-name or redirect entry in DNS records. Virus or misconfiguration?

Question

On Oracle Cloud server, I have set up a Wireguard VPN Server running Ubuntu Server 20.04. Then, I have set up a Raspberry Pi LEMP Web server as the VPN client to the Oracle Wireguard server. My Raspberry Pi LEMP Server successfully obtains the exact IP address of my Oracle Wireguard Server, and tunnels its traffic through the Oracle Wireguard server. This all seems to work. However, Now I am having a strange problem with my Raspberry pi LEMP Server IP address (Same IP as the Oracle Cloud Wireguard VPN server) automatically redirecting when typing the IP address in my browsers url bar to access and test nginx/php.

I am running Nginx version 1.22.1 (Mainline), and have set up my Raspberry Pi LEMP server (The VPN Client) according to this guide. To test PHP, I have created a file named /usr/share/nginx/html/info.php on the LEMP server, and populated it with the line <?php phpinfo(); ?>. When I navigate to my-lemp-server-client-ip-address/info.php (123.456.78.901/info.php) in my web browser, my web browser automatically redirects 123.456.78.901/info.php to www.123.456.78.901/info.php, and doesn't find my test info.php file. When I attempt to just access the default Nginx Page of my LEMP server by typing my server's IP address into the web browser's url bar, the browser automatically redirects my LEMP Server's IP address to www.my-lemp-server-client-ip-address, as if I have a c-name entry in my dns records or a redirect going on in my Nginx's virtual hosts file.

As of now, I have not connected any DNS records (or "www" c-names) to this server, and I am just running it strait off of http on port 80. So there seems to be one of three things happening:

Something (a virus?) on my Ubuntu Based Oracle Wireguard Cloud Server, is intercepting the tunneled vpn traffic from the client LEMP server, and somehow redirecting it's ip address to begin with "www".
Something (a virus?) directly on my LEMP Server (the VPN Client) is intercepting and redirecting the IP address to be www.123.456.78.901 instead of just 123.456.78.901
Some unknown setting in oracle's cloud web interface instance settings is automatically redirecting the instance's IP address to www, or somehow adding a c-name entry for an http IP address.

I just can't figure out how to debug and diagnose this issue. For the life of me, I cannot figure out what exactly is redirecting my IP address to appear with a www. in front of it in my web browser. This is pretty baffling to me since both servers (the VPN server, and the LEMP server) have no DNS records or domain name attached to them yet.

Below are my /etc/nginx/nginx.conf and /etc/nginx/conf.d/default.conf files on my LEMP server (the VPN Client). Note, /etc/nginx/conf.d/default.conf is the only virtual host I have running on the LEMP Server and Nginx is not installed on the Cloud VPN server.

/etc/nginx/nginx.conf

user  nginx;
worker_processes  auto;

error_log  /var/log/nginx/error.log notice;
pid        /var/run/nginx.pid;


events {
    worker_connections  1024;
}


http {
    include       /etc/nginx/mime.types;
    default_type  application/octet-stream;

    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    #sendfile        on;
    #tcp_nopush     on;

    keepalive_timeout  65;

    #gzip  on;

    include /etc/nginx/conf.d/*.conf;
}

/etc/nginx/conf.d/default.conf

server {
  listen 80;
  listen [::]:80;
  server_name _;
  root /usr/share/nginx/html/;
  index index.php index.html index.htm index.nginx-debian.html;

  location / {
    try_files $uri $uri/ /index.php;
  }

  location ~ \.php$ {
    fastcgi_pass unix:/run/php/php7.4-fpm.sock;
    fastcgi_intercept_errors on;
    fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
    include fastcgi_params;
    include snippets/fastcgi-php.conf;
  }

 # A long browser cache lifetime can speed up repeat visits to your page
  location ~* \.(jpg|jpeg|gif|png|webp|svg|woff|woff2|ttf|css|js|ico|xml)$ {
       access_log        off;
       log_not_found     off;
       expires           360d;
  }

  # disable access to hidden files
  location ~ /\.ht {
      access_log off;
      log_not_found off;
      deny all;
  }
}

Nginx IP address www redirection happening on LEMP server without having a c-name or redirect entry in DNS records. Virus or misconfiguration?

0 Answers0