How to use NGINX as forward proxy for any requested location?

Question

I am trying to configure NGINX as a forward proxy to replace Fiddler which we are using as a forward proxy. The feature of Fiddler that we use allows us to proxy ALL incoming request to a 8888 port. How do I do that with NGINX?

In all examples of NGINX as a reverse proxy I see proxy_pass always defined to a specific upstream/proxied server. How can I configure it so it goes to the requested server, regardless of the server in the same way I am using Fiddler as a forward proxy.

Example:

In my code:

WebProxy proxyObject = new WebProxy("http://mynginxproxyserver:8888/",true);
WebRequest req = WebRequest.Create("http://www.contoso.com");
req.Proxy = proxyObject;

In mynginxproxyserver/nginx.conf I do not want to delegate the proxying to another server (e.g. proxy_pass set to http://someotherproxyserver). Instead I want it to just be a proxy server, and redirect requests from my client (see above) to the request host. That's what Fiddler does when you enable it as a proxy: http://docs.telerik.com/fiddler/Configure-Fiddler/Tasks/UseFiddlerAsReverseProxy

Can you give an example of a request and what you expect? I'm not certain if you're asking for a dynamic host, dynamic ip, or something else. Is this port 8888 of the same machine? — Grumpy, Sep 06 '17 at 01:23
I added an example in the question, as well as a link to how it's done using Fiddler. I basically wanna do the same thing as you do with Fiddler through nginx. — Arman Bimatov, Sep 06 '17 at 14:10

score 68 · Accepted Answer · edited Mar 19 '18 at 18:50

68

Your code appears to be using a forward proxy (often just "proxy"), not reverse proxy and they operate quite differently. Reverse proxy is for server end and something client doesn't really see or think about. It's to retrieve content from the backend servers and hand to the client. Forward proxy is something the client sets up in order to connect to rest of the internet. In turn, the server may potentially know nothing about your forward proxy.

Nginx is originally designed to be a reverse proxy, and not a forward proxy. But it can still be used as a forward one. That's why you probably couldn't find much configuration for it.

This is more a theory answer as I've never done this myself, but a configuration like following should work.

server {
    listen       8888;

    location / {
        resolver 8.8.8.8; # may or may not be necessary.
        proxy_pass http://$http_host$uri$is_args$args;
    }
}

This is just the important bits, you'll need to configure the rest.

The idea is that the proxy_pass will pass to a variable host rather than a predefined one. So if you request http://example.com/foo?bar, your http header will include host of example.com. This will make your proxy_pass retrieve data from http://example.com/foo?bar.

The document that you linked is using it as a reverse proxy. It would be equivalent to

        proxy_pass http://localhost:80;

edited Mar 19 '18 at 18:50

marc_s

732,580
175
1,330
1,459

answered Sep 06 '17 at 20:19

Grumpy

1,408
1
11
18

3

That actually works! And I did need: `resolver 8.8.8.8;` – Arman Bimatov Oct 10 '17 at 22:13
24

Does not work for HTTPS targets. Returns 400 error about failed `CONNECT` to 443. – Nakilon May 01 '18 at 12:15
1

Check out this (old) answer. Seems it still applies? https://superuser.com/questions/604352/nginx-as-forward-proxy-for-https – user3841460 Mar 26 '19 at 20:06
When curl `http://forward-proxy-server-ip:8888`, nginx will stop work. anyone have idea? – chengzi Dec 18 '19 at 16:10
@Nakilon, use this https://github.com/chobits/ngx_http_proxy_connect_module for HTTPS – Salmaan P Jan 31 '21 at 06:40
Any clues on how to do general TCP/UDP forwarding with NGINX? I tried using the proxy_protocol `--with-stream` but i am unable to retrieve the original address (`http_host` in the http example)... – Frank Martin Apr 08 '21 at 14:15

David Asher · Answer 2 · 2022-01-28T07:49:02.687

9

You can run into url encoding problems when using the $uri variable as suggested by Grumpy, since it is decoded automatically by nginx. I'd suggest you modify the proxy pass line to

proxy_pass http://$http_host$request_uri;

The variable $request_uri leaves the encoding in tact and also contains all query parameters.

edited Jan 28 '22 at 07:49

answered Apr 07 '21 at 12:06

David Asher

142
1
7

score 0 · Answer 3 · answered Mar 15 '23 at 12:59

To use nginx as forward proxy for https Need to install proxy_connect

cd /tmp
wget https://nginx.org/download/nginx-1.20.2.tar.gz
tar xzvf nginx-1.20.2.tar.gz

git clone https://github.com/chobits/ngx_http_proxy_connect_module

cd nginx-1.20.2/
patch -p1 < ../ngx_http_proxy_connect_module-master/patch/proxy_connect_rewrite_1018.patch

./configure --add-module=../ngx_http_proxy_connect_module-master --prefix=/usr
make 
sudo make install

Then edit the nginx.conf

nano /usr/conf/nginx.conf
http {
 server {
     listen                         3128;

     # dns resolver used by forward proxying
     resolver                       8.8.8.8;

     # forward proxy for CONNECT request
     proxy_connect;
     proxy_connect_allow            443 563;
     proxy_connect_connect_timeout  10s;
     proxy_connect_data_timeout     10s;

     # forward proxy for non-CONNECT request
     location / {
         proxy_pass http://$host;
         proxy_set_header Host $host;
     }
 }
}

How to use NGINX as forward proxy for any requested location?

3 Answers3