根据请求的来源将反向代理重定向到 SSL

Question

我有一个 NGINX 服务器，它绑定到端口 443，提供身份验证，并将所有 SSL 请求反向代理到一堆后端服务器。另一台服务器在端口 80 上进行侦听，但它暂时只是简单地导致了一个占位符页面。如何让 NGINX 将所有外部请求重定向到受 SSL 保护的站点，同时将所有 Intranet 请求重定向到没有 SSL 的相同站点？这是我的 nginx.conf 的相关部分：

server {
    listen       80;
    server_name  intranet;
allow 10.10.0.0/16;
    #charset koi8-r;
    access_log  logs/host.access.log  main;

#######################################
#
# locations on LOCALHOST
#
#######################################         

    location / {
    allow   all;
        root   /data/www;
            index  index.html index.htm;
        }
##############
# HTTPS server
##############

server {
    listen       443 ssl;
    server_name  localhost;

    ssl_certificate      /srv/ssl/ExternalSite.com.combined.crt;
    ssl_certificate_key  /srv/ssl/ExternalSite.key;

    ssl_session_cache    shared:SSL:1m;
    ssl_session_timeout  5m;

    ssl_ciphers  HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers  on;


    #######################################
    #
    # Reverse proxy blocks
    #
    #######################################         


    #General ExternalSite web site
    location / {
        auth_basic "Please enter userid and password to enter the ExternalSite web site";
        auth_basic_user_file /var/www/www.ExternalSite.com/.htpasswd;
        proxy_buffers 16 4k;
        proxy_buffer_size 2k;
        proxy_buffering off;   
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Accept-Encoding "";
        proxy_pass http://10.10.10.16:2080;
        }       

    #nagios server 
    location  /nagios  {
        auth_basic "Please enter userid and password to enter the ExternalSite nagios web site";
        auth_basic_user_file /var/www/www.ExternalSite.com/.htpasswd;
        proxy_set_header Authorization $http_authorization;
        proxy_buffers 16 4k;
        proxy_buffer_size 2k;
        proxy_buffering off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Accept-Encoding "";
        proxy_pass http://10.10.10.18/nagios;
        }       

    # # munin server
    location  /munin  {
        auth_basic "Please enter userid and password to enter the ExternalSite munin web site";
        auth_basic_user_file /var/www/www.ExternalSite.com/.htpasswd;
        proxy_set_header Authorization $http_authorization;
        proxy_buffers 16 4k;
        proxy_buffer_size 2k;
        proxy_buffering off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Accept-Encoding "";
        proxy_pass http://10.10.10.18/munin;
        }       
    #######################################
    #
    # End of Reverse proxy blocks
    #
    #######################################         
    }

Answer 1

要拆分内网和外部请求，请创建另一个服务器部分并修改监听指令以包含相应的接口。 即，如果您的 Intranet 接口是 10.10.10.1，公共 IP 是 54.200.200.200，对于 Intranet，您将执行以下操作： 听 10.10.10.1:80

对于外部请求： 听 54.200.200.200:80

然后要重定向到 ssl，使用 nginx return 语句到同一服务器，但使用 https。

更新：示例 Nginx 配置架构（根据 cmets）：

#######################################
#
# Intranet server
#
#######################################         
server {
    listen       10.10.10.1:80 default_server;
    server_name  intranet;
    allow 10.10.0.0/16;
    deny all;
    # server configuration with all locations, proxy_passes, etc.
}

#######################################
#
# Internet server, redirecting to ssl
#
#######################################         
server {
    listen       80;
    server_name  www.yourdomain.com;

    location / {
      return https://www.yourdomain.com$request_uri;
    }
}
##############
# HTTPS server
##############

server {
    listen       443 ssl;
    server_name  www.yourdomain.com;
    # server configuration with all locations, proxy_passes, etc.
}