如何阻止 nginx 传递从解析上游到 IP

Question

我是 nginx 反向代理配置的新手。我们需要设置代理服务器以将请求路由到需要 IP 白名单的远程服务器。也有两种方式的 SSL。

我们一直在努力解决这个问题。以下是配置：

server {
   listen 80;
   server_name myserver.com;
   return 302 https://myserver.com;
}

server {
   listen 443;
   server_name myserver.com;

   ssl on;
   ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
   ssl_prefer_server_ciphers on;
   ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH"; 
   ssl_certificate           /etc/nginx/keys/my-net.crt;
   ssl_certificate_key       /etc/nginx/keys/my-net.key;
   access_log /var/log/nginx/access.log;
   error_log /var/log/nginx/error.log;

   location / {
        resolver 8.8.8.8;
        set $backend "https://remoteserver.com";
        proxy_pass $backend;

        proxy_ssl_server_name on;
        proxy_ssl_trusted_certificate /home/ubuntu/myfile.pem;
        proxy_ssl_session_reuse off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwared-For $proxy_add_x_forwarded_for; 
   }
}

我们面临的问题是代理服务器正在将域名解析为 IP，因为 SSLhandshake 失败。我们需要停止这个并点击域名，因为证书在域名上。

error.log 中的错误

2022/03/02 14:10:02 [error] 27012#27012: *8 SSL_do_handshake() failed (SSL: error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure:SSL alert number 40) while SSL与上游握手，客户端：，服务器：，请求：“POST HTTP/1.1”，上游：“https:”，主机：“” 2022/03/02 14:10:02 [alert] 27012#27012: *8 socket() 在连接到上游时失败（97：协议不支持地址系列），客户端：，服务器：，请求： “POST /gateway/api/txb/v1/payments/transfer-payment HTTP/1.1”，上游：“https://[IPv6]:443/”，主机：“”

已经在这里尝试了解决方案，但没有运气 - How to stop nginx from resolving upstream to ip?

Answer 1

您需要在使用proxy_set_heder 设置标题后关闭proxy_pass_request_headers 并监听ssl listen 443 ssl;

server {
   listen 80;
   server_name myserver.com;
   return 302 https://myserver.com;
}

server {
   listen 443 ssl; 
   server_name myserver.com;

   ssl on;
   ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
   ssl_prefer_server_ciphers on;
   ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH"; 
   ssl_certificate           /etc/nginx/keys/my-net.crt;
   ssl_certificate_key       /etc/nginx/keys/my-net.key;
   access_log /var/log/nginx/access.log;
   error_log /var/log/nginx/error.log;

   location / {
        resolver 8.8.8.8;
        set $backend "https://remoteserver.com";
        proxy_pass $backend;

        proxy_ssl_server_name on;
        proxy_ssl_trusted_certificate /home/ubuntu/myfile.pem;
        proxy_ssl_session_reuse off;
        proxy_pass_request_headers off;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwared-For $proxy_add_x_forwarded_for; 
   }
}