Nginx port 443 is blocked by firewall

Add-Ons
1

I’m struggling with setting up nginx as a reverse proxy on ipfire.
nginx is setup to listen on port 443, but all external access to RED/port 443 is blocked by the firewall and not forwarded to the nginx running on ipfire.

Is it necessary to create a firewall rule for this type of access ?

2
3

Surely you want www.ipfire.org - Creating an External Access Rule because nginx is running on IPF?

4

Nick, thanks a lot, this was the link I missed. I wasn’t aware that it’s necessary to create a firewall rule for any service running on ipfire with accessibility from the internet.
Also in all documentation about nginx on ipfire I couldn’t find any hint about this issue.
Thanks again for solving my issue.

5

@o_schlenker

Just a heads-up – it is absolutely not (!) recommended to install any Services on the IPFire that are accessible via WAN!

This can backfire very badly, even if Nginx as Reverse Proxy is properly secured…

6

Is it a more secure approach to run nginx on a separate machine inside the green network, and make a port fowarding from ipfire to this machine ?

7

Yes and then use the Orange DMZ from IPFire

8

I don’t know what you want to use a server for to access the internet, but it’s safer to use a VPN (OPENVPN or Wireguard).

9

If it is properly secured, why would it backfire?

Running nginx or HAProxy as a reverse proxy is a great task for IPFire because you can have to many different services running behind it, have the IPS scan all the traffic and what not.

I would not recommend to host your blog on IPFire.

10

Well, it seems we unfortunately have different views on that.

I use Nginx myself as a Proxy (about 10 Services) and as a Webserver as a Jail - therefore I know pretty much exactly that even a missing or incorrect “/” placed in the ‘location’ block can have devastating Consequences.

Unlike an Nginx Jail (FreeBSD) or a VM, this may potentially allow access to the underlying IPCop ‘root’ filesystem.

I may be a little paranoid about this, but in my opinion, such a Service has no place on my Firewall.

11

Thanks again for all the aspects and arguments about this.

After evaluation all the aspects I think running nginx just as a proxy on IPFire is ok from my point of view, keeping in mind that misconfiguration of any firewall component is always something which hurts firewall security.