Hey, everyone.
And welcome back.
Now in today's video, we will look into how we can implement our reverse proxy in Nginx using the proxy
pass directive.
So at a high level overview proxy pass directive forwards the request to the proxy server specified
along with this specific directive.
For example, under the location, you specify proxy pass followed by the IP address where the request
should be transferred.
So now what will happen is whenever a request is received at the Nginx level using this proxy pass directive,
it will transfer it to a backend server with the IP address of 1921638 10.50 similar to what you see
in the diagram.
And then based on the response that the Nginx receives, it will forward the response back to the client.
Now you can also have a lot of flexibility related to the proxy pass directive here.
For example, for the location of slash admin, you can have a different set of servers for a location.
Maybe of route.
You can have a different set of servers.
For example, if anyone visits the admin page in the website, he will automatically be redirected to
a server with the IP of 1050, 30, 20.
However, any other page other than the admin will be redirected to another server.
1921681 10.50.
So various kind of rules can be set up depending upon your requirements.
So let's go ahead and quickly try it out.
So for today's video, I have launched two additional servers.
First server is where our Nginx is already running.
Second server is the application server.
So this is just a name that I've given and the third server is basically the authentication server.
Now in all of the servers I have basically gone ahead and I have installed the Nginx we have already
discussed on how we can install Nginx.
So this is one of the steps that I have completed in all of the servers here.
So currently I am in the CLI and I have three tabs.
First tab is associated with our base Nginx installation.
So this demo Nginx, we will consider it as a reverse proxy.
Second is the application server, third is the authentication server.
So first what we will do.
Let's take a simple example of using a proxy pass directive where all the requests that Nginx receives
it will forward it to a backend server.
So in our case demo hyphen Nginx is basically will act as a reverse proxy here.
So what I'll do from any of the servers under the e.t.c nginx conf.d directory, let's take a default
dot conf data.
Let's copy the base example here and let me quickly paste it within my atom editor document.
So within here, let's go ahead.
And one thing that we were discussing is that a proxy pass goes ahead and sits inside the location.
So let's go ahead and remove the default entries here and what I'll specify.
I'll specify proxy, underscore, pass, followed by the IP address of the backend server.
Now I have three servers that are available.
So first I'll go ahead and specify the IP address of the application server here.
Now you can either specify public IP address just for ease of use, or you can also specify private
IP address.
Generally in the corporate environment, public IP address will not be present for any of the servers,
so you'll typically be using the private IP.
Now since I'm using digital ocean environment, if I'll quickly do a ifconfig, you'll see that the
digital ocean droplet has two interfaces.
First one is the zero, which is associated with a public interface.
Second one is the one which is associated with the private IP.
So now what will happen is if you want to communicate between this first server and the application
server publicly, you go ahead and specify the public IP specified with the zero interface.
If you want the communication to happen privately, then you will have to specify the IP address associated
with the one interface.
Now, again, if you're using a different cloud provider altogether, then the settings might change.
But just understanding the concept is something that is important.
So let's go ahead and find out the IP address associated with the application server so the Ifconfig
command is not found.
Let's quickly do a yum.
Why install net tools so that our ifconfig package is also installed and let's also do the same in the
authentication server.
Great.
So now I'll do a ifconfig and you will see for our application server.
This is the private IP, so I'll copy this private IP and let me paste it over here.
All right, so this is how the configuration looks like.
We also have to add one more block here.
All right, So what I'll do, I'll copy this.
And in a reverse proxy server.
Let's go to Etsy Nginx.conf and I'll do LS.
And currently there are some conf files that are available.
Let's go ahead and remove the conf extension here so that they are not really loaded by nginx.
All right, so now both of them has a back extension, so none of these will be loaded and we'll create
a new file, let's call it as proxy dot conf and I'll paste the contents here once.
Then let's go ahead and save this.
We'll quickly do a nginx hyphen t to verify and I'll do a systemctl restart nginx over here.
All right.
Now before we go ahead and test things out, one more important thing.
Let's copy the public IP of our application server.
I'll paste it in the browser and currently this has a default ingenix page.
So within the application server, let's go ahead and change this.
I'll say usr share nginx.
HTML and what I'll do I'll quickly do an echo.
This is application server backend.
All right, and I'll paste it to the index.html.
And if we refresh the page you should see our custom message now.
So what we'll do, we'll go ahead and send the request to the Nginx reverse proxy.
If our proxy pass directive is working as expected, it should go ahead and connect to the backend server
and retrieve this specific message.
Now from our base Nginx server, let's quickly do a curl on the localhost and currently it is showing
us the 502 bad gateway.
Let's also try it out from the browser.
I'll paste the IP address of our reverse proxy server and it is showing us bad gateway.
All right, so now let's look into why exactly this error is coming.
So generally in production environment, this is one of the common errors that you will see and you
will need to also troubleshoot those errors.
So let's quickly look into the troubleshooting steps.
So first thing that you need to do is you have to go to var log Nginx and here you should see that there
are two files.
These are two very important files.
One is the access log and second is the error log.
So let's quickly do a tale on the access log here.
Now within the access log here, you can determine that a new request was sent from this specific IP
address.
And it is also showing you the response, which is 502, which is nothing but the 502 bad gateway.
So access log is not really giving us much information related to what might happen.
So now the second important file is the error log.
So let's do a tail f on error log.
And interesting this time you are seeing some permission denied message if you see it is critical.
So generally the notice based messages you can avoid.
But generally the message is related to critical or very important.
That means something is not really working.
So let's explore on what might happen.
So here it is saying permission denied while connecting to upstream.
So it is not really able to connect to the upstream server here.
Now there are two important things that you will have to check.
First, you'll have to also verify the access log in the back end server where the request should be
received.
So let's do a tail f on var log nginx access dot log.
So this is our application server and let's verify if the request is actually received here or not.
So let's quickly do a curl localhost here.
As expected, we are seeing a bad gateway and if you see here the request is not even reaching the back
end server.
So something is wrong at a reverse proxy level itself.
Now whenever you see a permission denied, one of the things that you will have to identify again for
this, you might need a Linux skills as well.
So if you do a get enforce over here, you should see that the Linux is in the enforcing mode.
And if you're running Linux in the enforcing mode at one moment of time, things will get messed up.
So either you know on how to write a effective Linux rule or either you go ahead and disable SELinux.
So let's go ahead and temporarily disable Linux.
So I'll say set enforce zero.
All right, So now if you do a get enforce, you'll see it changed from enforcing to permissive.
So this we are doing at a reverse proxy level.
And now let's do a curl on localhost.
And you see our website is working perfectly well.
So if you'll have to verify from the browser, refresh the page and things are working perfectly well.
So generally whenever you see error related to your.
Configuration in Linux, it might not really mean that your actual configuration is wrong.
It can happen due to a SELinux issue as we were discussing.
It can happen due to permission issues.
There can be a lot of factors that might be involved, but generally in new servers you will primarily
see only two major issues.
Either Linux is breaking things or either it is a permission issue for the files that are present.
All right.
So I hope at this stage you understood the basics of what proxy pass directive allows you to do.
Now let's also go ahead and explore a few more examples here.
So in this approach, you have a location of root which is going to one server and the location of admin,
which is going to a specific server.
So now what we'll do the location admin, we want that all the requests related to slash admin should
go to authentication server only, it should not really go to application server.
So let's look into how we can achieve that.
So first within the authentication server, let's go to user share Nginx.
HTML and within the index.html, let's change it.
I'll say this is authentication server, all right?
And I'll send a message to index.html.
So now if I'll copy the IP address of the authentication server, let me paste it here.
And as expected it is stating this is authentication server.
So now let's also add one more location directive here.
Let's specify admin and this time just for simplicity we'll be pasting the public IP.
So let's copy the public IP and I'll add it over here.
All right, so this is our location block.
Things seems to be working.
I'll copy this up.
And within the Nginx reverse proxy, let's verify which directory we are in.
All right, So let's quickly go to etcd Nginx conf.d and our proxy dot conf let's open this up and here
we'll go ahead and add our own snippet.
All right.
Thing seems to be good.
I'll go ahead and save this.
Let's do a nginx hyphen t thing seems to be successful.
I'll do a systemctl restart nginx.
All right.
And now if I do a curl on localhost slash admin immediately.
Here you see it is showing 404 not found.
So now let's look into the troubleshooting step.
First thing specifically for the proxy pass directive related architecture.
What you can do, You can first verify if the request is actually receiving at a backend server or not.
So let's go ahead and verify.
I'll say tail f, var log nginx access dot log.
Now within here you should see that there is one specific entry and this entry has been received by
a curl client and the response to it is 404.
So if you want to quickly verify, let's make a request yet again.
And if we look into the backend server, this request is being received.
So at this stage you can determine that this is not really an issue, maybe at a reverse proxy level,
but it is a issue at a backend level because the request is being received at a backend site and the
backend is basically sending the 404 back to the reverse proxy server and reverse proxy server will
send the same 404 back to the client.
So this 404 is actually coming from the backend server.
Now why is 404 coming from the backend server?
Let's quickly identify.
So if you see this request is going at slash admin.
Now if I do a PWD, which we are in user share nginx.
HTML.
And if I do an ls, you only have an index dot HTML and 50X dot HTML.
You do not really have anything related to admin.
So what you need to do is you have to create a new directory of admin over here.
All right, so this directory matches this specific Uri.
And within this directory let's go ahead and create one more index HTML file.
I'll say this is auth server file under admin and I'll save it to index dot HTML.
All right.
And now let's do one thing.
Let's make a curl request on admin index dot HTML this time and you see it is stating this is auth server
file under admin.
Great.
So I hope with this you understood the basics of proxy pass directive.
We basically took two different examples.
We also looked into the troubleshooting aspect so that it gives us a better clarity.
So with this we'll conclude today's video.