[[Support] Linuxserver.io - SWAG - Secure Web Application Gateway (Nginx/PHP/Certbot/Fail2ban)]

35 minutes ago, alturismo said:

pretty simple, BUT ... it wont be behind your reverse proxy, need a sep Port and will be reachable through all available addresses, ip, domains, .... so more or less like a sep port forward anyway directly

 

if you want to go through your RP somehow, its alot of tweaks and adjustments ... ssl-preread would be a way to start, but be aware its alot of read, trial and error and even may wont work as expected.

 

nginx by design is made for http traffic, the stream module is like a sep part and you wont benefit from irc.yourdomain.com to pass to the stream by default, there are "workarounds" using the upper mentioned ssl_preread_module ... like said, workarounds

 

Thanks for your input. I think I'll save myself a lot of trouble and grey hair if I just forward the port for ZNC on my router and use SWAG for http traffic applications. Thanks for the help, I would've kept hitting my head to this wall for the foreseeable future.

[[Support] Linuxserver.io - SWAG - Secure Web Application Gateway (Nginx/PHP/Certbot/Fail2ban)]

5 minutes ago, alturismo said:

 

yes, i see there is IRC and web, and i assume the sample is for the web frontend

 

I think you're right. Here on ZNC's wiki they mention using the stream module to connect with IRC, which you mentioned as well:

 

https://wiki.znc.in/Reverse_Proxy

 

I'll take a new look at this in the evening. I'm not sure if I know how to enable the stream module, though, but I'll give it a go and let you know how it went.

[[Support] Linuxserver.io - SWAG - Secure Web Application Gateway (Nginx/PHP/Certbot/Fail2ban)]

10 hours ago, alturismo said:

may i ask if this is a http site you try to reverse proxy or TCP traffic (what it looks like on 1st sight), if so, swag is by design for http sites to be proxied and not tcp, udp traffic ... that would need some advanced setups etc with the stream module

 

It's an IRC bouncer so it's TCP traffic, but I've seen a lot of examples of people setting it up to work using nginx. Also SWAG comes with a built-in sample config file for ZNC, so I think it should be a viable way to set it up? I'm really not an expert on this, though.

[[Support] Linuxserver.io - SWAG - Secure Web Application Gateway (Nginx/PHP/Certbot/Fail2ban)]

Could someone give me a bit of insight on this? I'm trying to set up a remote connection to my ZNC IRC bouncer using nginx, so that I can access my bouncer from work. I have ZNC running as a container on unRAID. This is what I have in my nginx config file (znc.subdomain.conf):

 

## Version 2021/05/18
# make sure that your dns has a cname set for znc

server {
    listen 443 ssl;
    listen [::]:443 ssl;

    server_name irc.*;

    include /config/nginx/ssl.conf;

    client_max_body_size 0;

    # enable for ldap auth, fill in ldap details in ldap.conf
    #include /config/nginx/ldap.conf;

    # enable for Authelia
    #include /config/nginx/authelia-server.conf;

    location / {
        # enable the next two lines for http auth
        #auth_basic "Restricted";
        #auth_basic_user_file /config/nginx/.htpasswd;

        # enable the next two lines for ldap auth
        #auth_request /auth;
        #error_page 401 =200 /ldaplogin;

        # enable for Authelia
        #include /config/nginx/authelia-location.conf;

        include /config/nginx/proxy.conf;
        include /config/nginx/resolver.conf;
        proxy_pass http://192.168.1.2:6502;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

 

My ZNC config file has the following set up for listeners, nothing else in that config file should really matter:

 

<Listener listener0>
        AllowIRC = false
        AllowWeb = true
        IPv4 = true
        IPv6 = false
        Port = 6501
        SSL = false
        URIPrefix = /
</Listener>

<Listener listener1>
        AllowIRC = true
        AllowWeb = false
        IPv4 = true
        IPv6 = false
        Port = 6502
        SSL = false
        URIPrefix = /
</Listener>

 

With this setup I keep getting the following error message on my IRC client whenever I try to connect to my subdomain using the port 443:

 

HTTP/1.1 400 Bad Request
Server: nginx
Date: Tue, 17 Aug 2021 18:36:52 GMT
Content-Type: text/html
Content-Length: 150
Connection: close
<html>
<head><title>400 Bad Request</title></head>
<body>
<center><h1>400 Bad Request</h1></center>
<hr><center>nginx</center>
</body>

 

Using the same swag container I've managed to set up remote access for my Plex server using another one of my subdomains.