I have a non-encrypted service running separate to apache on 8080. I'd like to hide it and redirect all traffic to it via SSL.  I have successfully setup proxy/reverse proxy so all requests to www.example.com go to port 8080.  However, I can still directly access the service if I go to . And it goes via http, not https. I can't block that with the firewall, since the service includes some of the links in the form . I have tried adding a virtualhost on :8080 and listen on 8080 but that doesn't work (and also breaks the proxy on *:443).  Could anyone suggest what I am doing wrong? All services run on the same ip address.  &lt;VirtualHost *:80&gt;     ServerName example.com     ServerAlias www.example.com     Redirect permanent / https://www.example.com/ &lt;/VirtualHost&gt;  &lt;VirtualHost *:8080&gt;     ServerName example.com:8080     ServerAlias www.example.com:8080     Redirect permanent / https://www.swapsk.in:443/ &lt;/VirtualHost&gt;  NameVirtualHost *:443 &lt;VirtualHost *:443&gt;     ServerName example.com     ServerAlias www.example.com      ServerAdmin webmaster@localhost     DocumentRoot /var/www/html      SSLEngine on     SSLCertificateFile /root/cert.crt     SSLCertificateKeyFile /root/key.key     SSLCACertificateFile /root/ca.ca-bundle      ProxyRequests     Off     ProxyPreserveHost On     AllowEncodedSlashes NoDecode     &lt;Proxy *&gt;         Order deny,allow         Allow from all     &lt;/Proxy&gt;     ProxyPass         /phpmyadmin !     ProxyPassReverse  /phpmyadmin !     ProxyPass         /  http://localhost:8080/ nocanon     ProxyPassReverse  /  http://localhost:8080/     ProxyPassReverse  /  http://www.example.com/     RequestHeader set X-Forwarded-Proto "https"     RequestHeader set X-Forwarded-Port "443"  &lt;/VirtualHost&gt;
16372
This question is here so we can offer users who are looking for information on how to make one or more common or basic redirects in Apache using the htaccess file. All future questions pertaining to finding information that is that is covered by the question should be closed as a duplication of this question. .  Whats the point in this question? The idea while not perfect is catch the most commonly asked questions regarding redirects using the  htaccess on the Apache platform either on  some type of lamp or a live server. The type of answers should be generally those that you could imagine are used by 100,000’s of sites world-wide and are constantly asked here at Pro Webmasters repeatedly over and over in various forms.  A few examples of the type of answers we are looking for:   How can I redirect non-www to www? How can I redirect a sub domain to the main domain? How can I redirect a sub folder from domain to a root or a subdomain?  How can I redirect an old URL to a new URL?   A few examples of the types of answers that we are not looking for:   Answers that do not involve a redirect. Any answers relating to NGinx, IIS or any other non-Apache platform. Answers that involve custom and complex string or query removals.   Resources for Advanced to Complex Mod_Rewrite Rules:      Please note: that this question is still in construction and may need some refining either by myself or a real moderator of Pro Webmasters, if you have any concerns or questions .
64800
I would like terminate SSL at HAProxy, do some manipulation on the header, rewrite URL and re-encrypt traffic and send to backend servers as SSL?  I can't seem to find a way to do this. I can get regular SSL termination done, and send plain HTTP requests to backend. But I need to send SSL to backend.   I would like to have the following features:   Extract x-forwarded-for headers, to get the real client IP behind proxy. Implement session stickiness using cookie.  Do some URL rewriting.  Send SSL traffic to backend using cookie based session stickieness.    Unless I terminate SSL at haproxy end, I cannot get URL rewriting done.   Any help from the good people here would be highly appreciated.
101761
I have this configuration :  location / {     root /etc/nginx/euchet; }  location /app/ {     proxy_pass http://172.16.184.2:8080;     proxy_redirect off;     proxy_set_header Host $host;     proxy_set_header X-Real-IP $remote_addr;     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;     proxy_set_header REMOTE_ADDR $remote_addr; }   And I need to add another location with auth_basic enabled only for the request: /app/f?p=3000  I tried with rexexp:     location ~ \/appt\/f\?p=3000 {             auth_basic "Hello! Enter password";             auth_basic_user_file /etc/nginx/euchet.htpasswd;              proxy_pass http://172.16.184.2:8080;             proxy_redirect off;              proxy_set_header Host $host;             proxy_set_header X-Real-IP $remote_addr;             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;             proxy_set_header REMOTE_ADDR $remote_addr;     }   Nginx use previous location /app/.  I tried another way:  location ~* /euchet/f {      if ($arg_p = "4550") {         return 403;     }      error_page 403 = @hidden; }     location @hidden {             auth_basic "Hello! Enter password";             auth_basic_user_file /etc/nginx/euchet.htpasswd;              proxy_pass http://172.16.184.2:8080;             proxy_redirect off;              proxy_set_header Host $host;             proxy_set_header X-Real-IP $remote_addr;             proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;             proxy_set_header REMOTE_ADDR $remote_addr; }   And I get 403 error on f?p=3000, and 404 errors on f?p=&lt;another_number&gt;  How can I fix this problem?
17360
I hope that title is clear.  How do I prevent HTTPS requests for non-ssl-enabled virtual hosts from going to the first ssl-enabled virtualhost (setup is Apache-SNI).  For example, using my abbreviated config below, requests for https://example.com (a non-ssl vhost) are being served by Apache at the ssl-enabled vhost https://example.org. I'd like to disable that behavior and possibly reply with the appropriate HTTP response code (unsure of what that is).  It may not even be possible, but I thought I'd ask.  # I actually have a SNI setup, but it's not demonstrated here. # I don't think it's relevant in this situation.  NameVirtualHost *:80 NameVirtualHost *:443  &lt;VirtualHost *:80&gt;     ServerName example.org &lt;/VirtualHost&gt;  &lt;VirtualHost *:443&gt;     ServerName example.org &lt;/VirtualHost&gt;  &lt;VirtualHost *:80&gt;     ServerName example.com &lt;/VirtualHost&gt;   EDIT: Maybe a mod_rewrite rule in the first ssl-vhost?
82659
There appear to be many questions and guides out there that instruct how to setup nginx to redirect http requests to https. Many are outdated, or just flat out wrong.   # MANAGED BY PUPPET  upstream gitlab {   server unix:/home/git/gitlab/tmp/sockets/gitlab.socket; }  # setup server with or without https depending on gitlab::gitlab_ssl variable server {   listen *:80;   server_name gitlab.localdomain;   server_tokens off;   root /nowhere;   rewrite ^ https://$server_name$request_uri permanent; } server {   listen *:443 ssl default_server;   server_name gitlab.localdomain;   server_tokens off;   root /home/git/gitlab/public;    ssl                           on;   ssl_certificate               /etc/ssl/certs/ssl-cert-snakeoil.pem;   ssl_certificate_key           /etc/ssl/private/ssl-cert-snakeoil.key;   ssl_protocols                 SSLv3 TLSv1 TLSv1.1 TLSv1.2;   ssl_ciphers                   AES:HIGH:!ADH:!MDF;   ssl_prefer_server_ciphers     on;    # individual nginx logs for this gitlab vhost   access_log  /var/log/nginx/gitlab_access.log;   error_log   /var/log/nginx/gitlab_error.log;    location / {     # serve static files from defined root folder;.     # @gitlab is a named location for the upstream fallback, see below     try_files $uri $uri/index.html $uri.html @gitlab;   }    # if a file, which is not found in the root folder is requested,   # then the proxy pass the request to the upsteam (gitlab puma)   location @gitlab {     proxy_read_timeout 300; # https://github.com/gitlabhq/gitlabhq/issues/694     proxy_connect_timeout 300; # https://github.com/gitlabhq/gitlabhq/issues/694     proxy_redirect     off;      proxy_set_header   X-Forwarded-Proto $scheme;     proxy_set_header   X-Forwarded-Ssl   on;      proxy_set_header   Host              $http_host;     proxy_set_header   X-Real-IP         $remote_addr;      proxy_pass http://gitlab;   } }   I've restarted after every configuration change, and yet I still only get the 'Welcome to nginx' page when visiting http://192.168.33.10. whereas https://192.168.33.10 works perfectly.   Why will nginx still not redirect http requests to https?   I've also tried the following configurations      listen *:80;   server_name &lt;%= @fqdn %&gt;;   #root /nowhere;    #rewrite ^ https://$server_name$request_uri? permanent;    #rewrite ^ https://$server_name$request_uri permanent;   #return 301 https://$server_name$request_uri;   #return 301 http://$server_name$request_uri;   #return 301 http://192.168.33.10$request_uri;   return 301 http://$host$request_uri;   The logs   tailf /var/log/nginx/access.log 192.168.33.1 - - [22/Oct/2013:03:41:39 +0000] "GET / HTTP/1.1" 304 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Firefox/24.0" 192.168.33.1 - - [22/Oct/2013:03:44:43 +0000] "GET / HTTP/1.1" 200 133 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:24.0) Gecko/20100101 Firefox/24.0"  tailf /var/log/nginx/gitlab_error.lob 2013/10/22 02:29:14 [crit] 27226#0: *1 connect() to unix:/home/git/gitlab/tmp/sockets/gitlab.socket failed (2: No such file or directory) while connecting to upstream, client: 192.168.33.1, server: gitlab.localdomain, request: "GET / HTTP/1.1", upstream: "http://unix:/home/git/gitlab/tmp/sockets/gitlab.socket:/", host: "192.168.33.10"   Resources
112718
The Problem  Accessing my site over https (the only protocol allowed) I get the content, but none of the CSS, images etc.  Drupal is creating pages in response to https requests that include http links to these resources, but it should be using https.  What I've done  I have copied a site to a dev server. The site loads and basically works fine - I can log in etc. It's just that all the links drupal generates are http. The site I've copied it from also runs over https. The site does not exist on http (it would just get a Forbidden error). I've drush cc all.  So Apache's working - I can access the site. .htaccess is working (clean urls work, for example).  I'm using SNI to access the site because the server has other vhosts too, but I'm only accessing the site using the latest Firefox (and as it's a dev site and I'm the only dev, nobody else will use it).  I've done this dozens of times and am quite stumped! Why does Drupal not notice that the request came over https?  The fix  Turns out that .htaccess has this to say:   /* Base URL (optional).                                                          If Drupal is generating incorrect URLs on your site, which could             be in HTML headers (links to CSS and JS files) or visible links on pages     (such as in menus), uncomment the Base URL statement below (remove the       leading hash sign) and fill in the absolute URL to your Drupal installation.    Sure enough, putting $base_url = 'https://example.com'; fixed it.  But why is this necessary?
69632
My problem is really simple yet it sounds complex, but I have zero to none experience with this.  I have set up a box using gentoo which has its own semi-static WAN-IP and acts as router for my LAN. I have access to a router elsewhere on the web, which has a dynamic IP and is registered to dyndns. My plan is to redirect specific traffic from my gentoo-box to the router to make use of the tunnel and the dynamic IP.  My idea was to install a proxy on my gentoo-box which uses a VPN connection to the router as default. Every computer on the LAN and specific computers on the WAN (that have access right to the proxy) should be allowed to use this proxy, but no traffic should be forced to go through the router. Which rules out the idea of just using iptables.  Example: I want to redirect Firefox traffic through the VPN but not Opera traffic. I setup Firefox to use the local proxy, it gets the dynamic IP of the distant router, Opera still browses with my semistatic-IP.  Is this possible? Which software to use? Any further ideas?  btw: the router supports PPTP, IPSec and L2TP  Edit: If you have better ideas for the title please edit or suggest, I have no idea how to call my problem :(
80275
I use amazon EC2 instance which works via ubuntu. By default according security restrictions I can't bin my application to port 80, so I just bind it port 8080 and then set routing redirect from port 80 to 8080 via the following command:  iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to 8080   But I found that when I reboot the server this settings no longer active untill I invoke this command again.  So my question is how to enable port's redirect work even if system was rebooted?
68785
I'm trying to set up OpenVPN to listen on port 443, and then pass all HTTPS traffic to Apache, by using the port-share option. Relevant config snippets are: OpenVPN local ${PUBLIC_IP} port 443 port-share localhost 443  Apache with SSL Listen localhost:443  My OpenVPN client connects just fine, but when opening the HTTPS enabled page, I get errors. Firefox says:  SSL received a record that exceeded the maximum permissible length. (Error code: ssl_error_rx_record_too_long)  Curl says  curl: (35) error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol  The request ends up on Apache, since I see in the error logs the following messages: [Wed Oct 06 01:10:20 2010] [error] [client 127.0.0.1] Invalid method in request \x16\x03\x01 [Wed Oct 06 01:11:04 2010] [error] [client 127.0.0.1] Invalid method in request \x16\x03\x01 [Wed Oct 06 01:11:51 2010] [error] [client 127.0.0.1] Invalid method in request \x16\x03\x01  The messages entry for a HTTPS connection is Oct  6 01:13:21 ns1 openvpn[20154]: Re-using SSL/TLS context Oct  6 01:13:21 ns1 openvpn[20154]: LZO compression initialized Oct  6 01:13:21 ns1 openvpn[20154]: Control Channel MTU parms [ L:1544 D:140 EF:40 EB:0 ET:0 EL:0 ] Oct  6 01:13:21 ns1 openvpn[20154]: Data Channel MTU parms [ L:1544 D:1450 EF:44 EB:135 ET:0 EL:0 AF:3/1 ] Oct  6 01:13:21 ns1 openvpn[20154]: Local Options hash (VER=V4): 'c0103fa8' Oct  6 01:13:21 ns1 openvpn[20154]: Expected Remote Options hash (VER=V4): '69109d17' Oct  6 01:13:21 ns1 openvpn[20154]: TCP connection established with ${CLIENT_IP}:56203 Oct  6 01:13:21 ns1 openvpn[20154]: TCPv4_SERVER link local: [undef] Oct  6 01:13:21 ns1 openvpn[20154]: TCPv4_SERVER link remote: ${CLIENT_IP}:56203 Oct  6 01:13:21 ns1 openvpn[20154]: ${CLIENT_IP}:56203 Non-OpenVPN client protocol detected Oct  6 01:13:21 ns1 openvpn[20154]: TCP/UDP: Closing socket  Using httpd-2.2.3-43.el5.centos and openvpn-2.1.1-2.el5 . What should I do to make port sharing work?  Update: Using port 443 port-share localhost 10443  and Listen localhost:10443  makes no difference.  Update 2 : some command output [root@ns1 ~]# openvpn --help | grep port-share --port-share host port : When run in TCP mode, proxy incoming HTTPS sessions [root@ns1 ~]# netstat -nltp | grep 443 tcp        0      0 127.0.0.1:10443             0.0.0.0:*                   LISTEN      20088/httpd          tcp        0      0 ${PUBLIC_IP}:443             0.0.0.0:*                   LISTEN      20066/openvpn
53840
I have the following in my httpd.conf file  NameVirtualHost *:80  &lt;IfModule mod_vhost_alias.c&gt;   &lt;VirtualHost *:80&gt;     ServerAlias *     UseCanonicalName Off     LogFormat "%V %h %l %u %t \"%r\" %s %b" vcommon     CustomLog /var/log/httpd/access_log vcommon     VirtualDocumentRoot /web-data/vhosts/%0/httpdocs     VirtualScriptAlias  /web-data/vhosts/%0/httpdocs   &lt;/VirtualHost&gt; &lt;/IfModule&gt;   This works great for dynamic hosting. However, I can't figure out how to make https requests work the same way. What do I need to add to this so that https and http for the same domain request get sent to the same folder?
20660
I have a server that acts as a front-end for a cPanel mailserver in a network. The apache proxy on the front-end server ran for 152 days without fault then suddenly I now get 500/502 errors when using it to access the webmail clients of the mailserver.  The front-end server uses a signed SSL cert, the cPanel sever is using a self signed cert. Here is the error log output from the front-end server when it first started happening:   [Tue Sep 10 18:22:52.959291 2013] [proxy:error] [pid 19531] (502)Unknown error 502: [client 173.xx.xx.xx:9558] AH01084: pass request body failed to 184.xx.xx.xx:2096 (184.xx.xx.xx), referer:   [Tue Sep 10 18:22:52.959469 2013] [proxy:error] [pid 19531] [client 173.xx.xx.xx:9558] AH00898: Error during SSL Handshake with remote server returned by /cpsess12385596/3rdparty/roundcube/, referer:    The front-end server is an EC2 instance running Apache/2.4.6 (Amazon) My VirtualHost setup for the proxy on this server is as follows:   &lt; VirtualHost *:2096>     ServerName domain.com  SSLEngine on SSLProxyEngine on SSLProxyVerify none SSLProxyCheckPeerCN off  SSLCertificateFile /x/x/x/domain.com.crt SSLCertificateKeyFile /x/x/x/domain.com.key SSLCACertificateFile /x/x/x/domain.com.cabundle  ProxyPass / https://184.xx.xx.xx:2096/ ProxyPassReverse / https://184.xx.xx.xx:2096/ ProxyPassReverseCookieDomain 184.xx.xx.xx:2096 domain.com ProxyPassReverseCookiePath / /  SetOutputFilter INFLATE;proxy-html;DEFLATE ProxyHTMLURLMap https://184.xx.xx.xx:2096 /   &lt; /VirtualHost>   As far as I can think nothing has changed on the front-end server, I didn't do an update or anything, once noticing this problem and fiddling with no success I tried a restart on both servers but it did nothing to fix this.  Any suggestions?
59079
Here is what I have got:   CentOS 5.4 (32-bit)    installed Apache httpd (Server version: Apache/2.2.11 (Unix)) mod_rewrite already presents   Question: how to redirect simple  to  not using VirtualHost defines?  PS: tried to find in later answers on SF, but doesn't find nice solution.  Thanks.
121104
In Nginx we have been trying to redirect a URL as follows:  http://example.com/some/path -&gt; http://192.168.1.24   where the user still sees the original URL in their browser. Once the user is redirected, say they click on the link to /section/index.html, we would want this to make a request that leads to the redirect  http://example.com/some/path/section/index.html -&gt; http://192.168.1.24/section/index.html   and again still preserve the original URL.  Our attempts have involved various solutions using proxies and rewrite rules, and below shows the configuration that has brought us closest to a solution (note that this is the web server configuration for the example.com web server). However, there are still two problems with this:   It does not perform the rewrite properly, in that the request URL received by the web server http://192.168.1.24 includes /some/path and therefore fails to serve the required page. When you hover on a link once a page has been served, /some/path is missing from the URL  server {     listen          80;     server_name     www.example.com;      location /some/path/ {         proxy_pass http://192.168.1.24;         proxy_redirect http://www.example.com/some/path http://192.168.1.24;         proxy_set_header Host $host;     }      location / {         index index.html;         root  /var/www/example.com/htdocs;     } }    We are looking for a solution that only involves changing the web server configuration on example.com. We are able to change the config on 192.168.1.24 (also Nginx), however we want to try and avoid this because we will need to repeat this setup for hundreds of different servers whose access is proxied through example.com.
65678
I am really struggling with this.     My host (A) is behind a proxy/firewall (PF) and needs to connect to   host H.   The proxy has HTTP/FTP/SOCK proxy configured and I have no issue to configure in web browser, wget etc.  But when I use...   ssh H //to connect my host    I have no success to pass over the proxy. It seems to try to connect directly instead of going via the PF.  I am using Ubuntu 12.10.
111232
I mean if I've got something like this:  ssh -L 9000:itc.ua:80 andy@localhost   It will open port 9000 on my local machine and when I hit http://localhost:9000 in Firefox it will forward to itc.ua:80 So far so good.  BUT what if I want to hit that opened port 9000 from a different machine? For example I've got another machine on my local network and on that other machine I'm trying to navigate with Firefox to http://&lt;IP ADDRESS OF MACHINE WITH MY SSH -L 9000 Tunnel&gt;:9000 and this fails.   Is there any way to make it work?
115735
I'm trying to test a patch for the  that involves disabling SSLv3 on my web server. In order to test this on a non-production environment first, I'm setting the SSLProtocol on a VirtualHost for a different test server. My config looks something like this:  &lt;VirtualHost *:443&gt;     SSLEngine On     SSLProtocol All -SSLv2 -SSLv3     ServerName test.mysite.com     # bunch of other stuff omitted &lt;/VirtualHost&gt;   However even after restarting apache my test site is still claimed to be vulnerable. Is this expected to work? I'm wondering if I have to set it in the global ssl config or whether there's something else subtle that's causing the setting not to take and/or work.
6673
I am new to apache2. I have an ubuntu 12.04.4 LTS machine in my home, and just installed apache2 on it. I wanted to set up a webserver running on a port other than port 80 (my router uses port 80). Here's what I did:   Changed some lines at the beginning of /etc/apache2/ports.conf from  NameVirtualHost *:80 Listen 80   to  NameVirtualHost *:8041 Listen 8041  Changed the first line of /etc/apache2/sites-available/default from  &lt;VirtualHost *:80&gt;   to  &lt;VirtualHost *:8041&gt;  Restarted apache2   My ubuntu machine has local IP address 192.168.1.133, and from any computer on my home intranet if I point a web browser to http://192.168.1.133:8041 then I get the standard apache2 "It works!" web page. I also set up my router to port forward any incoming TCP  packets on port 8041 to the ubuntu machine (still on port 8041).   Let's say my ISP has given me the IP address 123.456.78.90. If I am outside my intranet and I point a web browser to http://123.456.78.90:8041 then again it works.  However, within my intranet (on the ubuntu machine itself or on other machines on the intranet), when I point a web browser to http://123.456.78.90:8041 I get an "unable to connect" error.   Where do I go from here? I am now unclear about whether this is an issue with my apache set-up or my router. I have now unfortunately realised though that it is probably not a question about Ubuntu :-/