NGINX double reverse proxy – Server Fault
My config for a similar setup is a little different:
upstream app_backend {
server 127. 0. 1:3000;}
server {
listen 443 ssl 2;
listen [::]:443 ssl 2;
server_name HOSTNAME;
location / {
try_files $uri $uri/ @app;}
location @app {
#proxy_cache general_cache;
proxy_pass app_backend;
proxy__version 1. 1;
proxy_set_header Upgrade $_upgrade;
proxy_set_header Connection “upgrade”;
proxy_set_header Host $_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto;
proxy_redirect off;}}
In my case, I have everything on one node, but adapting to your case should be a simple matter of creating similar blocks
You are also overriding the X-Real-IP on, which I am not sure you want to be doing.
Edited to account for update in comments:
Right – I just realised I missed something (or failed to account for it), which sort of relates to the X-Real-IP thing.
I think you may have an issue in part because on, you have:
proxy_set_header Host $host;
And on, $host =
So you are sending a request to (from gateway), that has a Host: header of
Your vhost on srv1 is configured to respond to a Host header of – and so your vhost config is not being used.
The 404 is most likely coming from the default port 80 server of srv1.
One way of fixing this could be:
proxy_set_header Host $proxy_host;
Which also happens to be the default value of the Host field (per).
This should be simple enough to test: configure logging for to go to some other destination than the default nginx log files.
Then check whether the next request you make shows up in your ‘custom’ log, or the default one.
The issue with X-Real-IP is that on, $remote_addr is meaningful, but on, $remote_addr is the internal address of
Nginx – Reverse proxy to an already reverse proxied location …
I am using nginx on centos 7.
I am reverse proxying a remote nodejs server on the same LAN to the nginx root / as per the below:
location / {
proxy_pass proxy_set_header Upgrade $_upgrade;
proxy_set_header Connection ‘upgrade’;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;}
This works fine for serving my website – all external requests on port 80 are rewritten to use which has been configured in nginx e. g nginx forwards any incoming requests to and deals with rewrites and forwarding so that the nodejs content is served over ssl even though ssl hasn’t been configured within the node application.
e. g my site can be accessed at
I now want to reverse proxy another nodejs app so that it appears at a location which is prefixed with e. g:
I’ve tried using the below config for the second node server…
location /node2/ {
When I load the url, the html of the root page of the second node server is displayed but none of the css, js or images are loaded so the page doesn’t look or work as it should and I see the following in the browser console…
Mixed Content: The page at ” was loaded
over HTTPS, but requested an insecure image
”. This content
should also be served over HTTPS.
and
Failed to load resource: net::ERR_CONNECTION_CLOSED
for css and js assets… so it seems that no redirection is taking place for assets and also any links on the html page do not show the /node2/ suffix when hovered over or when clicked as the page tries to load the resource from instead of
Is it possible to actually do what I want in terms of reverse proxy two locations and can anyone point me in the right direction on how I can get this work as need?
How do I setup an Apache double reverse proxy? – Super User
Just to make life difficult – I’m trying to setup a double reverse proxy:
WWW > Router > Apache Reverse Proxy #1 (443) > Apache Reverse Proxy (443) #2 > Docker Container (Which runs on same machine as #2)
Both reverse proxies have FQDNs. I’m trying to use Virtual Hosts but clearly don’t understand how to set up the proxy.
The main domain is (hosted on Apache #1), and subdomain (hosted on Apache #2).
On Apache #1 I have to Virtual Hosts setup ( and). The virtual host file for appears like this:
ServerName
UseCanonicalName off
DirectoryIndex /
DocumentRoot /usr/local/www/office……..
# keep the host
ProxyPreserveHost On
ProxyPass / ProxyPassReverse /……..
My DNS records are at Cloudflare and both and resolve to the same external IP address. The pfSense router however has a DNS Override that reassigns to an internal LAN address
On Apache #2 my virtual host file appears as the following:
DocumentRoot “/var/www/”
DirectoryIndex /……
# static html, js, images, etc. served from loolwsd
# loleaflet is the client part of LibreOffice Online
ProxyPass /loleaflet retry=0
ProxyPassReverse /loleaflet……
I left out the SSL encryption items as SSL transport is involved from Web to Apache #1 and SSL encryption from Apache #1 to Apache #2. SSL terminates at the 2nd proxy.
From the outside I can reach which correctly displays the file located at Document Root on Apache #2.
However any other link I can’t resolve. I get a 500 error if I try: or.
I think I’m missing something with the reverse proxy requests.
Frequently Asked Questions about double reverse proxy
What is the meaning of proxy reversal?
In computer networks, a reverse proxy is a type of proxy server that retrieves resources on behalf of a client from one or more servers. These resources are then returned to the client, appearing as if they originated from the reverse proxy server itself. It is mainly used to balance load.
What is the use of reverse proxy?
A reverse proxy server is an intermediate connection point positioned at a network’s edge. It receives initial HTTP connection requests, acting like the actual endpoint. Essentially your network’s traffic cop, the reverse proxy serves as a gateway between users and your application origin server.
What is reverse proxy vs proxy?
A traditional forward proxy server allows multiple clients to route traffic to an external network. For instance, a business may have a proxy that routes and filters employee traffic to the public Internet. A reverse proxy, on the other hand, routes traffic on behalf of multiple servers.Mar 31, 2021
