Nginx as a reverse proxy behind AWS ALB (self-signed)

Question

I've created an environment in AWS which includes an EC2 instance with node js web-server and Nginx installed, behind a self-signed application load balancer.

My ALB gets requests from HTTPS (443) and forwards them on HTTP (80) to the Nginx. My Nginx should get the requests from the ALB (in port 80) and forward them on port 9090 (which used by the node js web server).

However, I'm having issues with translating the requests from the Nginx to the application. When entering the URL with the ALB DNS on HTTP I'm able to get to the above page (instead of my webserver application page):

My default.conf file attached above:

All my security groups are open to test the problem (on 443, 80, 9090). so ports are not the problem, but the Nginx configuration.

Also, my target group presented above:

What could be the problem / what further configuration should I do? Thank you.

Toothpaste

Remove the server_name localhost; line. That should fix it. – Broomstick

Not worked, same "Welcome to nginx" result page – Toothpaste

Answer 1

Worked. The problem was in the "/etc/nginx/nginx.conf" file. After a lot of reading and try - I've found that inside the file it forwards to HTML (instead of my nodejs web server). Changed the line of "root /path_to_ws", restarted Nginx and it worked. Thank you for the help!

Toothpaste

Answer 2

When you have Load Balancer why you are using Nginx? its sound like you are using two Nginx server for one nodejs application. also SSL operations consume extra CPU resources. The most CPU-intensive operation is the SSL handshake.

terminating-ssl-http

The correct way to handle this which will also solve your above issue.

• Create a target group and bind with instance port 9090
• Generate certificate from AWS (it's free)
• Create an HTTPS listener and place the aws certificate
• Add the target group that we create on step 1 to the HTTPS listener of Load Balancer.

With this approach, you are terminating SSL/TLS at the Load balancer and instance will receive plain HTTP connection which will save the CPU time for SSL encryption/decryption.

SSL termination is the term pointing to proxy servers or load balancers which accepts SSL/TLS connections however do not use the same while connecting to the back end servers. E.g. A load balancer exposed to the internet might accept HTTPS at port 443 but connects to backend servers via HTTP only

For testing purpose, this should work.

server {
    listen                      80;
    server_name                 example.com;
    client_max_body_size        32M;
    underscores_in_headers  on;

    location / {
        proxy_set_header        Upgrade $http_upgrade;
        proxy_pass_header       device_id;
        proxy_set_header        Connection "upgrade";
        proxy_http_version      1.1;
        proxy_set_header        Host $host;
        proxy_read_timeout      120;
        proxy_next_upstream     error timeout invalid_header http_500;
        proxy_connect_timeout   90;
        proxy_pass              http://localhost:9090;
    }
}

Teamster

It looks like he is already doing all this, which the exception of using a ACM generated cert. – Broomstick

My point is that he do not need Nginx at all, as TLS termination is CPU intensive process and LB can handle everything that ngin can do at server level. – Teamster

Thank you for the response. I already have the environment that you described, however, I wanted to deploy thee Nginx and use it as a "second lb" just for my private practice. – Toothpaste

I see, then chagne server_name to default or keep it empty or better to set it accordingly as your DNS server_name mydomain.com www.mydomain.com; – Teamster

Did it, same "Welcome to nginx" screen. – Toothpaste

nginx (or equivalent) is required when having to use certificates that ACM does not support (like EV). Also, there are functions that nginx does, which an ALB does not implement yet, like rewrites, so it is a valid case to use ALB in front of nginx. – Handfasting