# I am getting wrong response from nginx

**URL:** <https://www.ruby-forum.com/t/i-am-getting-wrong-response-from-nginx/218963>\
**Category:** NGINX\
**Created:** [April 17, 2012, 1:43pm UTC](https://www.ruby-forum.com/t/i-am-getting-wrong-response-from-nginx/218963 "2012-04-17T13:43:59Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\
**Post date:** [April 17, 2012, 1:43pm UTC](https://www.ruby-forum.com/t/i-am-getting-wrong-response-from-nginx/218963/1 "2012-04-17T13:43:59Z")

</div>

Hi

I am wondering how does nginx returns wrong content, atleast it seems  
so.  
I am terminating https addresses to nginx thru my firewall, what does  
nat  
public ips to nginx to ports 901 and 902 in this case, where nginx is  
configured to wait https connections.

So when end user hits eg address: [https://a.host.com/](https://a.host.com/), firewall does nat  
and sends it to nginx private ip port 901, and [https://b.host.com/](https://b.host.com/) goes  
to  
nginx private ip port 902.

Some config lines:  
http {  
proxy\_buffer\_size 128k;  
proxy\_buffers 4 256k;  
proxy\_busy\_buffers\_size 256k;  
client\_max\_body\_size 50M;  
# DNS resolver  
resolver 213.250.93.67;

# nginx oma http proxy cache

```
proxy_cache_path /usr/share/nginx/cache levels=1:2 

```

keys\_zone=one:10m  
max\_size=1G;  
proxy\_temp\_path /usr/share/nginx/tmp;  
proxy\_cache\_key “$scheme$host$request\_uri$args”;  
proxy\_cache\_use\_stale updating error timeout invalid\_header http\_500  
http\_502 http\_503 http\_504;

# ---- cache times ----

```
proxy_cache_valid 200 302 5m;
proxy_cache_valid 301 1h;
proxy_cache_valid any 1m;

proxy_cache one;
proxy_cache_bypass $http_pragma $http_authorization

```

$cookie\_DomAuthSessId $args;  
proxy\_no\_cache $http\_pragma $http\_authorization  
$cookie\_DomAuthSessId $args;

include mime.types;  
default\_type application/octet-stream;

gzip\_http\_version 1.1;  
gzip\_vary on;  
gzip\_min\_length 1100;  
gzip\_buffers 16 8k;  
gzip\_disable “MSIE [1-6].(?!.\*SV1)”;  
gzip\_proxied any;  
gzip\_types text/css text/plain application/atom+xml  
application/x-javascript application/xml text/javascript  
application/xml+rss;  
gzip on;

server\_tokens off;  
client\_header\_timeout 3m;  
send\_timeout 3m;  
client\_header\_buffer\_size 8k;  
large\_client\_header\_buffers 4 8k;  
output\_buffers 1 32k;  
postpone\_output 1460;  
sendfile on;  
tcp\_nopush on;  
tcp\_nodelay on;  
keepalive\_timeout 75 20;  
server\_names\_hash\_bucket\_size 256; # this seems to be required for  
some  
vh

log\_format main '$remote\_addr - $remote\_user [$time\_local] $request  
’  
'“$status” $body\_bytes\_sent “$http\_referer” ’  
‘“$http\_user\_agent” “$http\_x\_forwarded\_for”’;

proxy\_redirect off;  
proxy\_set\_header Host $host;  
proxy\_set\_header X-Real-IP $remote\_addr;  
proxy\_set\_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for;  
proxy\_connect\_timeout 120;  
proxy\_send\_timeout 120;  
proxy\_read\_timeout 120;

proxy\_set\_header Accept-Encoding “”;  
proxy\_pass\_header Set-Cookie;

# ---- geoip -----

geo $country {  
default no;  
include conf.d/geo.data;  
}

```
# catchall
server {
    listen 80 default;
    server_name _;

    access_log /var/log/nginx/default-access.log main;

    server_name_in_redirect off;

    location / {
        index index.html;
        root /var/www/default/htdocs;
    }

```

}

include /etc/nginx/virtual-hosts/\*;

}

then here is config file for [a.host.com](http://a.host.com), file:  
/etc/nginx/virtual-hosts/a.host.com

server {  
listen 81.x.y.x:901;  
ssl on;  
ssl\_certificate /etc/nginx/ssl/a.crt;  
ssl\_certificate\_key /etc/nginx/ssl/a.key;  
ssl\_session\_timeout 5m;  
ssl\_protocols SSLv3 TLSv1;  
ssl\_ciphers RC4:HIGH:!aNULL:!MD5;  
ssl\_prefer\_server\_ciphers on;

# HTTP Strict Transport Security

add\_header Strict-Transport-Security max-age=500;

proxy\_connect\_timeout 300;  
proxy\_send\_timeout 300;  
proxy\_read\_timeout 300;

server\_name [a.host.com](http://a.host.com) [atest.host.com](http://atest.host.com);  
access\_log /logfiles/a.host.com/a.host.com-access\_log combined;  
default\_type text/html;  
root /usr/share/nginx/huolto;

location / {  
proxy\_cache off;  
proxy\_cache\_valid 200 302 0;  
proxy\_cache\_valid 301 0;  
proxy\_cache\_valid any 0;  
proxy\_set\_header ClientProtocol HTTPS;  
proxy\_set\_header Accept-Encoding “”;  
proxy\_pass [http://1.1.1.131](http://1.1.1.131);

```
  # Huoltoikkuna (manuaalinen)
  include /etc/nginx/maintenance.conf;

```

}  
}

then file: /etc/nginx/virtual-hosts/b.host.com

server {  
listen 81.x.y.x:902;  
ssl on;  
ssl\_certificate /etc/nginx/ssl/b.crt;  
ssl\_certificate\_key /etc/nginx/ssl/b.key;  
ssl\_session\_timeout 5m;  
ssl\_protocols SSLv3 TLSv1;  
ssl\_ciphers RC4:HIGH:!aNULL:!MD5;  
ssl\_prefer\_server\_ciphers on;

proxy\_cache\_use\_stale off;

# HTTP Strict Transport Security

add\_header Strict-Transport-Security max-age=500;

proxy\_connect\_timeout 300;  
proxy\_send\_timeout 300;  
proxy\_read\_timeout 300;

server\_name [b.host.com](http://b.host.com) [btest.host.com](http://btest.host.com);  
access\_log /logfiles/b.host.com/b.host.com-access\_log combined;  
default\_type text/html;  
root /usr/share/nginx/huolto;

location / {  
proxy\_cache off;  
proxy\_cache\_valid 200 302 0;  
proxy\_cache\_valid 301 0;  
proxy\_cache\_valid any 0;  
proxy\_set\_header ClientProtocol HTTPS;  
proxy\_set\_header Accept-Encoding “”;  
proxy\_pass [http://1.1.1.131](http://1.1.1.131);

}  
}

I have also a wildcard ssl cert, file  
/etc/nginx/virtual-hosts/wildcard.host.com:  
ssl\_certificate /etc/nginx/ssl/wildcard.crt;  
ssl\_certificate\_key /etc/nginx/ssl/wildcard.key;  
ssl\_session\_timeout 5m;  
ssl\_protocols SSLv3 TLSv1;  
ssl\_ciphers RC4:HIGH:!aNULL:!MD5;  
ssl\_prefer\_server\_ciphers on;  
ssl\_session\_cache shared:SSL:20m;  
server {  
listen 443 default ssl;  
ssl on;  
server\_name my.default.hostname;  
access\_log  
/logfiles/my.default.hostname/my.default.hostname-access\_log combined;

```
    # HTTP Strict Transport Security
    add_header Strict-Transport-Security max-age=500;

```

location / {

```
  proxy_cache off;
  proxy_cache_valid 200 302 0;
  proxy_cache_valid 301 0;
  proxy_cache_valid any 0;

  proxy_pass http://1.2.3.4;

  # Huoltoikkuna (manuaalinen)
  include /etc/nginx/maintenance.conf;

```

}  
}

Now when i do go to address [https://b.host.com/](https://b.host.com/), i am getting response  
from [a.host.com](http://a.host.com).

I am pretty if correct Host header goes to 1.1.1.131 server, it should  
return different content, i have tested it manually using curl, eg:  
" curl --verbose --header ‘Host: [b.host.com](http://b.host.com)’ [http://1.1.1.131](http://1.1.1.131)" from  
nginx  
machine, i will get correct content, but not thru nginx.  
So i am assuming that somehow i am getting wrong content from [a.host.com](http://a.host.com)  
or does nginx somehow leave Host header off?

Notice that i have same proxy\_pass in both [a.host.com](http://a.host.com) and in [b.host.com](http://b.host.com),  
they resides on same ip and same port (named virtual hosts).  
What i am debugged, i can see it goes to [b.host.com](http://b.host.com) config block,  
atleast  
nginx writes to /logfiles/b.host.com/b.host.com-access\_log when i do  
test  
it.

Pekka Panula | Jatkuvat palvelut | Sofor Oy | [www.sofor.fi](http://www.sofor.fi)  
Takakaarre 3 | PL 51 |FIN-62201 KAUHAVA | tel. +358 6 432 3111 | fax.  
+358  
6 432 3555  
Mob. + 358 50 384 3232 | removed\_email\_address@domain.invalid

---

<div class="post-metadata">

**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\
**Post date:** [April 17, 2012, 2:30pm UTC](https://www.ruby-forum.com/t/i-am-getting-wrong-response-from-nginx/218963/2 "2012-04-17T14:30:01Z")

</div>

> By default nginx uses the name you wrote in a proxy\_pass directive  
> for the Host header. You probably want to use
> 
> ```
> proxy_set_header Host $host;
> 
> ```
> 
> or something similar in the locations above.
> 
> […]
> 
> Maxim D.

Hi, look again, i do have a proxy\_set\_header line in my http block. It  
should inherit it to server blocks, afaik?

Pekka Panula | Jatkuvat palvelut | Sofor Oy | [www.sofor.fi](http://www.sofor.fi)  
Takakaarre 3 | PL 51 |FIN-62201 KAUHAVA | tel. +358 6 432 3111 | fax.  
+358  
6 432 3555  
Mob. + 358 50 384 3232 | [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\
**Post date:** [April 17, 2012, 2:18pm UTC](https://www.ruby-forum.com/t/i-am-getting-wrong-response-from-nginx/218963/3 "2012-04-17T14:18:49Z")

</div>

Hello!

On Tue, Apr 17, 2012 at 02:43:27PM +0300, [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> I am wondering how does nginx returns wrong content, atleast it seems so.  
> I am terminating https addresses to nginx thru my firewall, what does nat  
> public ips to nginx to ports 901 and 902 in this case, where nginx is  
> configured to wait https connections.
> 
> So when end user hits eg address: [https://a.host.com/](https://a.host.com/), firewall does nat  
> and sends it to nginx private ip port 901, and [https://b.host.com/](https://b.host.com/) goes to  
> nginx private ip port 902.

[…]

> server {  
> listen 81.x.y.x:901;

[…]

> server\_name [a.host.com](http://a.host.com) [atest.host.com](http://atest.host.com);

[…]

> location / {  
> proxy\_cache off;  
> proxy\_cache\_valid 200 302 0;  
> proxy\_cache\_valid 301 0;  
> proxy\_cache\_valid any 0;  
> proxy\_set\_header ClientProtocol HTTPS;  
> proxy\_set\_header Accept-Encoding “”;  
> proxy\_pass [http://1.1.1.131](http://1.1.1.131);

This will result in a request with “Host: 1.1.1.131” to a backend  
server, see [Module ngx\_http\_proxy\_module](http://nginx.org/r/proxy_set_header).

[…]

> server {  
> listen 81.x.y.x:902;

[…]

> server\_name [b.host.com](http://b.host.com) [btest.host.com](http://btest.host.com);

[…]

> location / {  
> proxy\_cache off;  
> proxy\_cache\_valid 200 302 0;  
> proxy\_cache\_valid 301 0;  
> proxy\_cache\_valid any 0;  
> proxy\_set\_header ClientProtocol HTTPS;  
> proxy\_set\_header Accept-Encoding “”;  
> proxy\_pass [http://1.1.1.131](http://1.1.1.131);

Same here.

[…]

> Now when i do go to address [https://b.host.com/](https://b.host.com/), i am getting response  
> from [a.host.com](http://a.host.com).
> 
> I am pretty if correct Host header goes to 1.1.1.131 server, it should  
> return different content, i have tested it manually using curl, eg:  
> " curl --verbose --header ‘Host: [b.host.com](http://b.host.com)’ [http://1.1.1.131](http://1.1.1.131)" from nginx  
> machine, i will get correct content, but not thru nginx.  
> So i am assuming that somehow i am getting wrong content from [a.host.com](http://a.host.com)  
> or does nginx somehow leave Host header off?

By default nginx uses the name you wrote in a proxy\_pass directive  
for the Host header. You probably want to use

```
proxy_set_header Host $host;

```

or something similar in the locations above.

[…]

Maxim D.

---

<div class="post-metadata">

**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\
**Post date:** [April 17, 2012, 2:43pm UTC](https://www.ruby-forum.com/t/i-am-getting-wrong-response-from-nginx/218963/4 "2012-04-17T14:43:44Z")

</div>

Hello!

On Tue, Apr 17, 2012 at 03:29:26PM +0300, [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Hi, look again, i do have a proxy\_set\_header line in my http block. It  
> should inherit it to server blocks, afaik?

No.

Quote from [Alphabetical index of directives](http://nginx.org/r/proxy_set_header:)

```
These directives are inherited from the previous level if and only
if there are no proxy_set_header directives defined on the current
level.

```

Maxim D.

---

<div class="post-metadata">

**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\
**Post date:** [April 17, 2012, 2:51pm UTC](https://www.ruby-forum.com/t/i-am-getting-wrong-response-from-nginx/218963/5 "2012-04-17T14:51:10Z")

</div>

> > Hi, look again, i do have a proxy\_set\_header line in my http block. It

> Maxim D.  
> Hi, that was my problem! Thx man, you saved my day.  
> Now my configuration does do what it suppose todo.

Pekka Panula | Jatkuvat palvelut | Sofor Oy | [www.sofor.fi](http://www.sofor.fi)  
Takakaarre 3 | PL 51 |FIN-62201 KAUHAVA | tel. +358 6 432 3111 | fax.  
+358  
6 432 3555  
Mob. + 358 50 384 3232 | [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)