Multiple Wan IP Addresses, Single LAN IP Address

We are using NGINX .7.6 as a reverse proxy to an IIS webserver. We are
trying to serve our images from a separate domain and IP that proxies to
the same IIS root as the primary website. Both IP addresses are on the
same subnet. The primary domain is on and the image domain
is on

The NGINX config related to these two sites is as follows -

upstream primary_com {
server weight=10 max_fails=3 fail_timeout=30s;
server weight=1 backup;


upstream primary_com_ssl {
server weight=10 max_fails=3 fail_timeout=30s;
server weight=1 backup;


server {
     listen    80;

     access_log  /var/log/nginx/primary.access.log;

    location / {
proxy_pass  http://primary_com;



server {
     listen      443;

     access_log    /var/log/nginx/primary.ssl.access.log;

error_log /var/log/nginx/primary.ssl.error.log;

     ssl      on;
     ssl_certificate   /etc/ssl/primary/disccert.pem;
     ssl_certificate_key  /etc/ssl/primary/disckey.pem;

ssl_ciphers ALL:!ADH:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:-EXP;
ssl_protocols SSLv3 TLSv1;

     location / {
          proxy_pass  https://primary_com_ssl;


upstream images_com {
server weight=10 max_fails=3 fail_timeout=30s;
server weight=1 backup;

server {
listen 80;

   access_log      /var/log/nginx/images.access.log;

   ## Only requests to our Host are allowed
   if ($host !~ 

) {
return 444;

location ~* (\.jpg|\.png|\.gif|\.css)$ {


           if ($invalid_referer) {
                   return 444;

proxy_cache_valid 200 301 302 1480m;
expires  10d;
proxy_cache dci;
proxy_cache_use_stale  error timeout invalid_header updating;
proxy_pass     http://images_com;

When images are pulled through the images domain the rendering of the
images slows considerably. I am sure it is not related to the line
speed, latency, or dns servers. It appears there is something happening
on the proxy side either in pulling the images from the backend server
or in its attempt to respond to the outside request. Is there anything
that needs to be done in the upstream or listen section to make this
process efficient?

Posted at Nginx Forum:

Hi Folks,

We are running into a small problem with bad HTTP clients.

We have sold a bunch of hardware with embedded HTTP clients which don’t
URL-encode the parameter values. For example:

GET /a/r?did=X234 567 Y HTTP/1.1

We were using a pair of Apache servers behind a hardware load-balancer
switched our environment to front those Apache servers with a pair of
servers. We actually use those Nginx servers for a number of other web
we serve.

When we made this switch, these particular clients stopped working.
Nginx is
responding immediately after receiving the “GET” line above with “400
Request”. This is valid behavior on Nginx’s part, as according to our
understanding of the HTTP protocol, no spaces are allowed in the request

Apache is apparently rather forgiving on this front. Is there some
or configuration parameter in Nginx that would make it more forgiving of
these spaces in the request URI?

If there is not, would it be difficult for us to modify Nginx to make it
more forgiving? If so, any pointers as to where to start?

Our other options we can think of are:

  1. route HTTP traffic from these clients to Apache servers
  2. leave them dead in the water until customers complain so we can tell
    to upgrade their firmware for the fix

Thanks for any help or pointers you can offer.