# No basic auth from outside network

**URL:** <https://www.ruby-forum.com/t/no-basic-auth-from-outside-network/219886>\
**Category:** NGINX\
**Created:** [May 21, 2012, 12:32am UTC](https://www.ruby-forum.com/t/no-basic-auth-from-outside-network/219886 "2012-05-21T00:32:14Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![dubstep](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/cdc98d/32.png) [@dubstep](https://www.ruby-forum.com/u/dubstep)\
**Post date:** [May 21, 2012, 12:32am UTC](https://www.ruby-forum.com/t/no-basic-auth-from-outside-network/219886/1 "2012-05-21T00:32:14Z")

</div>

Hi - first post here… I’ve built an nginx server with SSL and basic  
auth. Basic auth works great from within my network but when I try to  
come in from outside (via port forwarding on my router) my http pages  
work fine, but the protected pages with SSL just hang.

I’m thinking of 2 possibilities:

1. I’ve messed up something in my nginx.conf, or
2. I’m blocking a port that’s needed other than 80 or 443.

Any ideas?

Thanks,

Mike

Posted at Nginx Forum:

> **[no basic auth from outside network](https://forum.nginx.org/read.php?2,226665,226665#msg-226665)**
>
> Hi - first post here.. I've built an nginx server with SSL and basic auth. Basic auth works great from within my network but when I try to come in from outside (via port forwarding on my router) my http pages work fine, but the protected pages with...

---

<div class="post-metadata">

**Author:** ![rattus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/3e96dc/32.png) [@rattus](https://www.ruby-forum.com/u/rattus)\
**Post date:** [May 21, 2012, 12:59am UTC](https://www.ruby-forum.com/t/no-basic-auth-from-outside-network/219886/2 "2012-05-21T00:59:23Z")

</div>

After further testing, it’s not the basic auth that’s causing the  
problem… it’s simply trying to access subdirectories from outside.  
Makes me thing I’ve messed something up in my nginx.conf:

worker\_processes 1;  
events {  
worker\_connections 64;  
}  
http {  
ssl\_ciphers  
ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:AES256-GCM-SHA384:AES256-SHA256:AES256-SHA:AES128-SHA;  
ssl\_prefer\_server\_ciphers on;  
ssl\_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;  
ssl\_session\_timeout 5m;

## Timeouts

keepalive\_timeout 300 300;

## General Options

charset utf-8;  
default\_type application/octet-stream;  
ignore\_invalid\_headers on;  
types {  
text/html html;  
image/gif gif;  
image/jpeg jpg;  
}  
keepalive\_requests 20;  
max\_ranges 0;  
recursive\_error\_pages on;  
sendfile on;  
server\_tokens off;  
source\_charset utf-8;

## Request limits

limit\_req\_zone $binary\_remote\_addr zone=fred:1m rate=60r/m;

## Compression

gzip on;  
gzip\_static on;  
gzip\_vary on;

## Log Format

log\_format main ‘$remote\_addr $host $remote\_user [$time\_local]  
“$request” $status $body\_bytes\_sent “$http\_referer” “$http\_user\_agent”  
$ssl\_cipher $request\_time’;

## http .:. redirect to https

server {  
access\_log /var/log/nginx/access.log main buffer=32k;  
error\_log /var/log/nginx/error.log error;  
expires 0;  
limit\_req zone=fred burst=200 nodelay;  
listen 80;  
root /var/empty;  
rewrite ^ https://192.168.1.100$request\_uri permanent;  
}

## https .:. (www.)[example.com](http://example.com)

server {  
add\_header Cache-Control “public”;  
add\_header Strict-Transport-Security “max-age=315360000;  
includeSubdomains”;  
access\_log /var/log/nginx/access.log main buffer=32k;  
error\_log /var/log/nginx/error.log error;  
expires max;  
index index.html;  
limit\_req zone=fred burst=200 nodelay;  
listen 443;  
root /var/www/htdocs;  
server\_name 192.168.1.100;

```
 ## Basic auth on test
  location / {
  }

  location ^~ /test/ {
    index index.html;
    auth_basic "Admin Login";
    auth_basic_user_file .htpasswd;
  }

  #!!! IMPORTANT !!! We need to hide the password file from prying

```

eyes  
# This will deny access to any hidden file (beginning with a  
.period)  
location ~ /. { deny all; }

```
 ## SSL Certs
  ssl on;
  ssl_session_cache shared:SSL:10m;
  ssl_certificate /home/root/ssl/test.crt;
  ssl_certificate_key /home/root/ssl/test.key;
  ssl_ecdh_curve secp521r1;

 ## Stop Image and Document Hijacking
  location ~* (\.jpg|\.gif|\.png|example\.css)$ {
    if ($http_referer !~ ^(https://192.168.1.100) ) {
      return 404;
    }
  }

 ## All other errors get the generic error page
  error_page 400 401 402 403 404 405 406 407 408 409 410 411 412 413

```

414 415 416 417 495 496 497 500 501 502 503 504 505 506 507  
/error\_page.html;  
location /example\_error\_page.html {  
internal;  
}  
}  
}

…again, it just hangs accessing subdirectories like “test”, while  
everything works well from within the local network. The www root  
directory index.html serves up fine, even redirected to 443.

TIA,

Mike

Posted at Nginx Forum:  
[http://forum.nginx.org/read.php?2,226665,226666#msg-226666](http://forum.nginx.org/read.php?2,226665,226666#msg-226666)

---

<div class="post-metadata">

**Author:** ![rattus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/3e96dc/32.png) [@rattus](https://www.ruby-forum.com/u/rattus)\
**Post date:** [May 21, 2012, 3:31am UTC](https://www.ruby-forum.com/t/no-basic-auth-from-outside-network/219886/3 "2012-05-21T03:31:10Z")

</div>

-------- Original-Nachricht --------

> Datum: Sun, 20 May 2012 18:58:53 -0400 (EDT)  
> Von: “rattus” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
> An: [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
> Betreff: Re: no basic auth from outside network

> ssl\_ciphers  
> default\_type application/octet-stream;  
> server\_tokens off;
> 
> ## Log Format
> 
> ```
> listen 80;
> root /var/empty;
> rewrite ^ https://192.168.1.100$request_uri permanent;
> 
> ```

Are you sure you want this rewrite to go from outside (aka: Internet) to  
an internal (aka: private network) address?

> ```
> index index.html;
> index index.html;
> ## SSL Certs
> }
> 
> ```
> 
> }
> 
> …again, it just hangs accessing subdirectories like “test”, while  
> everything works well from within the local network. The www root  
> directory index.html serves up fine, even redirected to 443.

What? Are you telling that using your external IP (lets say it is  
1.2.3.4) is working properly?

This here works from external? Really?

[http://1.2.3.4/](http://1.2.3.4/) will get redirected to [https://192.168.1.100/](https://192.168.1.100/)  
[http://1.2.3.4/index.html](http://1.2.3.4/index.html) will get redirected to  
[https://192.168.1.100/index.html](https://192.168.1.100/index.html)

You know that 192.168.0.0/16 is a class c private address range that is  
not routed on the Internet?

IMHO you should rewrite your http config to:

server {  
…  
rewrite ^ https://$host$request\_uri permanent;  
…  
}

And IMHO you should change the server\_name in the https part to be:

server\_name 192.168.1.100 “”;

> [mailman.nginx.org archive](http://mailman.nginx.org/mailman/listinfo/nginx)  
> –  
> Empfehlen Sie GMX DSL Ihren Freunden und Bekannten und wir  
> belohnen Sie mit bis zu 50,- Euro! [https://freundschaftswerbung.gmx.de](https://freundschaftswerbung.gmx.de)