Reverse proxy and wireshark

Server NGINX
1

Hello,

I am suddenly worrying about something simple :

I have a box that send some traffic with proxy_pass to get files from
another of my box faking the url. Hence acting as a reverse proxy.
All the connections are ssl covered.

Right.

But is the whole reverse proxy broken if one listen with wireshark to
the
traffic of that proxy server ?
Will it tell in the clear that I get the file from
https://xxx.xxx.xxx.xxx$uri ?

Any hope to prevent that ? I don’t want people to be able to know my
other
boxes ips.

My boxes are all over europe, cannot change this.

Is there an option in Nginx that would help there ?

Thanks !

Larry

Posted at Nginx Forum:

2

If you run wireshark on your main box, you will be able to see the ips
it connects to (but not the urls because of https). However they would
need to be logged into your box to run wireshark and at this point they
could just run a netstat command to find the ips it is connected to.
If you mean can the network operator find these ips? They can use tools
like netflow/sflow on their switches and routers to find these ips
(which is totally out of your control)
There’s no way to prevent this…

3

My concern is that a hacker is able to know my other ips over europe.

My host is not a problem. The real deal is the outgoing packets I don’t
want
external people to know where they are going to.

It would defeat the whole purpose of reverse proxy…

Posted at Nginx Forum:

4

any hacker will need to be inside your server or have some
administration over the network to find those ips

5

Reassuring but everywhere on the web, you can see wireshark sniffing
in/out
packet to any server.

Hence, they are not connected to the server to sniff packets.

That is why I started worrying actually !

Posted at Nginx Forum:

6

Thank you both of you,

I admit I started worrying on the basis of wrong
information/comprehension.

Now it is ok, and I can keep up my nginx config with the x-accel
variables.

Thanks again, and sincerely sorry I bothered you for such thing.

Regards,

Larry

Posted at Nginx Forum:

7

On 6 April 2013 15:27, Larry [email protected] wrote:

Reassuring but everywhere on the web, you can see wireshark sniffing in/out
packet to any server.

No you can’t.

Hence, they are not connected to the server to sniff packets.

Your conclusion is wrong as it is based on incorrect information.

That is why I started worrying actually !

I would suggest you started worrying because you don’t understand the
threat model you’re trying to mitigate. Please do some more reading
before continuing this thread.

Jonathan