# Translating an F5 rule **URL:** \ **Category:** NGINX\ **Created:** [March 19, 2013, 3:14pm UTC](https://www.ruby-forum.com/t/translating-an-f5-rule/227560 "2013-03-19T15:14:58Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [March 19, 2013, 3:14pm UTC](https://www.ruby-forum.com/t/translating-an-f5-rule/227560/1 "2013-03-19T15:14:58Z")
I am configuring Nginx to sit in front of several IIS web servers to do load balancing and SSL signing. THe IIS application is supplied by an outside vendor. I have the load balancing and SSL signing working, with one exception. The login page doesn’t work. ☹ When the vendor hosts this application, they use F5 hardware for SSP and load balancing. They gave me thisrule that they use in the F5 that I need to translate to nginx-ese: when HTTP\_REQUEST { HTTP::header remove SWSSLHDR HTTP::header insert SWSSLHDR [TCP::local\_port] } Is anyone here familiar w/ F5 hardwaare that can help translate this? – William Brown Core Hosted Application Technical Team and Messaging Team Technology Services, WNYRIC, Erie 1 BOCES (716) 821-7285 Confidentiality Notice: This electronic message and any attachments may contain confidential or privileged information, and is intended only for the individual or entity identified above as the addressee. If you are not the addressee (or the employee or agent responsible to deliver it to the addressee), or if this message has been addressed to you in error, you are hereby notified that you may not copy, forward, disclose or use any part of this message or any attachments. Please notify the sender immediately by return e-mail or telephone and delete this message from your system. ---
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [March 19, 2013, 3:44pm UTC](https://www.ruby-forum.com/t/translating-an-f5-rule/227560/2 "2013-03-19T15:44:12Z")
The code does the following: 1. remove an HTTP header named “SWSSLHDR” 2. replaces it with SWSSLHDR: port, where the port is the local port of the “current context’s TCP connection”, presumably the port that your F5 virtual server is listening on. This is presumably to separate SSL and non SSL traffic , or to allow for load balancing across websites that are hosted on ports 8080, 8000 or other nonstandard ports. One thought- are you configuring the nginx server to terminate SSL and then proxy to a single upstream endpoint? Is this the same topology as the F5 one? Is the entire site SSL or just the login portions? Peter ---
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [March 19, 2013, 4:12pm UTC](https://www.ruby-forum.com/t/translating-an-f5-rule/227560/3 "2013-03-19T16:12:16Z")
On Tue, Mar 19, 2013 at 10:43 PM, Peter B. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > The code does the following: > > 1. remove an HTTP header named “SWSSLHDR” > 2. replaces it with SWSSLHDR: port, where the port is the local port of > the “current context’s TCP connection”, presumably the port that your F5 > virtual server is listening on. “when HTTP\_REQUEST” is actually client-side, so the port in question would be the port on the backend server that it proxies to. Seems kind of strange to even pass this info along, unless somehow your backends are all listening on different ports. Whatever the case, this is what it actually means. -jf ---
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [March 19, 2013, 4:43pm UTC](https://www.ruby-forum.com/t/translating-an-f5-rule/227560/4 "2013-03-19T16:43:49Z")
Peter B. wrote on 03/19/2013 10:43:12 AM: > The code does the following: > > 1. remove an HTTP header named “SWSSLHDR” > 2. replaces it with SWSSLHDR: port, where the port is the local port of > the “current context’s TCP connection”, presumably the port that your F5 > virtual server is listening on. I had somewhat figured that out. It isn’t clear from the notes I got from vender as to what the current context is. I’m guessing the client side, but I can test that. > This is presumably to separate SSL and non SSL traffic , or to allow for > load balancing across websites that are hosted on ports 8080, 8000 or > other nonstandard ports. > > One thought- are you configuring the nginx server to terminate SSL and > then proxy to a single upstream endpoint? Is this the same topology as > the F5 one? Is the entire site SSL or just the login portions? Presently, we are using an Centos box with Piranha for load balancing, but we wish to implement SSL. There are about 50 sites hosted with three upstream servers. I don’t want to tie up 150 IP addresses for SSL on them, so I want to terminate the SSL connection at the nginx server and use HTTP on port 80 to connect from nginx to IIS. The F5 information is just what the IIS application vendor says they use in their configuration. We may be buying an F5 in the future, but I need SSL in the short term. Would I add to the location section something like this: ``` more_set_input_headers -r SWSSLHDR $server_port ``` If $server\_port isn’t correct, I could try $remote\_port. Are there any other port variables that I’ve missed? From my reading of the F5 docs, the “when HTTP\_REQUEST” indicates this is only processed on requests received from clients. Since they are always removing the SWSSLHDR from incoming requests, then adding it again, I think using the -r option is sensible and only adding it if it exists. Now I’m off to rebuild nginx with HttpHeadersMoreModule. Confidentiality Notice: This electronic message and any attachments may contain confidential or privileged information, and is intended only for the individual or entity identified above as the addressee. If you are not the addressee (or the employee or agent responsible to deliver it to the addressee), or if this message has been addressed to you in error, you are hereby notified that you may not copy, forward, disclose or use any part of this message or any attachments. Please notify the sender immediately by return e-mail or telephone and delete this message from your system. ---
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [March 19, 2013, 5:55pm UTC](https://www.ruby-forum.com/t/translating-an-f5-rule/227560/5 "2013-03-19T17:55:07Z")
You might find that you get most traction with open resty its an nginx bundle project that includes ngx\_lua, HttpHeadersMoreModule and a bunch of other mopdules that are great for transforming requests and implementing F5-like logic. I have been using it for six months and its saved me a bunch of time and helped me get weird stuff done. The openresty mailing list is very responsive. ---
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [March 20, 2013, 8:06am UTC](https://www.ruby-forum.com/t/translating-an-f5-rule/227560/6 "2013-03-20T08:06:24Z")
On Mar 19, 2013, at 19:42 , removed\_email\_address@domain.invalid wrote: > vender as to what the current context is. I’m guessing the client side, > Presently, we are using an Centos box with Piranha for load balancing, but > > ``` > more_set_input_headers -r SWSSLHDR $server_port > > ``` proxy\_set\_header SWSSLHDR $server\_port; – Igor S. > **[Professional Services | NGINX](https://www.nginx.com/services/)** > > NGINX's Professional Services team will help you take your application infrastructure to a new level of performance, scalability, and security ---
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [March 19, 2013, 7:05pm UTC](https://www.ruby-forum.com/t/translating-an-f5-rule/227560/7 "2013-03-19T19:05:52Z")
peter wrote on 03/19/2013 01:54:20 PM: > You might find that you get most traction with open resty ? its an > nginx bundle project that includes ngx\_lua, > HttpHeadersMoreModule and a bunch of other mopdules that are great > for transforming requests > and implementing F5-like logic. I have been using it for six months > and its saved me a bunch of time > and helped me get weird stuff done. The openresty mailing list is > very responsive. Thank you for the suggestion. OpenResty certainly looks like an interesting project adding lots of additional features/modules to the base nginx. My requirements are fairly limited, so I don’t need all the development features it offers. If I get stymied with the base nginx plus specific modules (ie. headers-more-nginx-module-master) then I will try OpenResty. Confidentiality Notice: This electronic message and any attachments may contain confidential or privileged information, and is intended only for the individual or entity identified above as the addressee. If you are not the addressee (or the employee or agent responsible to deliver it to the addressee), or if this message has been addressed to you in error, you are hereby notified that you may not copy, forward, disclose or use any part of this message or any attachments. Please notify the sender immediately by return e-mail or telephone and delete this message from your system. ---
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [March 21, 2013, 1:18pm UTC](https://www.ruby-forum.com/t/translating-an-f5-rule/227560/8 "2013-03-21T13:18:50Z")
> > proxy\_set\_header SWSSLHDR $server\_port; > > nice catch! But once again, because HTTP\_REQUEST is client-side, so > says this F5-certified engineer with reference to the docs, it should > be $proxy\_port instead of $server\_port. Thanks to everyone that responded to my questions. Nginx has a great community around it! It has become clear that I need to learn more about the HTTP protocol. I am starting with the O’Reilly book “HTTP The Definitive Guide”. Does anyone have other recommended reading to help my understand how HTTP operates? Confidentiality Notice: This electronic message and any attachments may contain confidential or privileged information, and is intended only for the individual or entity identified above as the addressee. If you are not the addressee (or the employee or agent responsible to deliver it to the addressee), or if this message has been addressed to you in error, you are hereby notified that you may not copy, forward, disclose or use any part of this message or any attachments. Please notify the sender immediately by return e-mail or telephone and delete this message from your system. ---
**Author:** ![unknown](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/4bbf92/32.png) [@unknown](https://www.ruby-forum.com/u/unknown)\ **Post date:** [March 20, 2013, 9:18am UTC](https://www.ruby-forum.com/t/translating-an-f5-rule/227560/9 "2013-03-20T09:18:18Z")
On Wed, Mar 20, 2013 at 3:05 PM, Igor S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > > the F5 one? Is the entire site SSL or just the login portions? > > > > Would I add to the location section something like this: > > > > ``` > > more_set_input_headers -r SWSSLHDR $server_port > > > > ``` > > proxy\_set\_header SWSSLHDR $server\_port; nice catch! But once again, because HTTP\_REQUEST is client-side, so says this F5-certified engineer with reference to the docs, it should be $proxy\_port instead of $server\_port. -jf