Having an issue with nginx reverse proxy

[Samkist]

Hi there, I'm having an issue with setting up an nginx reverse proxy for my Plan web server installation.

Everytime I attempt to connect I get a 502 (Gateway) issue.

I have followed the instructions for nginx reverse proxy to the tee, and went through the troubleshooting steps.

I even read through the entirety of this issue here: Why isn't my Nginx proxy working?

The steps myself and my partner took to debug were the following:

• Testing the webserver in its regular local ip, when alternate ip was off (server worked fine)
• I attempted to curl 10.0.0.14:8804, and there was no response. However when the proxy setup is disabled (the alternate ip for example), I am able to curl it from the reverse proxy server just fine
• I am very sure that my nginx is working, as I have a litebans setup working just fine running in tandum
• I do use cloudflare for my A records, however since my bans record is sent to the same ip and works just fine I highly doubt this to be of any significance
• I attempted to connect from the 10.0.0.14:8804 address, while the proxy system was running and it just redirects me through the proxy
• I ran nginx -t to see if there was any config errors (there was not)

http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';

    access_log  /var/log/nginx/access.log  main;

    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 4096;

    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;

    # Load modular configuration files from the /etc/nginx/conf.d directory.
    # See http://nginx.org/en/docs/ngx_core_module.html#include
    # for more information.
    include /etc/nginx/conf.d/*.conf;

    server {
        listen       443 ssl;
        listen       [::]:443 ssl;
        server_name  bans.mydomain.net;
        root         /var/www/bans.mydomain.net/;

        # Load configuration files for the default server block.
        include /etc/nginx/default.d/*.conf;

	ssl_certificate /etc/ssl/certs/mydomain.pem;
        ssl_certificate_key /etc/ssl/private/mydomain.key;

        error_page 404 /404.html;
        location = /404.html {
        }

        error_page 500 502 503 504 /50x.html;
        location = /50x.html {
        }
    }
    
    server {
        listen 80;
        server_name analytics.mydomain.net;
        return 301 https://$host%request_uri;
    }

    server {
        listen       443 ssl;
	ssl on;
        ssl_certificate /etc/ssl/certs/mycert.pem;
        ssl_certificate_key /etc/ssl/private/mykey.key;

        server_name  analytics.mydomain.net;

        location / { 
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
	    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_pass_request_headers on;
            proxy_pass http://10.0.0.14:8804;
        }
     }
}

Edit: The BungeeCord server is run on Pterodactyl. Which sits on CentOS 8, and the NGINX proxy is running on CentOS 9. It may be possible that it is an selinux issue. Once again, I don't believe it likely

A log from /var/log/nginx/error.log

2022/08/16 18:42:01 [crit] 44424#44424: *18 connect() to 10.0.0.14:8804 failed (13: Permission denied) while connecting to upstream, client: 108.162.241.41, server: analytics.mydomain.net, request: "GET /favicon.ico HTTP/1.1", upstream: "http://10.0.0.14:8804/favicon.ico", host: "analytics.mydomain.net", referrer: "https://analytics.mydomain.net/"

[Samkist]

Additionally we are proxying with cloudflare to the reverse proxy, to the Plan web server, however I doubt this to be the issue. As well, full ssl is enabled with an origin and edge certificate setup.

[AuroraLS3]

I attempted to connect from the 10.0.0.14:8804 address, while the proxy system was running and it just redirects me through the proxy

From this it sounds like Plan was reached, and as intended it tried to redirect to Alternative_IP, but that went to nginx which gave a 502 error for some reason.

This leads me to believe that the address being proxied to is somehow wrong address. Does it work if you proxy pass to local 127.0.0.1:8804?
How about the pterodactyl local network IP of the bungeecord container (172.x.x.x:8804)?

Is the nginx and pterodactyl on the same machine? If not the above advice might not work - Has the routing between the machines been set up?

If all these fail, I did find some issues related to the error 13 permission denied and selinux, so your hunch on that being the case might be correct - this might help https://stackoverflow.com/a/30952561

[Samkist]

https://stackoverflow.com/questions/25774999/nginx-stat-failed-13-permission-denied/30952561#30952561

yum install -y policycoreutils-devel
grep nginx /var/log/audit/audit.log | audit2allow -M nginx
semodule -i nginx.pp

Worked for me, thank you so much!