Is anyone successfully running Nginx in opnsense?
Is anyone successfully running Nginx in opnsense?
I currently have Nginx Proxy Manager running through portainer in a VM on my truenas server but I’d like to have it running directly on my opnsense router.
I tried to get it running before I set it up in docker but I couldn’t manage to get the Nginx plugin working properly. Is there an Nginx plug-in available for opnsense that has the same web front end?
The same front end? Nah it has it's own menus and such. If you're familiar with the anatomy of the conf files you can piece each sub-menu within the plugin to it's corresponding section in the conf. Not everything that I need was represented. There is a way to inject custom blocks, but it's pretty cumbersome.
Honestly? I'm considering going back to a dedicated nginx host for two reasons. Firstly it's just easier to configure. Secondly, I'm sending internal traffic to the public DNS addresses for some of the services and I'm not 100% positive those fuck-heads over at Comcast aren't charging me for the hairpin route. If I had a local, internal proxy, I could avoid that.
The only reason I want it on the router is if either my vm or my server go down for whatever reason I have no access. My router is way overkill hardware wise (it’s running opnsense and Adblocking and I’ve never seen above 2%) cpu usage.
I replied to a nginx plugin question years ago on Reddit. Simple fact is, the plugin is really just designed to host a simple-ish webpage. https://www.reddit.com/r/OPNsenseFirewall/comments/klauwb/setting_up_a_web_server_on_my_opnsense_box_with/
I recommend you serve whatever you want to serving on vm's/whatever on your internal network, and then use HAProxy (Built-in) to do the forwarding via opnsense. HAProxy is a High Availability and Performance proxy and load balancer, it does what nginx proxy manager does and more.
The nice thing about vm with nginx proxy manager or just nginx running on the same host as the rest(or majority) of vms is that internal traffic doesn’t traverse other devices. This only applies if your backend services are not configured with TLS so you’re effectively terminating at proxy and run unencrypted traffic to backend. That being said chances of some packet sniffer running on your internal network between proxy and destination VM is low.
I’m in similar situation as you. I run overpowered router that barely sees any CPU usage.
I tried Nginx opnsense plug-in but looks like GUI doesn’t support proxy by header (locations are path based). I don’t want to ssh and mess with raw config files. I’m running HA proxy on opnsense router. I saw in community forums most people use that. After going through tutorial for one service it’s pretty easy to grasp configuration concept and replicate for other services. I think only one confusing option is that backends pools and rules can have backends configured and you can have only one in use when assigning rules to public service. Test syntax button ensures you don’t make mistakes. HA proxy has powerful options for backend more than you probably need. I moved router management port to higher number and setup proxy to run on 443. Then wildcard DNS entry points to router and that allows to keep adding services as needed.