[HOW-TO] Configure Reverse Proxy using the QNAP Apache with SSL support

[alexsandro22]

Does anyone knows how to configurate it for Wordpress website? I was searhing this thread before but couldn't find the solution..

[oyvindo]

This is a generic solution.
It will work with any system reachable via URI/URL

Sent fra min SM-G996B via Tapatalk

[alexsandro22]

I still haven't been able to set up a proxy for Wordpress. Could it be because of the proxy server itself? I use proxybox.org. Do you know anything about it? I stumbled upon it online and decided to try it, but I still can't figure it out completely. What is the best proxy to use? I don't know much about it...

[oyvindo]

I have no knowledge of Proxybox, but after a brief look, it seems to be an IP proxy service that allows you to surf anonymously on the internet.
If so, this has nothing to do with my guide on how to set up a reverse proxy service to securely expose your own web services on the net.
Sorry, but I cannot help.

[USSBarb]

I've gone trough mayoralty of posts on this thread / topic (my personal conclusion I got lost / confused) help needed (if possible) @oyvindo

I would like to configure QNAP BUILT IN REVERSE PROXY: QNAP > Control Panel > Network & file services > Network Access > Revers Proxy (tab) … aka picture bellow
I'm visual person: so would someone be so kind and willing to explain; step by step (reverse proxy for dummies) how to configure it "right" so I can understand (why are some things as they are)?

personal choice: I would like to use built-in "reverse proxy" (because i can), and I personally do not see benefit of installing additional containers / apps (which basically are doing the same thing) as built in feature of QNAP (minus) SSL certificate. On that note: maybe we get someday support for multiple SSL certificates (natively) in QNAP (as on some other NAS models from different brands) + in-house DDNS.

[oyvindo]

This "feature" was not introduced until QTS 5.0
It doesn't exist in any 4.x version (or lower).
Because of all the other undesirable mandatory changes QNAP introduces in 5.x most owners refrain from upgrading until QNAP goes back to the drawing board and revert some of the changes forced upon us. QNAP has a very bad reputation of releasing early versions of features which are still full of bugs. If you wish to be their guinea-pig and test their new reverse-proxy feature for them, feel free. I only installed 5.0 on a test server. I would never use it on a production server.

[thechez]

Man, this seems super cool and would get around being forced to one single VPN provider because they allow port forwarding.
I have attempted to get this up and running, however I ran into issues here and there and fixed those but can't seem to get past this one.
It seems my router isn't allowing access to port 80?

[nasuser@NAS QSubSonic]$ /usr/local/apache/bin/apachectl restart
[Fri Feb 18 12:32:17.033250 2022] [so:warn] [pid 25414:tid 140279273940864] AH01574: module proxy_module is already loaded, skipping
AH00558: apache: Could not reliably determine the server's fully qualified domain name, using 10.0.5.1. Set the 'ServerName' directive globally to suppress this message
httpd not running, trying to start
(13)Permission denied: AH00072: make_sock: could not bind to address [::]:80
(13)Permission denied: AH00072: make_sock: could not bind to address 0.0.0.0:80
no listening sockets available, shutting down

[OneCD]

(13)Permission denied: AH00072: make_sock: could not bind to address 0.0.0.0:80

This typically means another service is already listening on port 80.

[thechez]

This typically means another service is already listening on port 80.

Thanks. I'm new to this so I'm trying to figure it out. How do I redirect it then? I'm assuming it's my QNAP web server already listening on port 80?

[OneCD]

Sorry, can't help there. Maybe @oyvindo can assist?

[thechez]

When I look in to what is listening on port 80 it's apache and Plex.
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
apache 4580 httpdusr 4u IPv6 41997 0t0 TCP *:www (LISTEN)
apache 5179 httpdusr 4u IPv6 41997 0t0 TCP *:www (LISTEN)
apache 13706 admin 4u IPv6 41997 0t0 TCP *:www (LISTEN)
Plex 20767 admin 58u IPv4 1416555 0t0 TCP CHEZNAS:43036->ec2-34-255-54-140.eu-west-1.compute.amazonaws.com:www (CLOSE_WAIT)
Plex 26852 admin 76u IPv4 108234 0t0 TCP CHEZNAS:41754->ec2-18-203-229-213.eu-west-1.compute.amazonaws.com:www (CLOSE_WAIT)

[VikingOy]

As @OneCD already pointed out; You cannot have more than one service listening to any specific port number.
This part of the restart message is quite normal and can be ignored:

Code: Select all

[nasuser@NAS QSubSonic]$ /usr/local/apache/bin/apachectl restart
[Fri Feb 18 12:32:17.033250 2022] [so:warn] [pid 25414:tid 140279273940864] AH01574: module proxy_module is already loaded, skipping
AH00558: apache: Could not reliably determine the server's fully qualified domain name, using 10.0.5.1. Set the 'ServerName' directive globally to suppress this message

The rest is an indication that you need to choose another port as you correctly assume, your NAS front is already using 80 and 8080
As you can see from the very first line in the guide:

Code: Select all

[EDIT - Mach 2021]I have rewritten this post completely in order to accommodate a new lesson learned: Use of Port80 for the Reverse Proxy causes conflict with other QTS Web Apps!
You need to modify the apache.conf file and add the additional port number to this file. You can choose any port number that isn’t already in use. In this tutorial I use port 81. See chapter 5 for instructions on how to edit the apache.conf file.

I hope this helps you.

[thechez]

Thanks Viking. That's what I had done was attempt to use Oyvindo's port 81 but it seems to be calling on port 80. In his initial design, he doesn't remove port 80 from the Apache file but adds port 81, which I did. This might just be a bit much for me and I might not be good enough to enable something like this.

[thechez]

This is what I have in my custom.conf file:

LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_proxy_http.so
<VirtualHost *:8081>
ServerName xxxx.com
ProxyPass / http://x.x.x.x:4040/
ProxyPassReverse / http://x.x.x.x:4040/
SSLEngine on
SSLCertificateKeyFile /share/CACHEDEV1_DATA/Certificates/38186601_xxxx.key
SSLCertificateFile /share/CACHEDEV1_DATA/Certificates/38186601_xxxx.cert
</VirtualHost>

<VirtualHost *:81>
ServerName xxxx.com
Redirect / https://xxxx.com/
</VirtualHost>

[OneCD]

I hope this helps you.

BTW: Viking, did you lose access to your previous forum account?