<HTML>
<HEAD>
<TITLE>Re: Translating an F5 rule</TITLE>
</HEAD>
<BODY>
<FONT FACE="Calibri, Verdana, Helvetica, Arial"><SPAN STYLE='font-size:11pt'><BR>
You might find that you get most traction with open resty – its an nginx bundle project that includes ngx_lua, <BR>
HttpHeadersMoreModule and a bunch of other mopdules that are great for transforming requests<BR>
and implementing F5-like logic. I have been using it for six months and its saved me a bunch of time<BR>
and helped me get weird stuff done. The openresty mailing list is very responsive.<BR>
<BR>
On 3/19/13 10:42 AM, "<a href="WBrown@e1b.org">WBrown@e1b.org</a>" <<a href="WBrown@e1b.org">WBrown@e1b.org</a>> wrote:<BR>
<BR>
</SPAN></FONT><BLOCKQUOTE><FONT FACE="Calibri, Verdana, Helvetica, Arial"><SPAN STYLE='font-size:11pt'>Peter Booth wrote on 03/19/2013 10:43:12 AM:<BR>
<BR>
> The code does the following:<BR>
><BR>
> 1. remove an HTTP header named "SWSSLHDR"<BR>
> 2. replaces it with SWSSLHDR: port, where the port is the local port of<BR>
> the "current context's TCP connection", presumably the port that your F5<BR>
> virtual server is listening on.<BR>
<BR>
I had somewhat figured that out. It isn't clear from the notes I got from<BR>
vender as to what the current context is. I'm guessing the client side,<BR>
but I can test that.<BR>
<BR>
> This is presumably to separate SSL and non SSL traffic , or to allow for<BR>
> load balancing across websites that are hosted on ports 8080, 8000 or<BR>
> other nonstandard ports.<BR>
><BR>
> One thought- are you configuring the nginx server to terminate SSL and<BR>
> then proxy to a single upstream endpoint? Is this the same topology as<BR>
> the F5 one? Is the entire site SSL or just the login portions?<BR>
<BR>
Presently, we are using an Centos box with Piranha for load balancing, but<BR>
we wish to implement SSL. There are about 50 sites hosted with three<BR>
upstream servers. I don't want to tie up 150 IP addresses for SSL on<BR>
them, so I want to terminate the SSL connection at the nginx server and<BR>
use HTTP on port 80 to connect from nginx to IIS.<BR>
<BR>
The F5 information is just what the IIS application vendor says they use<BR>
in their configuration. We may be buying an F5 in the future, but I need<BR>
SSL in the short term.<BR>
<BR>
Would I add to the location section something like this:<BR>
<BR>
more_set_input_headers -r SWSSLHDR $server_port<BR>
<BR>
If $server_port isn't correct, I could try $remote_port. Are there any<BR>
other port variables that I've missed?<BR>
<BR>
>From my reading of the F5 docs, the "when HTTP_REQUEST" indicates this is<BR>
only processed on requests received from clients. Since they are always<BR>
removing the SWSSLHDR from incoming requests, then adding it again, I<BR>
think using the -r option is sensible and only adding it if it exists.<BR>
<BR>
Now I'm off to rebuild nginx with HttpHeadersMoreModule.<BR>
<BR>
<BR>
<BR>
<BR>
Confidentiality Notice:<BR>
This electronic message and any attachments may contain confidential or<BR>
privileged information, and is intended only for the individual or entity<BR>
identified above as the addressee. If you are not the addressee (or the<BR>
employee or agent responsible to deliver it to the addressee), or if this<BR>
message has been addressed to you in error, you are hereby notified that<BR>
you may not copy, forward, disclose or use any part of this message or any<BR>
attachments. Please notify the sender immediately by return e-mail or<BR>
telephone and delete this message from your system.<BR>
<BR>
_______________________________________________<BR>
nginx mailing list<BR>
<a href="nginx@nginx.org">nginx@nginx.org</a><BR>
<a href="http://mailman.nginx.org/mailman/listinfo/nginx">http://mailman.nginx.org/mailman/listinfo/nginx</a><BR>
<BR>
</SPAN></FONT></BLOCKQUOTE>
</BODY>
</HTML>