Setting up an Nginx Reverse Proxy with NFTables and Encrypted HTTPS on a GCNAT Network
In this article, we will discuss how to set up an Nginx reverse proxy with NFTables and encrypted HTTPS on a GCNAT network. This setup is useful for hosting websites and web applications on a home network behind a carrier-grade NAT (CG-NAT) without the ability to forward ports.
Prerequisites
- A home network behind a CG-NAT
- A Linode server with a public IP address and configured to forward traffic
- Basic knowledge of Linux and networking
Setting up the Nginx Reverse Proxy
The first step is to set up the Nginx reverse proxy on the Linode server. This will allow incoming traffic to be forwarded to the appropriate internal network resource.
sudo apt-get update
sudo apt-get install nginx
sudo rm /etc/nginx/sites-enabled/default
sudo nano /etc/nginx/sites-available/default
In the default file, add the following configuration:
server {
listen 80;
server_name example.com;
location / {
proxy_pass http://192.168.1.100:8080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote\_addr;
proxy_set_header X-Forwarded-For $proxy\_add\_x\_forwarded\_for;
proxy\_set\_header X-Forwarded-Proto $scheme;
}
}Replace example.com with the domain name of your website and 192.168.1.100:8080 with the internal IP address and port of the web server you want to forward traffic to.
Save and close the file, then restart Nginx:
sudo systemctl restart nginx
Setting up NFTables
Next, we will set up NFTables to handle incoming traffic and forward it to the Nginx reverse proxy on the Linode server.
sudo apt-get install nftables
sudo nft add table inet filter
sudo nft add chain inet filter input { type filter hook input priority 0; }
sudo nft add rule inet filter input iifname lo accept
sudo nft add chain inet filter forward { type filter hook forward priority 0; }
sudo nft add rule inet filter forward ct state established,related accept
sudo nft add rule inet filter forward iifname lo accept
sudo nft add chain inet filter output { type filter hook output priority 0; }
sudo nft add rule inet filter output oifname lo accept
These rules will allow incoming traffic on all interfaces and forward it to the Nginx reverse proxy on the Linode server.
Setting up Encrypted HTTPS
The final step is to set up encrypted HTTPS for the website. This will ensure that all traffic is encrypted and secure.
sudo apt-get install certbot
sudo certbot certonly --webroot -w /var/www/html -d example.com
Replace example.com with the domain name of your website. This will generate a certificate for your website and store it in /etc/letsencrypt/live/example.com.
Next, modify the Nginx configuration to use the generated certificate:
sudo nano /etc/nginx/sites-available/default
Add the following lines:
listen 443 ssl;
ssl\_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl\_certificate\_key /etc/letsencrypt/live/example.com/privkey.pem;
include /etc/letsencrypt/options-ssl-nginx.conf;
ssl\_dhparam /etc/letsencrypt/ssl-dhparams.pem;
Save and close the file, then restart Nginx:
sudo systemctl restart nginx
In this article, we have discussed how to set up an Nginx reverse proxy with NFTables and encrypted HTTPS on a GCNAT network. This setup allows incoming traffic to be forwarded to internal network resources and ensures that all traffic is encrypted and secure.