I set up an Apache v2.4 reverse proxy on a CentOS 7 machine, serving requests to several vhosts; amongst these there are Atlassian application servers.
The proxy's private IP address is 10.0.0.77, its public IP address is 18.104.22.168, and several DNS A records map the public IP to various FQDN:
There is a NAT in place:
22.214.171.124:10080 -> 10.0.0.77:80 126.96.36.199:10443 -> 10.0.0.77:443
which is necessary because the proxy's public IP address is used also for other services. The setup is the same as this other question.
Here below is an example of vhost configuration (simplified),
<VirtualHost *:80> ServerName foo.example.com ProxyRequests Off ProxyPreserveHost Off SetEnv proxy-nokeepalive 1 Redirect "/" "https://foo.example.com:10443/" </VirtualHost> <VirtualHost *:443> ServerName foo.example.com ServerSignature On <Proxy *> Order deny,allow Allow from all </Proxy> SSLEngine On SSLProtocol ALL -SSLv2 -SSLv3 SSLHonorCipherOrder on # SSLCipherSuite shortened here for simplicity SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384" SSLCertificateFile /etc/httpd/ssl/proxy.crt SSLCertificateKeyFile /etc/httpd/ssl/proxy.key SSLCACertificateFile /etc/httpd/ssl/proxy.ca.crt ProxyRequests Off ProxyPreserveHost On ProxyPass "/" "http://foo.example.com:8080/" ProxyPassReverse "/" "http://foo.example.com:8080/" </VirtualHost>
This configuration works well with two Jira servers, a Stash server, a Confluence v6.10 server, and several other servers. However, the web browser fails loading a proxied Bamboo v6.4 server vhost and a Question2Answer platform.
On Firefox the reported error is
NS_ERROR_NET_TIMEOUT. On IE the error is:
There was a temporary DNS error. Try refreshing the page.
Error Code: INET_E_RESOURCE_NOT_FOUND
On the httpd access log for each failing vhost there is nothing, not even on
LogLevel trace8, so apparently the request doesn't even hit the proxy.
I can access Bamboo via curl from the proxy (a
-L flag is necessary as Bamboo serves a 302):
[root@proxy]# curl -XGET http://bamboo.example.com:8085/ [root@proxy]# curl -v -XGET http://bamboo.example.com:8085/ * About to connect() to bamboo.example.com port 8085 (#0) * Trying 10.0.0.11... * Connected to bamboo.example.com (10.0.0.11) port 8085 (#0) > GET / HTTP/1.1 > User-Agent: curl/7.29.0 > Host: bamboo.example.com:8085 > Accept: */* > < HTTP/1.1 302 Found < Server: Apache-Coyote/1.1 < X-ASEN: SEN-4619603 < X-Frame-Options: SAMEORIGIN < X-Content-Type-Options: nosniff < Vary: Accept-Encoding < Set-Cookie: JSESSIONID=E4D13B8AD7D4D172F4E5F834D1E89710; Path=/; Secure; HttpOnly < Cache-Control: no-store < Location: /userlogin!doDefault.action?os_destination=%2Fstart.action < Content-Language: en-US < Content-Length: 0 < Date: Mon, 01 Oct 2018 15:06:19 GMT < * Connection #0 to host bamboo.example.com left intact [root@proxy]# curl -L -XGET http://bamboo.example.com:8085/ <!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8" /> <title>Log in as a Bamboo user</title> <meta http-equiv="X-UA-Compatible" content="IE=EDGE" /> <meta http-equiv="Pragma" content="no-cache" /> <meta http-equiv="Expires" content="-1" /> <meta name="application-name" content="Bamboo" /> (...)
The firewall on the destination servers is open from the server to the proxy (note that Atlassian applications run on nonstandard ports, e.g. Jira serves content on TCP/8080).
I am puzzled because almost all other vhosts work flawlessly. I have also carefully checked the URL path and it is correct.
What could be the cause of this problem?
Is there a way to trace the HTTP request in a better way? I use Firefox's add-on HTTP Header Live for now and I'd like to find some more complex tool.