However, NPM (Nginx Proxy Manager) currently does not support Load Balancing configuration. But, for basic proxying use cases, this is more than enough! So, let’s jump on to it, shall we?

TLDR Guide

1. Install docker-ce and docker-compose
2. Create new folder npm or nginxproxymanager or anything else.
3. Save these lines as docker-compose.yaml in the folder

version: '3'
services:
  app:
    image: 'jc21/nginx-proxy-manager:latest'
    restart: unless-stopped
    ports:
      - '80:80'
      - '81:81'
      - '443:443'
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt

4. Run the stack

docker-compose up -d

5. Access the admin UI via http://YOUR-IP:81 . Remember, it’s PORT 81.
6. Default credentials

Email:    admin@example.com
Password: changeme

7. Change the default login.
8. Enjoy!

Prerequisites

1. Port 80, 81, and 443 are allowed on Firewall and Security Profile.
2. A domain name, at least.

Installation Steps

This installation guide would be OS-agnostic as this will run on any system with docker installed.

Assuming that docker-ce and docker-compose has been installed on your server. (Otherwise, check out this article and see only the docker installation part)

First, create a docker network with any name you wish:

docker network create proxy_network

Create a folder wherever you like and give it a name:

mkdir /opt/nginx_proxy
cd /opt/nginx_proxy

Then, save the following configuration as docker-compose.yaml :

version: '3'
services:
  app:
    image: 'jc21/nginx-proxy-manager:latest'
    restart: unless-stopped
    ports:
      - '80:80'
      - '81:81'
      - '443:443'
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt

networks:
  default:
    external:
      name: proxy_network

It’s a very basic configuration that will use SQLite as the database. So, if you wish to use MySQL/MariaDB instead, please use the following, and change the appropriate values:

version: "3"
services:
  app:
    image: 'jc21/nginx-proxy-manager:latest'
    restart: unless-stopped
    ports:
      # These ports are in format <host-port>:<container-port>
      - '80:80' # Public HTTP Port
      - '443:443' # Public HTTPS Port
      - '81:81' # Admin Web Port
      # Add any other Stream port you want to expose
      # - '21:21' # FTP
    environment:
      DB_MYSQL_HOST: "db"
      DB_MYSQL_PORT: 3306
      DB_MYSQL_USER: "npm"
      DB_MYSQL_PASSWORD: "npm"
      DB_MYSQL_NAME: "npm"
      # Uncomment this if IPv6 is not enabled on your host
      # DISABLE_IPV6: 'true'
    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt
    depends_on:
      - db

  db:
    image: 'jc21/mariadb-aria:latest'
    restart: unless-stopped
    environment:
      MYSQL_ROOT_PASSWORD: 'npm'
      MYSQL_DATABASE: 'npm'
      MYSQL_USER: 'npm'
      MYSQL_PASSWORD: 'npm'
    volumes:
      - ./data/mysql:/var/lib/mysql

Then, bring up the stack:

docker-compose up -d

Lastly, wait until the process is done.

Your NPM (Nginx Proxy Manager) should be accessible via http://YOUR_IP:81

Initial Setup

On the login page, enter the default NPM credentials as follows:

Email:    admin@example.com
Password: changeme

After successfully logging in, a dialog box will show up, and it will let you change the default credentials.

Now, NPM is ready! Yay~

Adding your first proxy host

NPM offers four types of proxy passes. Basic proxy pass called Proxy Hosts, redirection hosts, proxy streaming, and 404 hosts. This article will only cover the Proxy Hosts section, and I leave it to you to discover the rest 😉

For your very first proxy host configuration, why don’t you proxy the NPM dashboard? Accessing it directly via IP: port is ugly! Now, let’s create it!

First, ensure you already create an A record for your domain/subdomain that points to this server via your DNS manager. How to do it depends on your registrar/domain name provider.

On the dashboard, click on the Proxy Hosts button. It should show something like this:

Click Add Proxy Host. And then, fill in the required fields as follows:

The proxy host is on the same machine, so I prefer to put its private IP. Putting the public IP will work too. Make sure the forwarded port is 81. You can also cache assets, enable WebSockets support, and block common exploits. Here, I will enable the Block Common Exploits.

Move to the SSL tab; unless you’re using Cloudflare SSL (automatically provided by default), you can use LetsEncrypt to generate a valid SSL certificate. And do not forget to enable the options you want.

If you’re using Cloudflare, do not enable Force SSL option as it will result in redirection loop.

Finally, click Save. Your Proxy Hosts page should now list your very first proxy host.

Now, the moment of truth. Try to access the URL:

Hooray, it is working.

Conclusion

That’s way too easy, right? Now, you can deploy your own Nginx Proxy Manager using docker-compose and manage your proxy hosts using a simple user interface.

For more IT knowledge, you can access it freely in ServerStadium’s knowledge base. Or, for real exciting experience, you can also sign up in ServerStadium and find out what you can do in our dashboard.

The post Reverse Proxy management using Nginx Proxy Manager appeared first on ServerStadium.

This guide will show you how to create your own HTTP proxy using Squid, a highly customizable proxy/cache application, in Ubuntu 18.04 VM Instance in ServerStadium.

An HTTP proxy acts as an intermediary between you and the internet. While connected to your Squid HTTP proxy, you will be able to:

• Anonymously access internet services.
• Bypass certain regional and local network restrictions.

Installing Squid

First, make sure the server is up to date by running the following commands as sudo user:

$ sudo apt update && sudo apt upgrade

After you ensure your system is up to date, continue with the Squid Installation.

$ sudo apt install squid

Then check the installation by using the following command; if the installation succeeded, it will produce this following output:

$ sudo systemctl status squid

Output:
● squid.service - LSB: Squid HTTP Proxy version 3.x
   Loaded: loaded (/etc/init.d/squid; generated)
   Active: active (running) since Thu 2020-09-17 12:06:07 UTC; 4min 46s ago
     Docs: man:systemd-sysv-generator(8)
.....

Configuring Firewalls

We should ensure that our Ubuntu VM Instance Squid Port (TCP Port 3128) is not blocked by ServerStadium Security Profile and UFW Firewall.

To modify ServerStadium Cloud Security Profile, open the ServerStadium Cloud panel and navigate to Networking Sidemenu -> Security Profile. Then, edit or create a new Security Profile.
Add a new Firewall Rule on the Security Profile page that opens TCP port 3128. Then apply the security profile.

We also need to ensure Inbound TCP port is allowed in Ubuntu UFW. To do this, run the following command in the Ubuntu VM we installed with Squid server.

$ sudo ufw allow 'Squid'

To verify the firewall status, type the following command and the output will be shown below

$ sudo ufw status

Output:
Status: active

To                         Action      From
--                         ------      ----
OpenSSH                    ALLOW       Anywhere                  
Squid                      ALLOW       Anywhere                  
OpenSSH (v6)               ALLOW       Anywhere (v6)             
Squid (v6)                 ALLOW       Anywhere (v6) 

Configuring Squid

Now that Squid is installed on our ServerStadium Cloud Ubuntu VM, we can configure it to accept connections and serve as an HTTP proxy.

Squid can be configured by editing the /etc/squid/squid.conf file. You can also use separate files with configuration options which can be included using the “include” directive.

The configuration file contains comments that describe what each configuration option does.

Before making any changes, it is a good practice to back up the original configuration file by running the following commands:

$ sudo cp /etc/squid/squid.conf{,.orginal}

Edit the file by opening it using nano (or another text editor):

$ sudo nano /etc/squid/squid.conf

Configuring Client Access via IP ACL

In Squid, you can control how the clients can access the web resources using the Access Control Lists (ACLs).

By default, Squid allows access only from the localhost.

If all the clients using the proxy have a static IP address, you can create an ACL that includes the allowed IPs.

Instead of adding the IP addresses in the main configuration file, we will create a new dedicated file that will hold the IPs:

$ sudo nano /etc/squid/allowSourceIP.txt

192.168.33.1
# All other allowed IPs

Once done, open the main configuration file and create a new ACL named allowSourceIP (first highlighted line) and allow access to that ACL using the http_access directive (second highlighted line):

# ...
acl allowSourceIP  src "/etc/squid/allowSourceIP.txt"
http_access allow localhost
 #Allow access from localhost
http_access allow allowSourceIP #Allow access from IP List

# And finally deny all other access to this proxy
http_access deny all

The http_access directive works similarly to the firewall rules. Squid reads the rules from top to bottom, and when a rule matches, the rules below are not processed.

Since the order of http_access rules are important. Make sure you add the line before http_access deny all.

Please keep mindful that whenever you make changes to the config file, you need to restart the Squid service with the following command:

$ sudo systemctl restart squid

Configuring Client Access via Basic Authentication

Besides limiting access via IP, we can also configure Squid HTTP proxy via basic HTTP authentication.

$ sudo apt-get install apache2-utils

$ sudo touch /etc/squid/squid_usr

$ sudo chown proxy /etc/squid/squid_usr

$ sudo dpkg -L squid | grep ncsa_auth

auth_param basic program /usr/lib/squid/basic_ncsa_auth /etc/squid/squid_passwd
acl ncsa_users proxy_auth REQUIRED
http_access allow ncsa_users

Once you’ve saved and exited the file, complete user removal by restarting Squid:

$ sudo systemctl restart squid

Blocking access to restricted domain

One of the features of Squid proxy server is blocking websites for the client that connects to our Squid Proxy server. It can be done using forbidden dstdomain keyword in ACL directive.

First, we need to create the file. Then add domain names that we need to restrict:

$ sudo nano /etc/squid/forbidden_domains.txt

Contains:
.facebook.com
.twitter.com
.tiktok.com

After we create the list of domains in a text file, we modify the Squid configuration file as follows:

# ...
acl allowSourceIP src "/etc/squid/allowSourceIP.txt"

#Add a new ACL directive
acl forbidden dstdomain "/etc/squid/forbidden_domains" 

http_access allow localhost
 #Allow access from localhost
http_access allow allowSourceIP #Allow access from IP List
#Add the restricted server in the deny list
http_access deny forbidden

# And finally deny all other access to this proxy
http_access deny all

After that, don’t forget to restart the Squid service to apply the changes

$ sudo systemctl restart squid

Anonymizing Traffic

We also can anonymize clients that connect to our Squid proxy. Thus, IP address of the clients that connects to our Squid proxy will not be forwarded to servers that receive traffic from our Squid Proxy.

This is done via the rules below. Add the following lines at the beginning of the Squid configuration file:

forwarded_for off
request_header_access Allow allow all
request_header_access Authorization allow all
request_header_access WWW-Authenticate allow all
request_header_access Proxy-Authorization allow all
request_header_access Proxy-Authenticate allow all
request_header_access Cache-Control allow all
request_header_access Content-Encoding allow all
request_header_access Content-Length allow all
request_header_access Content-Type allow all
request_header_access Date allow all
request_header_access Expires allow all
request_header_access Host allow all
request_header_access If-Modified-Since allow all
request_header_access Last-Modified allow all
request_header_access Location allow all
request_header_access Pragma allow all
request_header_access Accept allow all
request_header_access Accept-Charset allow all
request_header_access Accept-Encoding allow all
request_header_access Accept-Language allow all
request_header_access Content-Language allow all
request_header_access Mime-Version allow all
request_header_access Retry-After allow all
request_header_access Title allow all
request_header_access Connection allow all
request_header_access Proxy-Connection allow all
request_header_access User-Agent allow all
request_header_access Cookie allow all
request_header_access All deny all

After that, close the config file and restart your Squid proxy.

Connecting to your Squid Proxy

Your Squid Proxy Server is now ready, Congratulations!

You can configure your local browser or operating system’s network settings to use your ServerStadium VM as an HTTP proxy. The settings to do this will vary depending on your OS and browser.

You may find several official articles below to configure your Client OS or Browser to connect to the Squid Proxy:

• Configure Proxy on Windows
• Proxy Server Settings on macOS
• Connection Settings in Firefox

The post Install and Configure Squid Proxy in Ubuntu appeared first on ServerStadium.