I set up an Apache v2.4 reverse proxy on a CentOS 7 machine, serving requests to several vhosts; amongst these there are Atlassian application servers.
The proxy's private IP address is 10.0.0.77, its public IP address is 77.77.77.77, and several DNS A records map the public IP to various FQDN: foo.example.com, bar.example.com, etc.
There is a NAT in place:
77.77.77.77:10080 -> 10.0.0.77:80
77.77.77.77:10443 -> 10.0.0.77:443
which is necessary because the proxy's public IP address is used also for other services. The setup is the same as this other question.
Here below is an example of vhost configuration (simplified), /etc/httpd/conf.d/foo.conf:
<VirtualHost *:80>
ServerName foo.example.com
ProxyRequests Off
ProxyPreserveHost Off
SetEnv proxy-nokeepalive 1
Redirect "/" "https://foo.example.com:10443/"
</VirtualHost>
<VirtualHost *:443>
ServerName foo.example.com
ServerSignature On
<Proxy *>
Order deny,allow
Allow from all
</Proxy>
SSLEngine On
SSLProtocol ALL -SSLv2 -SSLv3
SSLHonorCipherOrder on
# SSLCipherSuite shortened here for simplicity
SSLCipherSuite "EECDH+ECDSA+AESGCM EECDH+aRSA+AESGCM EECDH+ECDSA+SHA384"
SSLCertificateFile /etc/httpd/ssl/proxy.crt
SSLCertificateKeyFile /etc/httpd/ssl/proxy.key
SSLCACertificateFile /etc/httpd/ssl/proxy.ca.crt
ProxyRequests Off
ProxyPreserveHost On
ProxyPass "/" "http://foo.example.com:8080/"
ProxyPassReverse "/" "http://foo.example.com:8080/"
</VirtualHost>
This configuration works well with two Jira servers, a Stash server, a Confluence v6.10 server, and several other servers. However, the web browser fails loading a proxied Bamboo v6.4 server vhost and a Question2Answer platform.
On Firefox the reported error is NS_ERROR_NET_TIMEOUT. On IE the error is:
There was a temporary DNS error. Try refreshing the page.
Error Code: INET_E_RESOURCE_NOT_FOUND
On the httpd access log for each failing vhost there is nothing, not even on LogLevel trace8, so apparently the request doesn't even hit the proxy.
I can access Bamboo via curl from the proxy (a -L flag is necessary as Bamboo serves a 302):
[root@proxy]# curl -XGET http://bamboo.example.com:8085/
[root@proxy]# curl -v -XGET http://bamboo.example.com:8085/
* About to connect() to bamboo.example.com port 8085 (#0)
* Trying 10.0.0.11...
* Connected to bamboo.example.com (10.0.0.11) port 8085 (#0)
> GET / HTTP/1.1
> User-Agent: curl/7.29.0
> Host: bamboo.example.com:8085
> Accept: */*
>
< HTTP/1.1 302 Found
< Server: Apache-Coyote/1.1
< X-ASEN: SEN-4619603
< X-Frame-Options: SAMEORIGIN
< X-Content-Type-Options: nosniff
< Vary: Accept-Encoding
< Set-Cookie: JSESSIONID=E4D13B8AD7D4D172F4E5F834D1E89710; Path=/; Secure; HttpOnly
< Cache-Control: no-store
< Location: /userlogin!doDefault.action?os_destination=%2Fstart.action
< Content-Language: en-US
< Content-Length: 0
< Date: Mon, 01 Oct 2018 15:06:19 GMT
<
* Connection #0 to host bamboo.example.com left intact
[root@proxy]# curl -L -XGET http://bamboo.example.com:8085/
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8" />
<title>Log in as a Bamboo user</title>
<meta http-equiv="X-UA-Compatible" content="IE=EDGE" />
<meta http-equiv="Pragma" content="no-cache" />
<meta http-equiv="Expires" content="-1" />
<meta name="application-name" content="Bamboo" />
(...)
The firewall on the destination servers is open from the server to the proxy (note that Atlassian applications run on nonstandard ports, e.g. Jira serves content on TCP/8080).
I am puzzled because almost all other vhosts work flawlessly. I have also carefully checked the URL path and it is correct.
What could be the cause of this problem?
Is there a way to trace the HTTP request in a better way? I use Firefox's add-on HTTP Header Live for now and I'd like to find some more complex tool.
