NGINX Works on Static HTML Pages, but 404 on Wordpress sites

[Craash]

I've moved from pfSense to OPNsense and so far have had pretty good luck.  On pfSense I had used haproxy to do the below and it worked well.  I've tried to use NGINX now and I'm having issues with 404s.

UPDATE - It just hit me I don't have a "in URL" or "In Path" like I did in haproxy.  Is that the issue?

NGINX config in OPNsense

• Site 1 - Nextcloud on dedicated server - works
  Site 2 - Blue Iris on dedicated server - works
  Site 3 - static HTML behind NGINX on "vm-Web" - works
  Sites 4-6 - Wordpress sites behind NGINX on "vm-Web". - these result in immediate 404s.

If I change one of the wordpress sites to the static HTML site in OPNsense it then works.

Wordpress Server Block in next post.

[Craash]

Wordpress site 1-4, all 404's.

server {
        listen 80;
        ## Your website name goes here.
        server_name www.fauxsite.com;
        ## Your only path reference.
        root /var/www/fauxsite.com;
        ## This should be in your http block and if it is, it's not needed here.
        index index.php;

        location = /favicon.ico {
                log_not_found off;
                access_log off;
        }

        location = /robots.txt {
                allow all;
                log_not_found off;
                access_log off;
        }

        location / {
                # This is cool because no php is touched for static content.
                # include the "?$args" part so non-default permalinks doesn't break when using query string
                #try_files $uri $uri/ /index.php?$args;
                try_files $uri $uri/ /index.php?q=$uri&$args;
        }

        location ~ \.php$ {
                #NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini
                include fastcgi_params;
                fastcgi_intercept_errors on;
                fastcgi_pass php;
                #The following parameter can be also included in fastcgi_params file
                fastcgi_param  SCRIPT_FILENAME $document_root$fastcgi_script_name;
        }

        location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
                expires max;
                log_not_found off;
        }
}

[Craash]

Static HTML Site which works:

server {
        listen 80;
        root /var/www/fauxsite2.com;
        index index.php index.html index.htm index.nginx-debian.html;
        server_name fauxsite2.com www.fauxsite2.com;
        access_log /var/log/nginx/access.fauxsite2.log;
        error_log /var/log/nginx/error.fauxsite2.log;

        location / {
                try_files $uri $uri/ =404;
       }

        location ~ \.php$ {
                include snippets/fastcgi-php.conf;
                fastcgi_pass unix:/var/run/php/php7.2-fpm.sock;
        }

        location ~ /\.ht {
                deny all;
        }
        location = /favicon.ico { log_not_found off; access_log off; }
        location = /robots.txt { log_not_found off; access_log off; allow all; }
        location ~* \.(css|gif|ico|jpeg|jpg|js|png)$ {
                expires max;
                log_not_found off;
        }
        }

[Fright]

hi

Code: [Select]

fastcgi_pass php;
but there is no 'php' upstream

[Craash]

I'm sorry, could I ask you to expand on this?  Am I missing that, or is it a capability that doesn't exist?

hi

Code: [Select]

fastcgi_pass php;
but there is no 'php' upstream

[Fright]

sorry
you have

Code: [Select]

fastcgi_pass php;
directive on "404"'s servers php-locations blocks. like on nginx help page:
https://www.nginx.com/resources/wiki/start/topics/recipes/wordpress/
but they use upstream for this:

Code: [Select]

upstream php {
        server unix:/tmp/php-cgi.socket;
        server 127.0.0.1:9000;
}
for fastcgi_pass diretive you can use Upstream name, FastCGI server address or UNIX-domain socket path (like you do on other server).
AFAIK when configured via GUI OPN nginx sets fastcgi_pass to 'unix:/var/run/php-www.socket;'

[Craash]

I think I'm following.  So it is all in my server block, and not in OPNsense then?

I know in HAProxy I could run all the sites on port 80/443.  It seems here I need to put them on different ports?

I REALLY appreciate the help.

sorry
you have

Code: [Select]

fastcgi_pass php;
directive on "404"'s servers php-locations blocks. like on nginx help page:
https://www.nginx.com/resources/wiki/start/topics/recipes/wordpress/
but they use upstream for this:

Code: [Select]

upstream php {
        server unix:/tmp/php-cgi.socket;
        server 127.0.0.1:9000;
}
for fastcgi_pass diretive you can use Upstream name, FastCGI server address or UNIX-domain socket path (like you do on other server).
AFAIK when configured via GUI OPN nginx sets fastcgi_pass to 'unix:/var/run/php-www.socket;'

[Fright]

in HAProxy I could run all the sites on port 80/443.  It seems here I need to put them on different ports?

no no. you still can use one port for multiple sites.
i am just pointing out the error in the fastcgi_pass directive - you directed it to a non-existent upstream and this
and of course it's worth looking into the logs when something goes wrong
Services: Nginx: Logs - HTTP Error logs

[Craash]

I'm sorry for being so dense . . . I had hoped NGINX would make things less complicated than HAProxy, but I can't seem to get my head around it.  I added the upstream PHP server part in the block.  I didn't remove anything.  I haven't done anything in the OPNsense GUI.  What am I missing now?

Did I mention I really, really appreciate your support?

Logs: *1 kevent() reported that connect() failed (61: Connection refused) while connecting to upstream, client: 172.20.0.1, server: fauxsite.com, request: "GET / HTTP/2.0", upstream: "http://172.20.0.105:80/", host: "www.fauxsite.com"

in HAProxy I could run all the sites on port 80/443.  It seems here I need to put them on different ports?

no no. you still can use one port for multiple sites.
i am just pointing out the error in the fastcgi_pass directive - you directed it to a non-existent upstream and this
and of course it's worth looking into the logs when something goes wrong
Services: Nginx: Logs - HTTP Error logs

[Fright]

hm. now I'm confused
I don't understand where " upstream: "http://172.20.0.105:80/"" comes from. i dont see it in your config
i expected to see "no such file " or FastCGI errors
can you attach full nginx.conf file?

[Craash]

That is the internal IP address of the web server.

nginx.conf:

user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
        worker_connections 768;
        # multi_accept on;
}

http {

        ##
        # Basic Settings
        ##
        client_max_body_size 20M;

        sendfile on;
        tcp_nopush on;
        tcp_nodelay on;
        keepalive_timeout 65;
        types_hash_max_size 2048;
        # server_tokens off;

        # server_names_hash_bucket_size 64;
        # server_name_in_redirect off;

        include /etc/nginx/mime.types;
        default_type application/octet-stream;

        ##
        # SSL Settings
        ##

        ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
        ssl_prefer_server_ciphers on;

        ##
        # Logging Settings
        ##

        access_log /var/log/nginx/access.log;
        error_log /var/log/nginx/error.log;

        ##
        # Gzip Settings
        ##

        gzip on;

        # gzip_vary on;
        # gzip_proxied any;
        # gzip_comp_level 6;
        # gzip_buffers 16 8k;
        # gzip_http_version 1.1;
        # gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascrip>

        ##
        # Virtual Host Configs
        ##

        include /etc/nginx/conf.d/*.conf;
        include /etc/nginx/sites-enabled/*;
}


#mail {
#       # See sample authentication script at:
#       # http://wiki.nginx.org/ImapAuthenticateWithApachePhpScript
#
#       # auth_http localhost/auth.php;
#       # pop3_capabilities "TOP" "USER";
#       # imap_capabilities "IMAP4rev1" "UIDPLUS";
#
#       server {
#               listen     localhost:110;
#               protocol   pop3;
#               proxy      on;
#       }
#
#       server {
#               listen     localhost:143;
#               protocol   imap;
#               proxy      on;
#       }
#}

[Fright]

sorry
file does not look like an OPN nginx.conf-file at all 
and it is actually empty (just http section)

maybe I didn't understand the question at all?

[Craash]

Ah, I pulled it from the webserver.

Where should I pull from?

[Fright]

I have the feeling that we are confusing each other )
can we start from the beginning?
what scheme? what should the OPNsense nginx do, where are the wordpress files located?
(do you want to place wordpress php-scripts on OPN box? or just proxy request to some internal site with wordpress scripts?)

Where should I pull from?

from that nginx where "Connection refused) while connecting to upstream" errors appears )

[Craash]

I'm a pro at confusion. 

The error shows in the log of OPNsense.  I should have mentioned that when I first used the server blocks, which worked on pfSense, I was getting a to many redirects error.

My hope is to use NGINX on OPNsense to forward to a NGINX instance on a different machine.  OPN sense NGINX has Lets Encrypt SSL certificates and the separate servers are listening on port 80.  This different machine houses 1 static html site, and 4 wordpress sites. 

I'm hairpining the traffic at this point, as opposed to split DNS, because it is much easier from a zone management aspect with unbound and I don't have to maintain SSL certs on the inside of my network - OPNsense does it all.  My pfsense box used HA proxy and split DNS and it all worked.  I have 3 servers with one site - these are forwarded correctly, with SSL, from OPNsense.  It is just the wordpress sites.

LAN 172.20.0.0/24
OPNsense 172.20.0.254
Web Server 172.20.0.105.
Test client machine 172.20.0.1