Reproducing IIS Reverse Proxy Config with nginx - iis

Question

I am trying to reproduce an IIS reverse proxy configuration with nginx. The application is for a mobile iphone app to communicate to a configuration server on our LAN. Both the mobile app and web server are third party and lack documentation.
web.config
<?xml version="1.0" encoding="UTF-8"?>
<configuration>
<system.webServer>
<rewrite>
<rules>
<rule name="Authenticate" stopProcessing="true">
<match url="^authenticate(.*)" />
<action type="Rewrite" url="http://INTERNALIP:80{R:1}" logRewrittenUrl="true" />
</rule>
<rule name="SAC" stopProcessing="true">
<match url="^sac(.*)" />
<action type="Rewrite" url="http://INTERNALIP:5447{R:1}" logRewrittenUrl="true" />
</rule>
<rule name="Config" stopProcessing="true">
<match url="^config(.*)" />
<action type="Rewrite" url="http://INTERNALIP:5449{R:1}" logRewrittenUrl="true" />
</rule>
</rules>
</rewrite>
</system.webServer>
</configuration>
After reading through the documentation and looking through other posts. I came up with this for my server directive.
nginx.conf
server {
listen 5600;
server_name mobile.example.com;
access_log /var/log/nginx/log/rproxy.log;
error_log /var/log/nginx/log/error.log;
location ^~ /authenticate(.*){
rewrite ^/authenticate(.*)/ /$1 break;
proxy_pass http://INTERNALIP;
}
location ^~ /sac(.*){
rewrite ^/sac(.*)/ /$1 break;
proxy_pass http://INTERNALIP:5447;
}
location ^~ /config(.*){
rewrite ^/config(.*)/ /$1 break;
proxy_pass http://INTERNALIP:5449;
}
}
I am seeing some data in the log, but it wasn't really what I was expecting and I'm having difficulties troubleshooting from here. I really wish I knew what the requests looked like and had some sort of request flow, but I do not.
access.log
xx.xx.xx.xx - - [24/Jan/2014:18:33:45 +0000] "\x16\x03\x01\x00\xA1\x01\x00\x00\x9D\x03\x01R\xE2\xB2\x09\xBC\x9F\xE4h\x04_\x8C\x0C[\x94\x1E\xE66H\x1DLY^H\x16\xF5U\xF4\xF8" 400 172 "-" "-"
xx.xx.xx.xx - - [24/Jan/2014:18:33:45 +0000] "\x16\x03\x01\x00\xA1\x01\x00\x00\x9D\x03\x01R\xE2\xB2\x09\xD8>e\x15\x89\xF1\xC1,\xC6_Qj\x96\x88\xC8\x11\x06P=\xB2OE\xB6\xA4,\xE7;/\x00\x00J\x00\xFF\xC0$\xC0#\xC0" 400 172 "-" "-"
xx.xx.xx.xx - - [24/Jan/2014:18:33:45 +0000] "\x16\x03\x00\x00E\x01\x00\x00A\x03\x00R\xE2\xB2\x09\x09\xEC(\xCE\xD3\xB7$\xA7T\x0C\xEA\xEF^0\xF9In*Y#\xFE\x9F\x09\xD3W\xA8)f\x00\x00\x1A\x00\xFF\x00=\x00<\x00/\x00\x05\x00\x04\x005\x00" 400 172 "-" "-"
Any help would be greatly appreciated.
Thanks

Answer 1

I found this question searching for "\x16\x03\x01\x00", which I was also seeing throughout my access.log and not understanding what it was I was looking at. It's raw ssl coming through. For me, I had http redirecting to https but my server definition looked like
server {
listen 443;
server_name my.server.com;
...
}
I fixed the problem by adding in the missing "default ssl" to the listen line.
server {
listen 443 default ssl;
server_name my.server.com;
...
}