Tcp port forwarding with ssl

[MinitorMHS]

I'm trying to setup ngnix to use my subdomain and port 443 to forward requests to port 3000 which is a tcp port , for http ports it's easy to do this but did anyone do this before or can help me achieve this?

[shalafi99]

Hi, the protocol involved (https/http or another) would be more relevant than the actual TCP port involved while deciding on what to set up inside NPM.

You say you want NPM to listen for https traffic (TCP 443) using that subdomain of yours and for that, you will add a TLS certificate into NPM (either as an external certificate or using NPM's feature to request a new certificate).
And the traffic it receives will be sent to a destination listening on port TCP 3000.
All above is correct understanding?

That destination host/app/service which is listening on TCP 3000, is it using http or https?

[MinitorMHS]

Yeah you understood correctly, I want npm to listen to my subdomain on port 443 and forward the requests to tcp port 3000 which is tls , but about ssl certificates I can configure my application to use certs or neither npm so it's not really important cause I can do it both sides

[shalafi99]

So, for that it would be a proxy host.
You mentioned tls being used at TCP 3000 so https for the 'scheme' drop-down.
And for the NPM listener, what you select in the "SSL" tab determines http or https.

[MinitorMHS]

I selected https but that's where my problem is cause it won't work, as I searched before opening this issue nginx can only handle tcp ports in streams section but I don't really know if I'm right or not
And yes as you mentioned I'm running a proxy on port 3000

[shalafi99]

You would use a stream host only for non http/https traffic, as far as I know.
(That's why I began mentioning the protocol in use is more relevant)

A couple of examples I have in my environment:

--> traffic forwarded to a host running https on TCP 8443

--> traffic forwarded to the NPM container's own web gui port, http on TCP 81
(upon posting, realized websockets should not be turned on here, gone now)

For both, it might as well have been TCP 3000 instead of what is now (in case I changed the service's port to that)

When we think just TCP it's the Transport Layer (OSI Layer4), but when we add to that the knowledge it's http/https we have the Application Layer (OSI Layer7) thrown into the mix.

NPM Stream host = Layer4
NPM Proxy host = Layer7
And that's so no matter the actual TCP port in use.

[MinitorMHS]

Oh thanks for your helpful explanation, and one more question, what if my application is not running in docker? What should I put in "Forward hostname/ip"

[shalafi99]

You might have a couple options there, mostly depending on how the service is setup and where it is located inside the network in relation to docker/NPM.

Which one below would you use to reach the proxy at TCP 3000 directly? (=no NPM involved)

IP (maybe because it's a static one)
a fully qualified domain name (maybe because it has a dynamic IP, or because TLS being involved requires that)
localhost/127.0.0.1 (because it's running directly where you access it from)

I suppose it only gets tricky when it is running inside the same host where docker is installed and listening only on the loopback address and no other interfaces. Might that be your case?

[MinitorMHS]

Could you please dm me on telegram? https://t.me/minitor

[MinitorMHS]

So could you please give me a TON wallet address, I need to pay you something, it's not much but just for your time