diff --git a/www/nginx/pkg-descr b/www/nginx/pkg-descr
index f77fac368..958626fdd 100644
--- a/www/nginx/pkg-descr
+++ b/www/nginx/pkg-descr
@@ -13,6 +13,10 @@ Plugin Changelog
* Add proxy options for ignore client abort and disabling buffering
* Add logviewer support for streams
* Fix charset is not defined bug (contributed by ccesario [1])
+* Add an existence check for locations
+* Add PROXY protocol for HTTP and Streams frontend
+* Add PROXY backend support for Streams
+* Add support for better whitelist rules in the WAF
[1] https://github.com/opnsense/plugins/pull/1035
diff --git a/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/httpserver.xml b/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/httpserver.xml
index 5c5c9a4e8..50282f3d5 100644
--- a/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/httpserver.xml
+++ b/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/httpserver.xml
@@ -9,6 +9,30 @@
text
+
+ httpserver.proxy_protocol
+
+ checkbox
+ true
+ If you enable the proxy protocol, a downstream proxy can send the client IP and port before the real traffic is set.
+
+
+ httpserver.trusted_proxies
+
+ true
+
+ select_multiple
+ true
+ Enter a list of IP addresses or CIDR networks which are allowed to override the source IP address using the specified header.
+
+
+ httpserver.real_ip_source
+
+
+ true
+ X-Real-IP and X-Forwarded-For are HTTP headers, while PROXY protocol is a protocol which needs to be enabled.
+ dropdown
+ httpserver.servername
diff --git a/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/streamserver.xml b/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/streamserver.xml
index 23a264d94..e2f6044b0 100644
--- a/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/streamserver.xml
+++ b/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/streamserver.xml
@@ -9,6 +9,21 @@
checkbox
+
+ streamserver.proxy_protocol
+
+ checkbox
+ If you enable the proxy protocol, a downstream proxy can send the client IP and port before the real traffic is set.
+
+
+ httpserver.trusted_proxies
+
+ true
+
+ select_multiple
+ true
+ Enter a list of IP addresses or CIDR networks which are allowed to override the source IP address using the specified header.
+ streamserver.certificate
diff --git a/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/upstream.xml b/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/upstream.xml
index f2303d759..091431302 100644
--- a/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/upstream.xml
+++ b/www/nginx/src/opnsense/mvc/app/controllers/OPNsense/Nginx/forms/upstream.xml
@@ -10,6 +10,13 @@
select_multiple
+
+ upstream.proxy_protocol
+
+ checkbox
+ true
+ If you enable the proxy protocol, an upstream proxy or server will get the client IP and the server port before the real traffic is sent.
+ upstream.tls_enable
diff --git a/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml b/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml
index 8458931bc..8b7e3b827 100644
--- a/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml
+++ b/www/nginx/src/opnsense/mvc/app/models/OPNsense/Nginx/Nginx.xml
@@ -74,6 +74,10 @@
YY
+
+ 0
+ Y
+ Y0
@@ -439,8 +443,16 @@
Y
- Y
+ N/^[^"]+$/
+
+
+ This field must be set.
+ SetIfConstraint
+ match_type
+ id
+
+ Y
@@ -455,8 +467,16 @@
/^[^"]+$/
- Y
+ N/^[^"]+$/
+
+
+ This field must be set.
+ SetIfConstraint
+ match_type
+ id
+
+ Y
@@ -470,8 +490,16 @@
Y
- Y
+ N8
+
+
+ This field must be set.
+ SetIfConstraint
+ match_type
+ id
+
+ Y
@@ -514,6 +542,23 @@
N443
+
+ 0
+ Y
+
+
+ N
+ /^((?:\d+\.){3,3}\d+|[a-f0-9\:]+)(?:\/\d+)?(,?(?:(?:(\d+\.){3,3}\d+|[a-f0-9\:]+)(?:\/\d+)?))*$/i
+ Y
+
+
+
+ X-Real-IP (default)
+ X-Forwarded-For
+ PROXY Protocol
+
+ N
+
@@ -658,11 +703,26 @@
N80
+
+
+ You can only use one server at this port.
+ UniqueConstraint
+
+ Y0
+
+ N
+ /^((?:\d+\.){3,3}\d+|[a-f0-9\:]+)(?:\/\d+)?(,?(?:(?:(\d+\.){3,3}\d+|[a-f0-9\:]+)(?:\/\d+)?))*$/i
+ Y
+
+
+ 0
+ Y
+ certN
diff --git a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf
index c9c0b47b5..c677ef93e 100644
--- a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf
+++ b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/http.conf
@@ -60,8 +60,8 @@ server {
{% set our_headers = [] %}
{% do our_headers.append('X-Powered-By') %}
{% if server.listen_http_port is defined %}
- listen {{ server.listen_http_port }};
- listen [::]:{{ server.listen_http_port }};
+ listen {{ server.listen_http_port }}{% if server.proxy_protocol is defined and server.proxy_protocol == '1' %} proxy_protocol{% endif %};
+ listen [::]:{{ server.listen_http_port }}{% if server.proxy_protocol is defined and server.proxy_protocol == '1' %} proxy_protocol{% endif %};
{% do listen_list.append(server.listen_http_port) %}
{% endif %}
{% if server.listen_https_port is defined and server.certificate is defined %}
@@ -86,6 +86,14 @@ server {
sendfile {% if server.sendfile is defined and server.sendfile == '1' %}On{% else %}Off{% endif %};
{% endif %}
server_name {{ server.servername.replace(',', ' ') }};
+{% if server.real_ip_source is defined and server.real_ip_source != '' %}
+ real_ip_header {{ server.real_ip_source }};
+{% if server.trusted_proxies is defined and server.trusted_proxies != '' %}
+{% for trusted_proxy in server.trusted_proxies.split(',') %}
+ set_real_ip_from {{ trusted_proxy }};
+{% endfor %}
+{% endif %}
+{% endif %}
{% if server.charset is defined %}
charset {{ server.charset }};
{% endif %}
@@ -220,7 +228,9 @@ server {
{% if server.locations is defined %}
{% for location_uuid in server.locations.split(',') %}
{% set location = helpers.getUUID(location_uuid) %}
+{% if location.urlpattern is defined %}
{% include "OPNsense/Nginx/location.conf" ignore missing with context %}
+{% endif %}
{% endfor %}
{% endif %}
diff --git a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/naxsirule.conf b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/naxsirule.conf
index 4a279bd8e..24fc0af6c 100644
--- a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/naxsirule.conf
+++ b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/naxsirule.conf
@@ -39,10 +39,14 @@
{{ mz_matches|join('|') }}
{%- endmacro %}
{% macro naxsi_rule(uuid, rule, ruletype) -%}
+{% if rule.message is defined and rule.match_value is defined %}
{{ ruletype }}{% if rule.negate is defined and rule.negate == '1' %} negative{% endif
%} {{ rule.match_type }}:{{ rule.identifier }} "{% if rule.regex == '1' %}rx{% else %}str{% endif
%}:{{ rule.match_value }}" "msg:{{ rule.message }}" "mz:{{ naxsi_mzhelper(rule)
}}" "s:$policy{{ uuid.replace('-', '') }}:{{ rule.score }}";
+{% else %}
+ {{ ruletype }} {{ rule.match_type }}:{{ rule.identifier }};
+{% endif %}
{%- endmacro %}
{% if naxsi_ruletype == 'basic' %}
diff --git a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/streams.conf b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/streams.conf
index 4b70c1c85..2b7e340b7 100644
--- a/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/streams.conf
+++ b/www/nginx/src/opnsense/service/templates/OPNsense/Nginx/streams.conf
@@ -39,8 +39,8 @@
server {
{% set tls_enabled = server.certificate is defined %}
{% if server.listen_port is defined %}
- listen {{ server.listen_port }}{% if server.udp is defined and server.udp == '1' %} udp{% endif %}{% if tls_enabled %} ssl{% endif %};
- listen [::]:{{ server.listen_port }}{% if server.udp is defined and server.udp == '1' %} udp{% endif %}{% if tls_enabled %} ssl{% endif %};
+ listen {{ server.listen_port }}{% if server.udp is defined and server.udp == '1' %} udp{% endif %}{% if tls_enabled %} ssl{% endif %}{% if server.proxy_protocol is defined and server.proxy_protocol == '1' %} proxy_protocol{% endif %};
+ listen [::]:{{ server.listen_port }}{% if server.udp is defined and server.udp == '1' %} udp{% endif %}{% if tls_enabled %} ssl{% endif %}{% if server.proxy_protocol is defined and server.proxy_protocol == '1' %} proxy_protocol{% endif %};
{% endif %}
access_log /var/log/nginx/stream_{{ server['@uuid'] }}.access.log main;
@@ -84,6 +84,12 @@
{% elif server.route_field == 'sni_upstream_map' %}
proxy_pass $hostmap{{ server.sni_upstream_map.replace('-','') }};
{% endif %}
+ proxy_protocol {% if upstream.proxy_protocol == '1' %}on{% else %}off{% endif %};
+{% if server.trusted_proxies is defined and server.trusted_proxies != '' %}
+{% for trusted_proxy in server.trusted_proxies.split(',') %}
+ set_real_ip_from {{ trusted_proxy }};
+{% endfor %}
+{% endif%}
}
{% endfor %}