Nginx - Reverse Proxy with SSL Termination + ESET

Software & Web Applications
1

Hi All,

I am currently using Nginx as a reverse proxy with SSL termination to proxy several web services hosted on a Windows Server via IIS. Certbot is set up as well with free SSL goodness => happy management :smile:.

Everything works as expected expect for one thing…

ESET is installed on the Windows Server and from time to time we get some malicious requests coming through and the AV sees the Nginx server as the threat and blocks it.
All web services are inaccessible until I lift the block => management not so happy anymore :frowning_face:.
The current Nginx config adds the X-Forwarded-For Header with the source IP of the client but ESET seems to be ignoring it. I have tried pushing ESET upstream and installing it on the Nginx server but that does not seem to change anything.

Anyone ever encountered that kind of scenario? I am sure I am missing something trivial…

2

Might take a gander here.

Also you might set an exception on your AV to not block. To me this isn’t an ESET or nginx issue. If there is malicious traffic and being blocked then you’ll have to deal with the AV.

3

Thank you Maximus I will check this out. I will test whitelisting the proxy but it feels wrong :joy: