# VNC with Sunstone behind Nginx Proxy **URL:** \ **Category:** Product Support\ **Created:** [March 16, 2015, 12:55pm UTC](https://forum.opennebula.io/t/vnc-with-sunstone-behind-nginx-proxy/426 "2015-03-16T12:55:10Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![nico\_opennebula\_org](https://avatars.discourse-cdn.com/v4/letter/n/ce7236/32.png) [@nico\_opennebula\_org](https://forum.opennebula.io/u/nico_opennebula_org)\ **Post date:** [March 16, 2015, 12:55pm UTC](https://forum.opennebula.io/t/vnc-with-sunstone-behind-nginx-proxy/426/1 "2015-03-16T12:55:10Z")
Hello, we are looking into running sunstone behind nginx. (SSH) Forwarding the requests to localhost:9869 works, but when I access sunstone via nginx, the window for VNC does not open. Our nginx.conf looks like this: ``` # # cdist maintained configuration - do not overwrite # server { listen 443; ssl on; ssl_certificate /etc/nginx/ssl.crt; ssl_certificate_key /etc/nginx/ssl.key; # Compress everything [tm] gzip on; gzip_static on; gzip_proxied any; # Not for silly ie gzip_disable "MSIE [1-6]\."; gzip_http_version 1.0; gzip_types text/plain text/xml text/css text/comma-separated-values text/javascript application/x-javascript application/atom+xml; root /usr/lib/one/sunstone/public/; try_files $uri/index.html $uri.html $uri @sunstone; location ~* \.(ico|css|js|gif|jpe?g|png)(\?[0-9]+)?$ { expires 1y; # Need to enable proxying in this location as well try_files $uri @sunstone; } # Rails error pages error_page 500 502 503 504 /500.html; location @sunstone { proxy_pass http://127.0.0.1:9869; proxy_set_header Host $host; proxy_set_header SERVER_NAME $server_name; proxy_set_header SERVER_ADDR $server_addr; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header X_FORWARDED_SCHEME $scheme; proxy_set_header X_FORWARDED_PROTO $scheme; } } ``` Anyone an idea what is missing for VNC support? ---
**Author:** ![lorenzo\_faleschini](https://yyz1.discourse-cdn.com/flex031/user_avatar/forum.opennebula.io/lorenzo_faleschini/32/4242_2.png) [@lorenzo\_faleschini](https://forum.opennebula.io/u/lorenzo_faleschini)\ **Post date:** [March 16, 2015, 3:08pm UTC](https://forum.opennebula.io/t/vnc-with-sunstone-behind-nginx-proxy/426/2 "2015-03-16T15:08:44Z")
currently we are trying the same, but we have some issues… anyway you should proxy the WebSockets for the VNC console [http://nginx.org/en/docs/http/websocket.html](http://nginx.org/en/docs/http/websocket.html) somehow there’s something blocking the handshake… I’m not following in 1st person this issue, but as I got news I’ll ping here the results. NOTE: for now I’m using ssh tunneling to access my kvm hypervisors network from outsitde… I know it’s a workaround but at least I’m able to manage it from everywhere… have a look at this handy tool for some fuss-less ssh tunneling [https://github.com/apenwarr/sshuttle](https://github.com/apenwarr/sshuttle) ---
**Author:** ![DaD](https://yyz1.discourse-cdn.com/flex031/user_avatar/forum.opennebula.io/dad/32/8466_2.png) [@DaD](https://forum.opennebula.io/u/DaD)\ **Post date:** [March 16, 2015, 3:17pm UTC](https://forum.opennebula.io/t/vnc-with-sunstone-behind-nginx-proxy/426/3 "2015-03-16T15:17:52Z")
nico\_opennebula\_org [forum@opennebula.org](mailto:forum@opennebula.org) writes: > Hello, > > we are looking into running sunstone behind nginx. (SSH) Forwarding > the requests to localhost:9869 works, but when I access sunstone via > nginx, the window for VNC does not open. We are using nginx as sunstone reverse proxy but the NoVNC connexion is actually direct. We open an issue[1] to ease the reverse proxfication of NoVNC. Regards. Footnotes: [1] [Backlog #3538: Enable path based NoVNC - OpenNebula - OpenNebula Development pages](http://dev.opennebula.org/issues/3538) ---
**Author:** ![pioneer](https://avatars.discourse-cdn.com/v4/letter/p/3ec8ea/32.png) [@pioneer](https://forum.opennebula.io/u/pioneer)\ **Post date:** [March 21, 2015, 11:40am UTC](https://forum.opennebula.io/t/vnc-with-sunstone-behind-nginx-proxy/426/4 "2015-03-21T11:40:07Z")
Could this be a client/browser issue? Using Safari the VNC connections works, IE & Firefox do not open a connection window. The proxy is lighttpd with SSL. ---
**Author:** ![nico\_opennebula\_org](https://avatars.discourse-cdn.com/v4/letter/n/ce7236/32.png) [@nico\_opennebula\_org](https://forum.opennebula.io/u/nico_opennebula_org)\ **Post date:** [March 21, 2015, 1:42pm UTC](https://forum.opennebula.io/t/vnc-with-sunstone-behind-nginx-proxy/426/5 "2015-03-21T13:42:10Z")
@pioneer Can you show your lighty config? I have tested it so far with chromium and firefox (both Linux) without success ---
**Author:** ![pioneer](https://avatars.discourse-cdn.com/v4/letter/p/3ec8ea/32.png) [@pioneer](https://forum.opennebula.io/u/pioneer)\ **Post date:** [March 21, 2015, 4:02pm UTC](https://forum.opennebula.io/t/vnc-with-sunstone-behind-nginx-proxy/426/6 "2015-03-21T16:02:39Z")
Sure: ``` server.modules = ( "mod_access", "mod_alias", "mod_compress", "mod_proxy", "mod_redirect", ) server.document-root = "/var/www" server.upload-dirs = ( "/var/cache/lighttpd/uploads" ) server.errorlog = "/var/log/lighttpd/error.log" server.pid-file = "/var/run/lighttpd.pid" server.username = "www-data" server.groupname = "www-data" server.port = 443 index-file.names = ( "index.php", "index.html", "index.lighttpd.html" ) url.access-deny = ( "~", ".inc" ) static-file.exclude-extensions = ( ".php", ".pl", ".fcgi" ) compress.cache-dir = "/var/cache/lighttpd/compress/" compress.filetype = ( "application/javascript", "text/css", "text/html", "text/plain" ) proxy.server = ( "" => ("" => ( "host" => "127.0.0.1", "port" => 9869 ) ) ) ssl.engine = "enable" ssl.pemfile = "/etc/lighttpd/server.pem" include_shell "/usr/share/lighttpd/create-mime.assign.pl" include_shell "/usr/share/lighttpd/include-conf-enabled.pl" ``` Hope this helps, marc ---
**Author:** ![nico\_opennebula\_org](https://avatars.discourse-cdn.com/v4/letter/n/ce7236/32.png) [@nico\_opennebula\_org](https://forum.opennebula.io/u/nico_opennebula_org)\ **Post date:** [March 23, 2015, 9:07am UTC](https://forum.opennebula.io/t/vnc-with-sunstone-behind-nginx-proxy/426/7 "2015-03-23T09:07:31Z")
@pioneer is it possible that you are not using lighty at all but connecting plainly to the vnc socket? ---
**Author:** ![pioneer](https://avatars.discourse-cdn.com/v4/letter/p/3ec8ea/32.png) [@pioneer](https://forum.opennebula.io/u/pioneer)\ **Post date:** [March 23, 2015, 12:37pm UTC](https://forum.opennebula.io/t/vnc-with-sunstone-behind-nginx-proxy/426/8 "2015-03-23T12:37:52Z")
just checked that - since the url to the vnc proxy is https, it should be proxied: **https** ://fqdn.of.sunstone-lighttpd/vnc?[host=sunstone.rhpdbs.ch](http://host=sunstone.rhpdbs.ch)&port=29876&token=clm6…h56nd&password=null&encrypt=no&title=the-vm but this is only working with Safari (on Mac and Windows) - IE and Firefox refuse to open a window… ---
**Author:** ![jmelis](https://yyz1.discourse-cdn.com/flex031/user_avatar/forum.opennebula.io/jmelis/32/24_2.png) [@jmelis](https://forum.opennebula.io/u/jmelis)\ **Post date:** [March 23, 2015, 2:56pm UTC](https://forum.opennebula.io/t/vnc-with-sunstone-behind-nginx-proxy/426/9 "2015-03-23T14:56:02Z")
can you try forwarding both 9869 **and 29876**? ---
**Author:** ![nico\_opennebula\_org](https://avatars.discourse-cdn.com/v4/letter/n/ce7236/32.png) [@nico\_opennebula\_org](https://forum.opennebula.io/u/nico_opennebula_org)\ **Post date:** [March 23, 2015, 11:07pm UTC](https://forum.opennebula.io/t/vnc-with-sunstone-behind-nginx-proxy/426/10 "2015-03-23T23:07:12Z")
@jmelis With forwarding you are referring to using https on that port? I have just checked, on our instance the proxy is actually reachable from externally directly (probably not a good idea?): [23:53:10] entrance:~# netstat -anp | grep 29876 tcp 0 0 0.0.0.0:29876 0.0.0.0:\* LISTEN 7467/python ---
**Author:** ![feldsam](https://yyz1.discourse-cdn.com/flex031/user_avatar/forum.opennebula.io/feldsam/32/4441_2.png) [@feldsam](https://forum.opennebula.io/u/feldsam)\ **Post date:** [August 16, 2015, 5:08pm UTC](https://forum.opennebula.io/t/vnc-with-sunstone-behind-nginx-proxy/426/11 "2015-08-16T17:08:58Z")
Hi Nico, I also using nginx as reverse proxy and VNC is working. I have issues if I use non-ssl access respectively when I access sunstone direct via IP and certificane doesnt match. So verify that you have valid certificate. Here is my config: nginx: ``` server { listen 80 default_server; server_name _; return 301 https://$host$request_uri; } server { listen 443; server_name _; ssl on; ssl_certificate /etc/nginx/feldhost.cz.nginx.crt; ssl_certificate_key /etc/nginx/feldhost.cz.nginx.key; # Load configuration files for the default server block. include /etc/nginx/default.d/*.conf; location / { proxy_pass http://127.0.0.1:9869; } error_page 404 /404.html; location = /40x.html { } error_page 500 502 503 504 /50x.html; location = /50x.html { } location /nginx_status { # Turn on nginx stats stub_status on; # I do not need logs for stats access_log off; # Security: Only allow access from localhost IP # allow 127.0.0.1; # Send rest of the world to /dev/null # deny all; } } ``` and sunstone-server vnc conf ``` :vnc_proxy_port: 29876 :vnc_proxy_support_wss: only :vnc_proxy_cert: /etc/one/ssl/feldhost.cz.nginx.crt :vnc_proxy_key: /etc/one/ssl/feldhost.cz.nginx.key :vnc_proxy_ipv6: false ``` Hope to help you. I also added my private network to firewall zone “trusted”, so sunstone can conenct without limitations to compute nodes. ---
**Author:** ![nico\_opennebula\_org](https://avatars.discourse-cdn.com/v4/letter/n/ce7236/32.png) [@nico\_opennebula\_org](https://forum.opennebula.io/u/nico_opennebula_org)\ **Post date:** [August 17, 2015, 7:54am UTC](https://forum.opennebula.io/t/vnc-with-sunstone-behind-nginx-proxy/426/12 "2015-08-17T07:54:15Z")
Thanks for following up, Kristian! We found out that it was two problems in our case: a) firewall setup (sigh!) b) changing the url from ws:// to wss:// It works like charm now! ---
**Author:** ![cesarufmt](https://avatars.discourse-cdn.com/v4/letter/c/58f4c7/32.png) [@cesarufmt](https://forum.opennebula.io/u/cesarufmt)\ **Post date:** [August 26, 2015, 1:33am UTC](https://forum.opennebula.io/t/vnc-with-sunstone-behind-nginx-proxy/426/13 "2015-08-26T01:33:31Z")
Hello guys. I installed the SSL certificates on the server nginx and sunstone. It worked. I updated the Ubuntu sunstone. I updated my nginx server. Configured nginx following this post. I tested it with firefox and chrome. In both the message: “VNC Server disconnected (code: 1006)” I’ve changed the parameter (: vnc\_proxy\_support\_wss:) file (vi /etc/one/sunstone-server.conf) to “yes”, “no” and “only”. None worked. Does anyone know what could be? Thank you. ---
**Author:** ![esfreire](https://avatars.discourse-cdn.com/v4/letter/e/f4b2a3/32.png) [@esfreire](https://forum.opennebula.io/u/esfreire)\ **Post date:** [August 26, 2015, 1:26pm UTC](https://forum.opennebula.io/t/vnc-with-sunstone-behind-nginx-proxy/426/14 "2015-08-26T13:26:06Z")
Hi César, I think you are missing two things: - For one side, I think you need to define the attribute “VNC\_WSS = no” for oneadmin user. - For other side, maybe you need to access to your sunstone UI through the web browser and to the port 29876 to accept your certificate. Example: [https://sunstone-UI:29876/](https://sunstone-UI:29876/) I hope it helps 😄 Cheers, Esteban ---
**Author:** ![esfreire](https://avatars.discourse-cdn.com/v4/letter/e/f4b2a3/32.png) [@esfreire](https://forum.opennebula.io/u/esfreire)\ **Post date:** [August 26, 2015, 1:28pm UTC](https://forum.opennebula.io/t/vnc-with-sunstone-behind-nginx-proxy/426/15 "2015-08-26T13:28:22Z")
By the way, after the update, have you made a restart/reload of nginx/sunstone services? Cheers, Esteban ---
**Author:** ![cesarufmt](https://avatars.discourse-cdn.com/v4/letter/c/58f4c7/32.png) [@cesarufmt](https://forum.opennebula.io/u/cesarufmt)\ **Post date:** [August 26, 2015, 7:24pm UTC](https://forum.opennebula.io/t/vnc-with-sunstone-behind-nginx-proxy/426/16 "2015-08-26T19:24:33Z")
Hi. Thanks. I should add that line down on my file? /etc/one/sunstone-server.conf “VNC\_WSS = no” Yes. i restarted my machine 3 times. ---
**Author:** ![esfreire](https://avatars.discourse-cdn.com/v4/letter/e/f4b2a3/32.png) [@esfreire](https://forum.opennebula.io/u/esfreire)\ **Post date:** [August 27, 2015, 7:37am UTC](https://forum.opennebula.io/t/vnc-with-sunstone-behind-nginx-proxy/426/17 "2015-08-27T07:37:52Z")
Hi @cesarufmt, Exactly, on your sunstone UI you need to go to users, look for oneadmin user and add “VNC\_WSS no” to the attributes for oneadmin user. For that, you just need to enter “VNC\_WSS” on the left field and “no” on the right field on the attributes fields for oneadmin user and finally, just make click on the “add” button. If it still does not work after it, maybe you need to access to your sunstone UI through the web browser and to the port 29876 to accept your certificate. Example: [https://sunstone-UI:29876/](https://sunstone-UI:29876/) I hope it helps 😄 Cheers, Esteban ---
**Author:** ![cesarufmt](https://avatars.discourse-cdn.com/v4/letter/c/58f4c7/32.png) [@cesarufmt](https://forum.opennebula.io/u/cesarufmt)\ **Post date:** [August 27, 2015, 12:33pm UTC](https://forum.opennebula.io/t/vnc-with-sunstone-behind-nginx-proxy/426/18 "2015-08-27T12:33:44Z")
Hi. Thanks for you help. So what did I have to add that the “VNC\_WSS” and this value “on” in the oneadmin OpenNebula user settings in the web interface. Would it be this? My sunstone: _################################################################################_ _# UI Settings_ _################################################################################_ _# :vnc\_proxy\__ _# port: port where the vnc proxy will listen_ _# support\_wss: no | yes | only. For yes and only, provide path to_ _# cert and key. “yes” means both ws and wss connections will be_ _# supported._ _# vnc\_proxy\_cert: Certificate to encrypt wss connections._ _# vnc\_proxy\_key: Key for wss connections. Only necessary if not included in cert._ _# vnc\_proxy\_ipv6: Enable ipv6 support for novnc-server_ _:vnc\_proxy\_port: 29876_ _#:vnc\_proxy\_support\_wss: no #era default_ _:vnc\_proxy\_support\_wss: only_ _#:vnc\_proxy\_cert: #era default_ _#:vnc\_proxy\_key: #era default_ _:vnc\_proxy\_cert: /home/cesar/certificados/ic.ufmt.br.crt_ _:vnc\_proxy\_key: /home/cesar/certificados/www.ic.ufmt.br.key_ _:vnc\_proxy\_ipv6: false_ * * * My nginx file: upstream [opennebula.ic.ufmt.br](http://opennebula.ic.ufmt.br) { ip\_hash; server 10.5.0.1:9869; } ### Parte HTTP server { listen 80; server\_name [opennebula.ic.ufmt.br](http://opennebula.ic.ufmt.br); return 301 https://$host$request\_uri; } #### HTTPS virtual host server { listen 443; server\_name [opennebula.ic.ufmt.br](http://opennebula.ic.ufmt.br); ``` ### SSL Parameters ssl on; ssl_certificate /etc/nginx/certificados/ic.ufmt.br.crt; ssl_certificate_key /etc/nginx/certificados/www.ic.ufmt.br.key; ``` ### Proxy request to upstream location / { proxy\_pass [http://opennebula.ic.ufmt.br](http://opennebula.ic.ufmt.br); } } ---
**Author:** ![nico\_opennebula\_org](https://avatars.discourse-cdn.com/v4/letter/n/ce7236/32.png) [@nico\_opennebula\_org](https://forum.opennebula.io/u/nico_opennebula_org)\ **Post date:** [August 27, 2015, 12:47pm UTC](https://forum.opennebula.io/t/vnc-with-sunstone-behind-nginx-proxy/426/19 "2015-08-27T12:47:50Z")
Hey, what we did to get vnc+ssl running behind nginx: reconfigure /etc/one/sunstone-server.conf :vnc\_proxy\_support\_wss: yes :vnc\_proxy\_cert: /etc/ssl/certs/star.ungleich.ch.crt :vnc\_proxy\_key: /etc/ssl/private/star.ungleich.ch.key restart sunstone server service opennebula-sunstone restart reconfigure user configuration in sunstone GUI to use wss (User Settings -\> tab conf -\> check box VNC Secure websockets) HTH! Nico ---
**Author:** ![VURoland](https://yyz1.discourse-cdn.com/flex031/user_avatar/forum.opennebula.io/vuroland/32/7682_2.png) [@VURoland](https://forum.opennebula.io/u/VURoland)\ **Post date:** [August 31, 2015, 6:00pm UTC](https://forum.opennebula.io/t/vnc-with-sunstone-behind-nginx-proxy/426/20 "2015-08-31T18:00:39Z")
hi all, just sharing how we set things up with nginx ssl proxy for sunstone and encrypted vnc. here is the nginx config we use: ``` # No squealing. server_tokens off; # OpenNebula Sunstone upstream upstream sunstone { server 127.0.0.1:9869; } # HTTP virtual host, redirect to HTTPS server { listen 80 default_server; return 301 https://$server_name:443; } # HTTPS virtual host, proxy to Sunstone server { listen 443 ssl default_server; ssl_certificate /etc/ssl/certs/opennebula-certchain.pem; ssl_certificate_key /etc/ssl/private/opennebula-key.pem; ssl_stapling on; } ``` here is the relevant part of sunstone conf: > UI Settings > > :vnc\_proxy\_port: 29876 > :vnc\_proxy\_support\_wss: only > :vnc\_proxy\_cert: /etc/one/ssl/opennebula-certchain.pem > :vnc\_proxy\_key: /etc/one/ssl/opennebula-key.pem > :vnc\_proxy\_ipv6: false When this is set, reload sunstone. Then, go in web interface to “settings” \> “info” and change VNC\_WSS from no to yes (4.12.1) older versions have a checkmark under “conf” to set VNC to secure sockets. NOTE: if using a selfsigned cert, the connection to VNC window in Sunstone will fail, either get a real cert, or manually accept the selfsigned cert in your browser before trying it with Sunstone. Now, VNC sessions should show “encrypted” in the title. Extra protection: To better protect VNC we also change the default listen address in templates from “0.0.0.0” to the word “vnc-if”. Then on every host in the cluster we make sure “vnc-if” points to a local IP by editing /etc/hosts for every server in the cluster. (like localhost points to 127.0.0.1, vnc-if points to 10.0.0.1 on server 1, to 10.0.0.2 on server 2, etc etc), which is a non-public management network. This way the VNC listen port is only available for that secure network, and people cant view screens they shouldnt, without the need for a firewall. This will change the VNC ports for running VMs on opennebula hypervisors from: > tcp 0 0 **0.0.0.0** :6102 0.0.0.0:\* LISTEN 36021 > tcp 0 0 **0.0.0.0** :6135 0.0.0.0:\* LISTEN 35370 > tcp 0 0 **0.0.0.0** :6109 0.0.0.0:\* LISTEN 33822 > tcp 0 0 **0.0.0.0** :6144 0.0.0.0:\* LISTEN 7273 > tcp 0 0 **0.0.0.0** :6145 0.0.0.0:\* LISTEN 11997 into: > tcp 0 0 **10.149.16.12** :6102 0.0.0.0:\* LISTEN 36021 > tcp 0 0 **10.149.16.12** :6135 0.0.0.0:\* LISTEN 35370 > tcp 0 0 **10.149.16.12** :6109 0.0.0.0:\* LISTEN 33822 > tcp 0 0 **10.149.16.12** :6144 0.0.0.0:\* LISTEN 7273 > tcp 0 0 **10.149.16.12** :6145 0.0.0.0:\* LISTEN 11997 Which makes it a LOT easier to secure VNC. With all hosts setup correctly with “vnc-if” pointing to their local IP, stuff like live migration still works, because “vnc-if” always points to the correct IP on any host in opennebula. Hope this helps anyone, lots of good info in this thread 🙂 EDIT: forgot to mention, with the above config, you only need to enable 443 (HTTPS) and 29876 (VNC proxy) in your (physical) firewall of Sunstone. [Next page](https://forum.opennebula.io/t/vnc-with-sunstone-behind-nginx-proxy/426.md?page=2)