NginxProxyManager / NginxProxyManager/nginx-proxy-manager
Add support for Server Name Indication (SNI)-based routing for TCP/UDP streams in Nginx Proxy Manager.
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 34.2k
- Forks
- 3.9k
- Avg merge
- 21h 12m
- Merged PRs (30d)
- 20
Description
Description: Currently, Nginx Proxy Manager allows for simple TCP/UDP stream forwarding but lacks advanced routing capabilities based on the requested domain name (SNI). Enabling SNI-based routing for streams would allow users to direct traffic to specific backend servers based on the hostname provided by the client during the TLS handshake. This feature would mirror the SNI-based routing commonly used in HTTP proxies, but extend its benefits to TCP and UDP streams, such as SSH and other non-HTTP protocols that require secure, domain-specific routing.
Use Cases:
-
Multi-Server SSH Access: Organizations with multiple servers that need to be accessible over SSH (e.g., server1.example.com, server2.example.com) can route SSH connections to the correct backend server using only the hostname in the request, without needing separate ports for each server. This would simplify access and allow DNS-based routing to specific servers.
-
Load Balancing Across TCP/UDP Applications: Services using custom TCP/UDP protocols could benefit from SNI-based routing, providing flexibility and load distribution across multiple servers for protocols that aren’t HTTP-based.
-
Simplified Network Configuration: By using SNI-based routing, administrators can reduce the need for complex port mapping schemes and assign services based on domains rather than ports, making configurations more readable and scalable.
Advantages:
- Improves Scalability: Users can host multiple TCP/UDP services on the same IP and port but differentiate them based on domain, reducing the need for multiple IP addresses or custom port configurations.
- Enhanced Security and Isolation: SNI-based routing can enforce domain-specific access, making it easier to segregate traffic and apply domain-based rules.
- Streamlined User Access: Clients can connect to services directly via hostname without needing to remember unique ports, which is especially beneficial for protocols like SSH or databases over TLS.
Suggested Implementation: Implement SNI-based routing within the "Streams" section of Nginx Proxy Manager to allow administrators to set up stream proxies that route based on the SNI hostname. This would likely require expanding the current stream configuration options and allowing users to specify hostnames directly for each stream backend.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in the Streams section and inspect the existing stream forwarding configuration and its frontend and backend entry points. Define how administrators would specify SNI hostnames and backend targets, then verify that multiple TCP/UDP stream routes can be configured and selected by hostname, with coverage for the supported stream behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- nginx, typescript
- Domain
- backend, networking
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100