[GH-ISSUE #2091] Trying to open my rmm server to an external proxy server #3245

New issue

Closed

opened 2026-03-14 06:57:32 +03:00 by kerem · 0 comments

kerem commented

2026-03-14 06:57:32 +03:00

Owner

Originally created by @gabmega on GitHub (Dec 3, 2024).
Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/2091

I have some servers that have to run on the same public ip, for this I use an nginx server, however I need to install rmm on a server, and it must be accessible via the same public ip and with a subdomain of the same dns name

I've made great progress, and I can now log in and manage things via rmm. However, I am still facing 2 problems, in the api log there is an error with natsws, and the mesh cannot connect to the computer remotely, the "connect" button is disabled when I use "take control"

My rmm server: 192.168.1.41
My Nginx server: 192.168.1.54

Nginx log error:
2024/12/03 18:47:39 [error] 817#817: *1085253 recv() failed (104: Unknown error) while proxying upgraded connection, client: (my public ip), server: api.example.com, request: "GET /natsws HTTP/1.1", upstream: "http://192.168.1.41:8080/natsws", host: "api.example.com"

Rmm api log error:
2024/12/03 20:25:12 [error] 735#735: *14458 recv() failed (104: Connection reset by peer) while proxying upgraded connection, client: 192.168.1.54, server: , request: "GET /natsws HTTP/1.1", upstream: "http://127.0.0.1:9235/natsws", host: "api.example.com"

Nginx server > /etc/nginx/sites-available/rmm.conf

server {
    listen 80;
    server_name rmm.example.com api.example.com mesh.example.com;

    location / {
        return 301 https://$host$request_uri;
    }
}

server {
        listen 443 ssl;
        listen [::]:443 ssl;
        server_name rmm.example.com;

        ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_prefer_server_ciphers on;
        ssl_ciphers EECDH+AESGCM:EDH+AESGCM;
        ssl_ecdh_curve secp384r1;
        ssl_stapling on;
        ssl_stapling_verify on;
        add_header X-Content-Type-Options nosniff;

        error_log  /var/log/nginx/rmm-frontend-error.log;
        access_log /var/log/nginx/rmm-frontend-access.log;

        location / {

                proxy_pass http://192.168.1.41:80;
                proxy_set_header Host $host;
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;

        }
}

server {
        listen 443 ssl;
        listen [::]:443 ssl;
        server_name mesh.example.com;

        proxy_send_timeout 330s;
        proxy_read_timeout 330s;

        ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

        ssl_session_cache shared:WEBSSL:10m;

        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_prefer_server_ciphers on;
        ssl_ciphers EECDH+AESGCM:EDH+AESGCM;
        ssl_ecdh_curve secp384r1;
        ssl_stapling on;
        ssl_stapling_verify on;
        add_header X-Content-Type-Options nosniff;

        error_log  /var/log/nginx/rmm-mesh-error.log;
        access_log /var/log/nginx/rmm-api-access.log;

        location / {

                proxy_pass http://192.168.1.41:4430/;
                proxy_http_version 1.1;

                proxy_set_header Host $host;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
                proxy_set_header X-Forwarded-Host $host:$server_port;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;

        }

}


server {

        listen 443 ssl reuseport;
        listen [::]:443 ssl;
        server_name api.example.com;

        client_max_body_size 300M;

        error_log  /var/log/nginx/rmm-api-error.log;
        access_log /var/log/nginx/rmm-api-access.log;

        ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_prefer_server_ciphers on;
        ssl_ciphers EECDH+AESGCM:EDH+AESGCM;
        ssl_ecdh_curve secp384r1;
        ssl_stapling on;
        ssl_stapling_verify on;
        add_header X-Content-Type-Options nosniff;

        location / {

                proxy_pass http://192.168.1.41:8080/;
                proxy_http_version 1.1;

                proxy_set_header Host $host;
                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "upgrade";
                proxy_set_header X-Real-IP $remote_addr;
                proxy_set_header X-Forwarded-Host $host:$server_port;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto $scheme;

                uwsgi_read_timeout 300s;
                uwsgi_ignore_client_abort on;

        }
}

Rmm server > /etc/nginx/sites-available/rmm.conf

server_tokens off;

upstream tacticalrmm {
    server unix:////rmm/api/tacticalrmm/tacticalrmm.sock;
}

map $http_user_agent $ignore_ua {
    "~python-requests.*" 0;
    "~go-resty.*" 0;
    default 1;
}

server {
    listen 8080 default_server;
    listen [::]:8080 default_server;

    client_max_body_size 300M;

    access_log /rmm/api/tacticalrmm/tacticalrmm/private/log/access.log combined if=$ignore_ua;
    error_log /rmm/api/tacticalrmm/tacticalrmm/private/log/error.log;

    location /static/ {
        root /rmm/api/tacticalrmm;
        add_header "Access-Control-Allow-Origin" "https://rmm.example.com";
    }

    location /private/ {
        internal;
        add_header "Access-Control-Allow-Origin" "https://rmm.example.com";
        alias /rmm/api/tacticalrmm/tacticalrmm/private/;
    }

    location /assets/ {
        internal;
        add_header "Access-Control-Allow-Origin" "https://rmm.example.com";
        alias /opt/tactical/reporting/assets/;
    }

    location ~ ^/ws/ {
        proxy_pass http://unix:/rmm/daphne.sock;

        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_redirect     off;
        proxy_set_header   Host $host;
        proxy_set_header   X-Real-IP $remote_addr;
        proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header   X-Forwarded-Host $server_name;
    }

    location ~ ^/natsws {
        proxy_pass http://127.0.0.1:9235;
        proxy_http_version 1.1;

        proxy_set_header Host $host;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header X-Forwarded-Host $host:$server_port;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location / {
        uwsgi_pass  tacticalrmm;
        include     /etc/nginx/uwsgi_params;
        uwsgi_read_timeout 300s;
        uwsgi_ignore_client_abort on;
    }
}

Rmm server > /etc/nginx/sites-available/frontend.conf

server {
    listen 80 default_server;
    listen [::]:80 default_server;

    charset utf-8;

    location / {
        root /var/www/rmm/dist;
        try_files $uri $uri/ /index.html;
        add_header Cache-Control "no-store, no-cache, must-revalidate";
        add_header Pragma "no-cache";
    }

    error_log  /var/log/nginx/frontend-error.log;
    access_log /var/log/nginx/frontend-access.log;

}

Any advice on how to solve my problem would be a great help.

Originally created by @gabmega on GitHub (Dec 3, 2024). Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/2091 I have some servers that have to run on the same public ip, for this I use an nginx server, however I need to install rmm on a server, and it must be accessible via the same public ip and with a subdomain of the same dns name I've made great progress, and I can now log in and manage things via rmm. However, I am still facing 2 problems, in the api log there is an error with natsws, and the mesh cannot connect to the computer remotely, the "connect" button is disabled when I use "take control" My rmm server: 192.168.1.41 My Nginx server: 192.168.1.54 Nginx log error: `2024/12/03 18:47:39 [error] 817#817: *1085253 recv() failed (104: Unknown error) while proxying upgraded connection, client: (my public ip), server: api.example.com, request: "GET /natsws HTTP/1.1", upstream: "http://192.168.1.41:8080/natsws", host: "api.example.com"` Rmm api log error: `2024/12/03 20:25:12 [error] 735#735: *14458 recv() failed (104: Connection reset by peer) while proxying upgraded connection, client: 192.168.1.54, server: , request: "GET /natsws HTTP/1.1", upstream: "http://127.0.0.1:9235/natsws", host: "api.example.com"` Nginx server > /etc/nginx/sites-available/rmm.conf ``` server { listen 80; server_name rmm.example.com api.example.com mesh.example.com; location / { return 301 https://$host$request_uri; } } server { listen 443 ssl; listen [::]:443 ssl; server_name rmm.example.com; ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; ssl_protocols TLSv1.2 TLSv1.3; ssl_prefer_server_ciphers on; ssl_ciphers EECDH+AESGCM:EDH+AESGCM; ssl_ecdh_curve secp384r1; ssl_stapling on; ssl_stapling_verify on; add_header X-Content-Type-Options nosniff; error_log /var/log/nginx/rmm-frontend-error.log; access_log /var/log/nginx/rmm-frontend-access.log; location / { proxy_pass http://192.168.1.41:80; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } } server { listen 443 ssl; listen [::]:443 ssl; server_name mesh.example.com; proxy_send_timeout 330s; proxy_read_timeout 330s; ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; ssl_session_cache shared:WEBSSL:10m; ssl_protocols TLSv1.2 TLSv1.3; ssl_prefer_server_ciphers on; ssl_ciphers EECDH+AESGCM:EDH+AESGCM; ssl_ecdh_curve secp384r1; ssl_stapling on; ssl_stapling_verify on; add_header X-Content-Type-Options nosniff; error_log /var/log/nginx/rmm-mesh-error.log; access_log /var/log/nginx/rmm-api-access.log; location / { proxy_pass http://192.168.1.41:4430/; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header X-Forwarded-Host $host:$server_port; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } } server { listen 443 ssl reuseport; listen [::]:443 ssl; server_name api.example.com; client_max_body_size 300M; error_log /var/log/nginx/rmm-api-error.log; access_log /var/log/nginx/rmm-api-access.log; ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; ssl_protocols TLSv1.2 TLSv1.3; ssl_prefer_server_ciphers on; ssl_ciphers EECDH+AESGCM:EDH+AESGCM; ssl_ecdh_curve secp384r1; ssl_stapling on; ssl_stapling_verify on; add_header X-Content-Type-Options nosniff; location / { proxy_pass http://192.168.1.41:8080/; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-Host $host:$server_port; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; uwsgi_read_timeout 300s; uwsgi_ignore_client_abort on; } } ``` Rmm server > /etc/nginx/sites-available/rmm.conf ``` server_tokens off; upstream tacticalrmm { server unix:////rmm/api/tacticalrmm/tacticalrmm.sock; } map $http_user_agent $ignore_ua { "~python-requests.*" 0; "~go-resty.*" 0; default 1; } server { listen 8080 default_server; listen [::]:8080 default_server; client_max_body_size 300M; access_log /rmm/api/tacticalrmm/tacticalrmm/private/log/access.log combined if=$ignore_ua; error_log /rmm/api/tacticalrmm/tacticalrmm/private/log/error.log; location /static/ { root /rmm/api/tacticalrmm; add_header "Access-Control-Allow-Origin" "https://rmm.example.com"; } location /private/ { internal; add_header "Access-Control-Allow-Origin" "https://rmm.example.com"; alias /rmm/api/tacticalrmm/tacticalrmm/private/; } location /assets/ { internal; add_header "Access-Control-Allow-Origin" "https://rmm.example.com"; alias /opt/tactical/reporting/assets/; } location ~ ^/ws/ { proxy_pass http://unix:/rmm/daphne.sock; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_redirect off; proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Host $server_name; } location ~ ^/natsws { proxy_pass http://127.0.0.1:9235; proxy_http_version 1.1; proxy_set_header Host $host; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; proxy_set_header X-Forwarded-Host $host:$server_port; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; } location / { uwsgi_pass tacticalrmm; include /etc/nginx/uwsgi_params; uwsgi_read_timeout 300s; uwsgi_ignore_client_abort on; } } ``` Rmm server > /etc/nginx/sites-available/frontend.conf ``` server { listen 80 default_server; listen [::]:80 default_server; charset utf-8; location / { root /var/www/rmm/dist; try_files $uri $uri/ /index.html; add_header Cache-Control "no-store, no-cache, must-revalidate"; add_header Pragma "no-cache"; } error_log /var/log/nginx/frontend-error.log; access_log /var/log/nginx/frontend-access.log; } ``` Any advice on how to solve my problem would be a great help.