reverse proxy nginx noVNC problem since V5

[gottlieb]

hello,

i have a problem when i want use noVNC console from my reverse proxy nginx
when i was on proxmox 4, i havent problem, now on proxmox 5 with new console features
i have a black screen on console, he said me connected (encrypted ) on QEMU, but i can nothing
on my local network with IP of proxmox, its work

my nginx config in attach


have you a idea?
thanks

 

[Sunit Kumar Nandi]

I am facing the same issue. Proxying via nginx results in a blank screen in noVNC while direct connections to port 8006 works as intended.

 

[warinthestars]

I am having the same problem. I've tried may different configs and so far nothing has worked.

 

[warinthestars]

So, i'm no longer getting a blank screen when trying to connect to console. However, it's still not 100% working all the time. Here's an example of my config

map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
upstream proxmox {
server 192.168.1.5;
}

server {
listen 80;
rewrite ^(.*) https://DOMAIN.NET permanent;
}

server {
listen 443 ssl;
server_name PROXMOX.DOMAIN.NET;
ssl on;
include snippets/ssl-default.conf;
include snippets/ssl-params.conf;
client_max_body_size 5g;
proxy_read_timeout 3000s;
proxy_send_timeout 3000s;


location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

# Also proxy websocket
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
add_header X-Frame-Options SAMEORIGIN;

# proxy backend
proxy_pass https://192.168.1.50:8006/;
}
}

 

[b3nw]

I am using a similar config based on https://pve.proxmox.com/wiki/Web_Interface_Via_Nginx_Proxy which is close to warinthestars and also am unable to get NoVNC working using a reverse proxy.

 

[psmitty7373]

Same issue. For what its worth I've tried reverse proxying with haproxy also only to have the same issue. Black screens on consoles about 60% of the time.

 

[warinthestars]

I was able to use chrome dev menu to debug a bit.

Adding this line: add_header X-Frame-Options SAMEORIGIN;
stopped a blank screen and started allowing it sometimes. Sometimes it worked with the inline console, sometimes it worked with the pop out window console.

It will still say it's connected and encrypted, but stays blank.

 

[Nayar]

I'm having the same issue. Anyone found a solution?

Works randomly for me.

 

[GabrieleV]

Same problem ...

 

[mir]

The solution to your problems is to enable sticky sessions. Your problem is that your novnc some times makes connection to another node than the one you are currently connected to.

 

[GabrieleV]

I have only one node, and I have the same problem

 

[b3nw]

@mir can you expand on how to enable sticky sessions?

 

[mir]

@mir can you expand on how to enable sticky sessions?

Use ip_hash as distribution algorithm. See: http://nginx.org/en/docs/http/load_balancing.html (Session persistence)

 

[janos]

I can reproducate this also. However, its not happening everytime, but i not see any system in it.

Usually if i press F5 on noVNC windows it start working, but not always.

Config: https://pastebin.com/xZDZpLXJ

 

[Nayar]

Anyways, you guys can also do TCP forwarding like this which works fine

stream {
server {
listen 8006;
proxy_pass 192.168.1.65:8006;
}
}​

But we lose the advanced HTTP ACL features

 

[aychprox]

since current noVNC version in PVE5.1 not work well, possible to downgrade to previous version?
ip_hash nginx work fine for noVNC in PVE4.4.

 

[mir]

I set my domain on my ip and I installed nginx on my proxmox server and map 8006 port on my 443 using this article:
https://pve.proxmox.com/wiki/Web_Interface_Via_Nginx_Proxy
But now I cannot use novnc.
Is there a way to figure this out?

The article misses this in the 'location / { ..' section: add_header X-Frame-Options SAMEORIGIN;

 

[Amin Vakil]

The article misses this in the 'location / { ..' section: add_header X-Frame-Options SAMEORIGIN;

I changed it to be like this:

location / { ...
.
.
.
add_header X-Frame-Options SAMEORIGIN;
}​

Still doesn't work, Am I missing something?
I can verify adding this on my firefox (view image)
As I'm new to forum I can't post my image.
View this link: aminvakil.com/proxmox/1.png

 

[mir]

Still doesn't work, Am I missing something?

Hard to help you without access to the contents of the proper log files. Try run you preferred browser in web developer mode and see what is showing in the console window.

 

[Amin Vakil]

I use firefox and I checked network tab of developers options, and the only sent headers when connecting to vnc websocket different from using IP itself which works novnc on it is Host & Origin.