An Nginx Port-Forwarding Pitfall

I recently made a serious mistake while configuring Nginx port forwarding. Here is what happened.

Our game server used WSS, and Nginx needed to forward many paths to backend WebSocket ports. For example, wss://xxx.com/10000 should reach ws://xxx.com:10000. The requested range was around ports 10000–11000. I did not want to write a thousand separate rules, so I found this configuration online:

1
location ~* ^/(?<port>\d+)$ {
2
    proxy_pass http://127.0.0.1:$port;
3
    proxy_http_version 1.1;
4
    proxy_set_header Upgrade $http_upgrade;
5
    proxy_set_header Connection "Upgrade";
6
    proxy_set_header Host $host;
7
}

At first glance, it seemed to work: take the number after / and use it as the backend port.

Then a colleague noticed the problem. Although our security group exposed only the intended game-server ports, this rule allowed a user to reach any local port indirectly through Nginx’s public port 80 or 443. A small deployment might appear to work normally, but scanning could expose sensitive internal services as traffic grew.

1
location ~* ^/(?<port>(20[0-9]\{3\}))$ {
2
    proxy_pass http://127.0.0.1:$port;
3
    proxy_http_version 1.1;
4
    proxy_set_header Upgrade $http_upgrade;
5
    proxy_set_header Connection "Upgrade";
6
    proxy_set_header Host $host;
7
}

1
location ~* ^/(?<port>2[0-1]\d\d\d)$ {
2
    proxy_pass http://127.0.0.1:$port;
3
    proxy_http_version 1.1;
4
    proxy_set_header Upgrade $http_upgrade;
5
    proxy_set_header Connection "Upgrade";
6
    proxy_set_header Host $host;
7
}