simonyun

securing a Foscam FI8910W for external access with an nginx SSL reverse proxy.

Note: This isn’t a fully-baked how-to guide. It’s more of a reminder to myself and a note to others that this can work and is a breeze to set up.

My existing Summer Infant Best View system has been wreaking havoc on my home Wi-Fi (it renders the 2.4GHz band almost useless) and has unimpressive range. At $200, it’s a pricey system that doesn’t perform the way it should, in my opinion.

So I recently bought a Foscam FI8910W IP camera ($70!) to use as a baby monitor. But I was horrified that it uses Basic authentication without SSL. I’d need a reverse proxy to secure the connection between a client and the cheap-but-insecure IP camera.

At first, I tried using Apache, following the steps here. Yeah, maybe Apache is overkill for my needs, but Jeff pointed out today that it’s also tried and true. Anyway, maybe it was because I was attempting to configure Apache while watching the Super Bowl, but at the end of the evening it was not working and I was tired and frustrated. Tomorrow would be a new day.

Since Lamby is the best ops person I know, I mentioned to him what I was trying to do and he suggested nginx. Hmm. I basically combined advice from here and here and had things up and running within 15 minutes, including download, build configuration, compilation, installation, and nginx configuration. (I already had port-forwarding configured on my router.)

Here’s a sample config that works for me:

worker_processes  1;

events {
    worker_connections  1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;

    sendfile            on;
    keepalive_timeout   65;

    server {
        listen          192.168.1.10:443; # local IP address of reverse proxy running nginx
        ssl             on;
        server_name     server.name.here;

        access_log  logs/ssl-access.log;
        error_log   logs/ssl-error.log;

        ssl_certificate     ssl/cert.crt;
        ssl_certificate_key ssl/cert_key.key;

        ssl_protocols               SSLv3 TLSv1 TLSv1.1 TLSv1.2;
        ssl_ciphers                 RC4:HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers   on;
        keepalive_timeout           60;
        ssl_session_cache           shared:SSL:10m;
        ssl_session_timeout         10m;

        location / {
            proxy_pass              http://192.168.1.11:80; # Camera IP:port
            proxy_set_header        Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

            # re-write redirects to http as to https, example: /home
            proxy_redirect http:// https://;
        }

        error_page   500 502 503 504  /50x.html;
        location = /50x.html {
            root   html;
        }
    }
}

Some of that crap probably isn’t necessary and maybe there’s some stuff missing. But I have this working right now and there are other things to do, so this is where I’ll leave you.