# Running OOD behind reverse proxy on a different port

**URL:** <https://discourse.openondemand.org/t/running-ood-behind-reverse-proxy-on-a-different-port/4722>\
**Category:** Get Help\
**Tags:** question\
**Created:** [January 23, 2026, 10:14am UTC](https://discourse.openondemand.org/t/running-ood-behind-reverse-proxy-on-a-different-port/4722 "2026-01-23T10:14:35Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![keysmashes](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/keysmashes/32/3227_2.png) [@keysmashes](https://discourse.openondemand.org/u/keysmashes)\
**Post date:** [January 23, 2026, 10:14am UTC](https://discourse.openondemand.org/t/running-ood-behind-reverse-proxy-on-a-different-port/4722/1 "2026-01-23T10:14:35Z")

</div>

Hey folks. I’m trying to set up OOD behind a reverse proxy which does TLS termination, and for irritating internal network reasons I’m hoping to have the reverseproxy↔OOD communication done on port 8000 (but expose it to the world on port 443 as usual). Setting `listen_addr_port: 8000` and `port: 8000` doesn’t seem to work – the redirect to `/pun/sys/dashboard` sends me to port 8000. (And it uses the `http` scheme, but that’s not such a big problem.)

I’ve looked through a bunch of posts about this, but I can’t find any suggestions other than “don’t do that”. Has anyone done this successfully?

---

<div class="post-metadata">

**Author:** ![bsingleton](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/bsingleton/32/3343_2.png) [@bsingleton](https://discourse.openondemand.org/u/bsingleton)\
**Post date:** [January 23, 2026, 4:39pm UTC](https://discourse.openondemand.org/t/running-ood-behind-reverse-proxy-on-a-different-port/4722/2 "2026-01-23T16:39:38Z")

</div>

Hi and welcome Ash!

Unfortunately this isn’t something we support yet, but you might try something with `iptables` to route things around those defaults. If you want to share more about the specific network limitations you are working with someone might have more concrete suggestions for workarounds.

We would be happy to fix this in the future though, and perhaps your redirect issue is related to [app init url not being set correctly in proxies · Issue #4768 · OSC/ondemand · GitHub](https://github.com/OSC/ondemand/issues/4768) ? Check it out and see if that captures your problem, if not then we can make a new issue upstream.

---

<div class="post-metadata">

**Author:** ![keysmashes](https://sea1.discourse-cdn.com/flex015/user_avatar/discourse.openondemand.org/keysmashes/32/3227_2.png) [@keysmashes](https://discourse.openondemand.org/u/keysmashes)\
**Post date:** [January 27, 2026, 10:11am UTC](https://discourse.openondemand.org/t/running-ood-behind-reverse-proxy-on-a-different-port/4722/3 "2026-01-27T10:11:43Z")

</div>

That looks like about the same issue to me, thank you for the link!

---

<div class="post-metadata">

**Author:** ![Elijah\_Gagne](https://avatars.discourse-cdn.com/v4/letter/e/ee7513/32.png) [@Elijah\_Gagne](https://discourse.openondemand.org/u/Elijah_Gagne)\
**Post date:** [January 27, 2026, 5:08pm UTC](https://discourse.openondemand.org/t/running-ood-behind-reverse-proxy-on-a-different-port/4722/4 "2026-01-27T17:08:24Z")

</div>

I can comment that Dartmouth has successfully deployed OOD behind a double proxy. Here’s our path:

- Client connects on port 443 to [https://ood.dartmouth.edu/](https://ood.dartmouth.edu/).
- HA Proxy receives the request and sends TLS traffic to the backend server on port 8443
- Apache #1 uses mod\_auth\_cas to require single sign-on authentication. It is listening on port 8443 and is running in a Docker container on the VM that runs OOD.
- Apache #2 runs directly on the server and uses mod\_auth\_gssapi and is listening on port 443. Apache #1 proxies to Apache #2.

Here’s some of the proxy config in Apache #1

…

General setup for the virtual host  
DocumentRoot “/usr/local/apache2/htdocs”  
SSLProxyEngine on  
SSLProxyVerify none  
SSLProxyCheckPeerName off  
SSLProxyCheckPeerExpire off  
ProxyErrorOverride off  
ProxyPreserveHost on  
ProxyPassMatch ^/rnode/(.)$ wss://10.0.0.5:443/rnode/$1  
ProxyPassMatch ^/node/(.)$ wss://10.0.0.5:443/node/$1  
ProxyPassMatch ^/pun/sys/shell/ssh/(.\*)$ wss://10.0.0.5:443/pun/sys/shell/ssh/$1  
ProxyPass / [https://10.0.0.5:443/](https://10.0.0.5:443/)  
ProxyPassReverse / [https://10.0.0.5:443/](https://10.0.0.5:443/)  
ProxyTimeout 300  
ServerName ood.dartmouth.edu:443  
ServerAdmin research.computing@dartmouth.edu  
ErrorLog /proc/self/fd/2TransferLog /proc/self/fd/1  
…

Internal IPs have been changed. You can see more details at

> **[GitHub - dartmouth/ondemand-gssapi-cas: Open OnDemand setup using both mod\_auth\_gssapi and...](https://github.com/dartmouth/ondemand-gssapi-cas)**
>
> Open OnDemand setup using both mod\_auth\_gssapi and mod\_auth\_cas

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/osc/original/2X/b/bae70bd0ed39a3ae769c2108155f4cb3e9da8385.png) [@system](https://discourse.openondemand.org/u/system)\
**Post date:** [July 26, 2026, 5:09pm UTC](https://discourse.openondemand.org/t/running-ood-behind-reverse-proxy-on-a-different-port/4722/5 "2026-07-26T17:09:21Z")

</div>

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.