I'm building a clearnet-to-Tor gateway where:

• Nginx on port 80 should proxy requests to a Tor hidden service

• Using Privoxy (port 8118) as HTTP-to-SOCKS bridge to Tor (port 9050)

• Direct Privoxy works, but Nginx → Privoxy fails with "Invalid header received from client"

working:

• Hidden service accessible via Tor: torsocks curl http://my-onion.onion

• Privoxy direct access: curl -x http://127.0.0.1:8118 http://my-onion.onion

• Hidden service nginx config (port 8080) serves HTML correctly

failing:

• Nginx proxy to Privoxy: curl http://localhost → 502 Bad Gateway

• Privoxy logs show: "Invalid header received from client"

Configs:

Nginx gateway (/etc/nginx/sites-available/gateway):

nginx

server {
    listen 80;
    server_name localhost;
    
    location / {
        proxy_pass http://127.0.0.1:8118;
        proxy_set_header Host "my-onion.onion";
        proxy_set_header X-Forwarded-For "";
    }
}

Privoxy config (/etc/privoxy/config):

text

forward-socks5 / 127.0.0.1:9050 .

Tor hidden service (/etc/tor/torrc):

text

HiddenServiceDir /var/lib/tor/hidden_service/
HiddenServicePort 80 127.0.0.1:8080

Attempted fixes:

1. Various proxy_set_header combinations (empty Host, etc.)

2. proxy_http_version 1.1

3. Using Tor's HTTPTunnelPort 9060 instead of Privoxy

4. Different resolver configurations

Privoxy works alone but Nginx can't properly forward requests to it. Need Nginx to successfully proxy through Privoxy to Tor hidden service.