Reverse Proxy

[FN-GM]

Hi,

 

In the days where Public IP's are scarce and you have to jump through hoops to get them, I was wondering if anyone is using a reverse proxy to get around this issue? What did you use and what was your experience like please?

 

Thanks

[MattRVBC]

I did investigate this briefly a few months ago and decided against it in the end. The main reason being the fact that this would be a public facing proxy which would be potentially accessible to anyone on the internet therefore wide open to potential attack and exploit.

[dhicks]

In the days where Public IP's are scarce and you have to jump through hoops to get them, I was wondering if anyone is using a reverse proxy to get around this issue?

 

I think I'd decided on Pound in the end:

 

Apsis Gmbh

 

Handily, it can act as an HTTPS frontend to an HTTP-only service, so you can force something to use HTTPS even if it doesn't have built-in support.

[FN-GM]

I did investigate this briefly a few months ago and decided against it in the end. The main reason being the fact that this would be a public facing proxy which would be potentially accessible to anyone on the internet therefore wide open to potential attack and exploit.

 

You can lock it down with firewall rules though. For example make it so it can only access updates on the internet.

[lmgtfy]

Just setup our Smoothwall box the other day to do this. It was really easy, you just turn it on, give the external address and then the internal IP and it just worked.

 

Brilliant if you have Smootwall already

[FN-GM]

We have a smoothwall but our DMZ is on the wrong side of it.

 

We have 2 firewalls and our DMZ is between the 2. The smoothwall being the inner firewall.

[dhicks]

Handily, it can act as an HTTPS frontend to an HTTP-only service, so you can force something to use HTTPS even if it doesn't have built-in support.

 

Just configuring this now. It's worth pointing out that all communication between Pound and the services it is proxying (i.e. your current web servers) is via HTTP, not HTTPS. That should, of course, be over your internal network, and if you are putting all traffic to your web servers through the proxy server anyway, even internal traffic, you can firewall / VLAN off your webservers so that they only respond to the proxy server and keep theat HTTP traffic securly away from any other traffic, but it's something to consider.

[ADMaster]

Do you have a dedicated IP for web access already?

My webserver runs on apache so I’m using the apache proxy modules.

 

We do have an external ip dedicated to our website that forwards to an apache server. From there I can serve the main webpage, or reverse proxy to other internal web services.

I have entries such as /hap and /moodle that will reverse proxy those sites through the single address.

I’ve found some things just don’t work well with a proxy though. What web services are you try to reverse proxy?

[Theblacksheep]

Use UAG. It does the job and some more but has its limitations. Not going to be replaced tho.

 

Server 2012 R2 Web Application Proxy is the replacement.

[m25man]

Sonicwall SRA series, set it and forget it.

[FN-GM]

Sonicwall SRA series, set it and forget it.

 

I thought the SRA series are VPN appliances?

[m25man]

I thought the SRA series are VPN appliances?

 

SSL VPN is just one of their functions.

The latest OS has an HTML5 RDP client so you can log in to the SRA with two factor or AD login then get a predefined RDS session to a windows box from an iPad!

 

With WOL we pre-configure RDP sessions to specific PCs eliminating the need for RDS Servers and licensing so the Head can go home login to there own school PC from any device over SSL.

 

With Application offloading its also possible to access different HTTPS apps over the one SSL connection using a single IP and port.

[FN-GM]

SSL VPN is just one of their functions.

The latest OS has an HTML5 RDP client so you can log in to the SRA with two factor or AD login then get a predefined RDS session to a windows box from an iPad!

 

With WOL we pre-configure RDP sessions to specific PCs eliminating the need for RDS Servers and licensing so the Head can go home login to there own school PC from any device over SSL.

 

With Application offloading its also possible to access different HTTPS apps over the one SSL connection using a single IP and port.

 

I know that, we used to use them. But that kind of stuff requires a login. The general public won't be able to access that stuff.