test

Oracle iPlanet Web Proxy Server 4.0.14 Administration Guide

Chapter 14 Using a Reverse Proxy

This chapter describes how to use Proxy Server as a reverse proxy. A reverse proxy can be used outside the firewall to represent a secure content server to outside clients, preventing direct, unmonitored access to your server’s data from outside your company. It can also be used for replication; that is, multiple proxies can be attached in front of a heavily used server for load balancing. This chapter describes the alternate ways that Proxy Server can be used inside or outside a firewall.

This chapter contains the following sections:

How Reverse Proxying Works

You can use two different methods for reverse proxying. One method takes advantage of Proxy Server’s security features to handle transactions. The other method uses caching to provide load balancing on a heavily used server. Both of these mehtods differ from the conventional proxy usage because they do not operate strictly on a firewall.

Proxy as a Stand-in for a Server

If you have a content server that has sensitive information that must remain secure, such as a database of credit card numbers, you can set up a proxy outside the firewall as a stand–in for your content server. When outside clients try to access the content server, they are sent to the proxy server instead. The real content resides on your content server, safely inside the firewall. The proxy server resides outside the firewall, and appears to the client to be the content server.

When a client makes a request to your site, the request goes to the proxy server. The proxy server then sends the client’s request through a specific passage in the firewall to the content server. The content server passes the result through the passage back to the proxy. The proxy sends the retrieved information to the client, as if the proxy were the actual content server, as shown in Figure 14–1. If the content server returns an error message, the proxy server can intercept the message and change any URLs listed in the headers before sending the message to the client. This behavior prevents external clients from getting redirection URLs to the internal content server.

In this way, the proxy provides an additional barrier between the secure database and the possibility of malicious attack. In the unlikely event of a successful attack, the perpetrator is more likely to be restricted only to the information involved in a single transaction, as opposed to having access to the entire database. The unauthorized user can not get to the real content server because the firewall passage allows only the proxy server to have access.

Figure 14–1 Reverse Proxy Process

Diagram showing a reverse proxy that appears like the content server.

You can configure the firewall router to allow a specific server on a specific port (in this case, the proxy on its assigned port) to have access through the firewall without allowing any other machines in or out.

Secure Reverse Proxying

Secure reverse proxying occurs when one or more of the connections between the proxy server and another machine use the Secure Sockets Layer (SSL) protocol to encrypt data.

Secure reverse proxying has many uses:

Secure reverse proxying causes each secure connection to be slower due to the overhead involved in encrypting your data. However, because SSL provides a caching mechanism, two connecting parties can reuse previously negotiated security parameters, dramatically reducing the overhead on subsequent connections.

The three ways to configure a secure reverse proxy are:

Figure 14–2 Secure client connection to proxy

Diagram showing a secure client connection to proxy.

Figure 14–3 Secure Proxy Connection to Content Server

Diagram showing a secure proxy connection to content server.

Figure 14–4 Secure Client Connection to Proxy and Secure Proxy Connection to Content Server

Diagram showing a secure client connection to proxy and a secure proxy connection to content server.

For information about how to set up each of these configurations, see Setting up a Reverse Proxy.

In addition to SSL, the proxy can use client authentication, which requires that a computer making a request to the proxy provides a certificate or other form of identification to verify its identity.

Proxying for Load Balancing

You can use multiple proxy servers within an organization to balance the network load among web servers. This model takes advantage of the caching features of the proxy server to create a server pool for load balancing. In this case, the proxy servers can be on either side of the firewall. If you have a web server that receives a high number of requests per day, you could use proxy servers to take the load off the web server and make the network access more efficient.

The proxy servers act as go-betweens for client requests to the real server. The proxy servers cache the requested documents. If you have more than one proxy server, DNS can route the requests randomly using a “round-robin” selection of their IP addresses. The client uses the same URL each time, but the route the request takes might go through a different proxy each time.

The advantage of using multiple proxies to handle requests to one heavily used content server is that the server can handle a heavier load, and more efficiently than it could alone. After an initial start-up period in which the proxies retrieve documents from the content server for the first time, the number of requests to the content server can drop dramatically.

Only CGI requests and occasional new requests must go all the way to the content server. The rest can be handled by a proxy. For example, suppose that 90% of the requests to your server are not CGI requests, which means they can be cached, and that your content server receives 2 million hits per day. In this situation, if you connect three reverse proxies and each of them handles 2 million hits per day, about 6 million hits per day would then be possible. The 10% of requests that reach the content server could add up to about 200,000 hits from each proxy per day, or only 600,000 total, which is far more efficient. The number of hits could increase from approximately 2 million to 6 million, and the load on the content server could decrease correspondingly from 2 million to 600,000. Your actual results would depend upon your situation.

Figure 14–5 Proxy Used for Load Balancing

Diagram showing a proxy used for load balancing where all requests go to a central DNS server that routes the requests to any proxy server.

Setting up a Reverse Proxy

To set up a reverse proxy, you need two mappings: a regular and a reverse mapping.

Caution – Caution –

Do not use a reverse proxy with a proxy that serves autoconfiguration files, because the proxy could return the wrong result.

Suppose you have a web server called http://http.site.com/ and you want to set up a reverse proxy server for it. You could call the reverse proxy http://proxy.site.com/.

ProcedureTo Create Regular or Reverse Mapping

  1. Access the Server Manager, and click the URLs tab.

  2. Click the Create Mapping link.

    The Create Mapping page is displayed.

  3. In the page that appears, provide the source prefix and source destination for the regular mapping,

    for example,

    Source prefix: http://proxy.site.com

    Source destination: http://http.site.com/

  4. Click OK.

    Return to the page and create the reverse mapping, for example,

    Reverse mapping:

    Source prefix: http://http.site.com/

    Source destination: http://proxy.site.com/

  5. To make the change, click OK.

    Once you click the OK button, the proxy server adds one or more additional mappings. To see the mappings, click the lView/Edit Mappings link. Additional mappings would be in the following format:

    from: /

    to: http://http.site.com/

    These additional automatic mappings are for users who connect to the reverse proxy as a normal server. The first mapping is to catch users connecting to the reverse proxy as a regular proxy. The “/” mapping is added only if the user doesn't change the contents of the Map Source Prefix text box provided automatically by the Administration GUI. Depending on the setup, usually the second mapping is the only one required, but the extra mapping does not cause problems in the proxy.

    Note –

    If the web server has several DNS aliases, each alias should have a corresponding regular mapping. If the web server generates redirects with several DNS aliases to itself, each of those aliases should have a corresponding reverse mapping.

    CGI applications still run on the origin server. The proxy server never runs CGI applications on its own. However, if the CGI script indicates that the result can be cached by implying a non-zero time-to-live by issuing a Last-modified or Expires header, the proxy will cache the result.

    When authoring content for the web server, keep in mind that the content will be served by the reverse proxy, too, so all links to files on the web server should be relative links. Do not refer to the host name in the HTML files. All links must consist only of the page:

    /abc/def

    as opposed to a fully qualified host name, such as:

    http://http.site.com/abc/def

    Note –

    You can provide custom error pages for the errors that occur in reverse proxy mode. These error pages override the errors generated by the proxy. This enables you to prevent the client from knowing that a proxy server is configured.

Setting Up a Secure Reverse Proxy

Before setting up secure reverse proxying, you should be familiar with digital certificates, Certificate Authorities, and authentication.

Setting up a secure reverse proxy is almost the same as setting up an insecure reverse proxy. The only difference is that you need to specify HTTPS as the protocol for the files to be encrypted.

Secure Client-to-Proxy

This procedure explains how to set up your secure reverse proxy according to the configuration scenario you choose. To demonstrate how to set up mappings, the instructions suppose that you have a web server called http.site.com and that you want to set up a secure reverse proxy server called proxy.site.com. When following the steps, substitute the name of your web server and proxy for the example names used in the directions.

ProcedureTo Set Up a Secure Client-to-Proxy Mapping

  1. Access the Server Manager, and click the URLs tab.

  2. Click the Create Mapping link.

    The Create Mapping page is displayed.

  3. In the page that appears, set up regular and reverse mappings in the following manner:

    Regular mapping:

    Source prefix: https://proxy.mysite.com

    Source destination: http://http.mysite.com/

    Reverse mapping:

    Source prefix: http://http.mysite.com/

    Source destination: https://proxy.mysite.com/

  4. Save and apply your changes.

    To see the mappings you just created, click the View/Edit Mappings link.

    Note –

    This configuration will only work if your proxy server is running in secure mode. In other words, encryption must be enabled and the proxy must be restarted from the command line. To restart the proxy from the command line, go to the proxy directory and type ./start.

ProcedureTo Set Up a Secure Proxy-to-Content Server Mapping

  1. Access the Server Manager, and click the URLs tab.

  2. Click the Create Mapping link.

    The Create Mapping page is displayed.

  3. In the page that appears, set up regular and reverse mappings in the following manner:

    Regular mapping:

    Source prefix: http://proxy.mysite.com

    Source destination: https://http.mysite.com/

    Reverse mapping:

    Source prefix: https://http.mysite.com/

    Source destination: http://proxy.mysite.com/

  4. Save and Apply your changes.

    To see the mappings you just created, click the link called View/Edit Mappings.

    Note –

    This configuration will only work if your content server is running in secure mode.

ProcedureTo Set up Secure Client-to-Proxy and Secure Proxy-to-Content Server

  1. Access the Server Manager, and click the URLs tab.

  2. Click the Create Mapping link.

    The Create Mapping page is displayed.

  3. In the page that appears, set up regular and reverse mappings in the following manner:

    Regular mapping:

    Source prefix: https://proxy.mysite.com

    Source destination: https://http.mysite.com/

    Reverse mapping:

    Source prefix: https://http.mysite.com/

    Source destination: https://proxy.mysite.com/

  4. Save and Apply your changes.

    To see the mappings you just created, click the link called View/Edit Mappings.

    Note –

    This configuration will only work if your proxy server and content server are running in secure mode. In other words, for the proxy, encryption must be enabled and the proxy must be restarted from the command line. To restart the proxy from the command line, go to the proxy directory and type ./restart.

Disabling the Forward Proxying Feature in a Reverse Proxy Setup

A proxy server instance, when configured as a reverse proxy server, by default does not stop functioning as a forward proxy server. Such a server instance accepts and serves reverse proxy requests as well as forward proxy requests. Further configuration is required to disable the forward proxying feature. You can set up an ACL configuration that denies requests whose URI matches forward proxy format. You can use a Client directive for this purpose:

<Client uri="http://.*">
PathCheck fn="check-acl" acl="http://.*"
<Client>
.
.
.
The "http://.*" ACL can be a deny all ACL as follows:
.
.
acl "http://.*";
deny (all) user="anyone";

Virtual Multihosting in Reverse Proxy

Virtual multihosting is a feature which enables an origin server, such as a reverse proxy server, to respond to multiple DNS aliases as if a different server was installed in each of those addresses. As an example, suppose you have the DNS host names:

Each of these host names could be mapped to the same IP address, the IP address of the reverse proxy. the reverse proxy could then act differently based on which DNS name was used to access it.

Virtual Multihosting enables you to host multiple different *domains* in a single reverse proxy server as well. For example:

You can have a combination of multiple local host names as well as multiple domains, all in a single proxy server:

Functional Details of Virtual Multihosting

The virtual multihosting feature works by specifying the DNS host and domain names or aliases, and then a target URL prefix where requests sent to that host name should be directed. As an example, suppose you have two mappings:

Mappings do not have to go root-to-root. You may specify an additional URL path prefix in the target URL:

The same technique applies to virtual domain mappings. For example, you could use:

The system will look at the HTTP “Host:” header. Based on that header, the system will choose the matching Virtual Multihosting mapping. If none of the multihosting mappings match, the server will continue looking at other mappings in the order that they appear in the configuration file, or perform no mappings if no matches are found. If no matches are found, the proxy will typically issue the “Proxy denies fulfilling the request” response.

ProcedureTo Configure Virtual Multihosting

  1. Access the Server Manager and click the URLs tab.

  2. Click the Configure Virtual Multihosting link.

    The Configure Virtual Multihosting page is displayed.

  3. In the Source Hostname (alias) field, specify the local host name (or DNS alias) that this mapping should apply to.

  4. In the Source Domain Name field, type the local domain name that this mapping should apply to.

    Typically, this name is your own network’s domain name, unless you want to multi host multiple different DNS domains.

  5. In the Destination URL Prefix field, type the target URL prefix where the request will be directed if the host and domain names match the above specifications.

  6. If you are using templates, choose the template name from the Use This Template drop-down list, or leave the value at NONE if you do not want to apply a template.

  7. Click OK.

  8. Click Restart Required.

    The Apply Changes page is displayed.

  9. Click the Restart Proxy Server button to apply the changes.

    Repeat the above steps for each virtual multihosting mapping you want to establish.

    All virtual multihosting mappings appear on the bottom of the Configure Virtual Multihosting page. The Source Hostname (alias) and Source Domain Name fields are merged, together with the proxy’s port number, into a single regular expression that is used to match the “Host:” header.

    For example, if you have host name www, domain example.com, and port number 8080, the following regular expression will appear:

    www(|.example.com)(|:8080)

    This regular expression guarantees a match with all of the following possible combinations that the user might have typed, or the client might have sent. The port number might be omitted by some client software even when it is non-80, as the server was listening on that port.

    • www

    • www:8080

    • www.example.com

    • www.example.com:8080

Notes about Virtual Multihosting