0

I have configured a reverse proxy and is working ok for one internal server, for example our mail server.

Now, I like to know if it is possible to configure a reverse proxy for only one server /application (in this case our web intranet).

Our problem is Intranet call another aplication inside same intranet server and another internal servers, and the only way that I know to publish this resources is make a reverse proxy in our dmz apache for all apllications servers, but I like that from our DMZ reverse apache only intranet will be called, and other applications will be called by intranet server, and not reverse proxy. I like to configure with this system for security reason, and only allow external access to one server.

I have configured With Debian Squeeze and apache 2.2

It is possible? How?


I'll try to give more information about my environment and what I'm trying to do.

I have a server in a dmz that has a domain published DNS Records https://intranet.domain.com with apache 2 configured as reverse proxy of a local intranet server (https://local_ip/intranet/) config in dmz apache:

<Proxy /intranet/>
    ProxyHTMLLogVerbose On
    ProxyHTMLURLMap     ttps://local_ip/intranet/ /intranet/
    ProxyHTMLURLMap     / /intranet/
    #
    ProxyPass         ttps://local_ip/intranet/
    ProxyPassReverse  ttps://local_ip/intranet/
</Proxy>

local intranet server has some other application called with relative paths ttps://local_ip/app1 as (/app1) ttps://local_ip/app2 as (/app2) ttps://local_ip/app3 as (/app3) and also other application locates on other server and called from intranet server with absolute paths, for example: ttps://server4/app4 ttps://server5/app5

At this moment I can visit our intranet from external source (Internet) with https://intranet.domain.com/intranet/ but if I want to allow to visit other applications called from intranet server I have to configure every application to reverse proxy and allow comunication between dmz/reverse-proxy server and local_ip, server4, server5 ... and we like to allow only between dmz/reverse-proxy and local_ip (intranet server), because other applications only are called from intranet and we want to restrict ips that can visit others servers that are different of intranet server

If I configure every application app4, app5, app1, app2, app3 and /intranet in reverse proxy this works, but this requires to configure all aplication to reverse proxy and with connectivity from dmz

now works....

Internet<--->dmz/reverse-proxy<------>https://local_ip/intranet
                              <--------------------->/app1
                              <--------------------->/app2
                              <--------------------->/app3
                              <--------------------------------->https://server4/app4
                              <--------------------------------->https://server5/app5

I like to configure with this structure:

Internet<--->dmz/reverse-proxy<------>https://local_ip/intranet
                                                         <----->/app1
                                                         <----->/app2
                                                         <----->/app3
                                                         <----->https://server4/app4
                                                         <----->https://server5/app5

The reason for this configuration is to restrict direct access from external access to internal server, and only allow direct access to intranet server from proxy. It is possible? How can I do this? Last question, how can I hide urls when you are visitin intranet or other internal application from itnernet and only show https://intranet.domain.com as fixed url?

1 Answer 1

1

If I understand you correctly, which I'm not sure I do to be honest, then yes you can.

You don't mention how you are doing the reverse proxying, but if you are not already doing so, my advice would be to use mod re-write.

Imaging you have the following: Internal server called private.mydomain.com, which hosts an app, lets call it myApp, that you want to make available to the public via your world-facing web server. This app is at http://private.mydomain.com/myapp.

Your public server is called www, and you want to make the app visible to the world at www.mydomain.com/myapp

You would use Modrewrite on the public server something like this:

RewriteEngine        on
RewriteRule ^/myapp(.*) http://private.mydomain/com/myapp$1 [P,L]

(if you want to reverse proxy HTTPS URLs you also need SSLProxyEngine On)

8
  • At this moment I have configured intranet resource with mod_proxy This is working, but we from /intranet we call othe servers/applications for example url http:://internal_ip2/app2 http:://internal_ip3/app3 or http:://internal_ip/app4 But when we call from internet and domain.com/intranet any resource of internal_ip2 or internal_ip3 is not available, because we like to configure reverse proxy for only intranet server but with access to other server Thanks
    – hrost
    Jun 5, 2012 at 12:36
  • @hrost So, do you want for those other applications on the internal IP addresses to be accessible or not? Jun 5, 2012 at 17:18
  • Shane, Yes I like to allow access to this internal ip addresses, but I like to restrict and allow only proxy reverse of intranet, and another applications that needs access to internal ip, we like that intranet server can make this connection. For security reasons we want to allow reverse proxy and access to internal ip server, but other application willl be called from intranet server without reverse proxy configured for this applications It is possible? Thanks
    – hrost
    Jun 6, 2012 at 13:44
  • You can acheive what ever you want with the right combination of RewriteCond and RewriteRule, you set the rules, and you use [P,L] to proxy what needs proxying - really, the possibilities are endless! You seem to want to acheive something mod rewrite can do for you, while dismissing it because, well, you like mod proxy. Why not use a tool that works and just get the job done?
    – Bart B
    Jun 8, 2012 at 15:28
  • We like to allow a reverse proxy to intranet server (only remote access to this server), and then we want that other applications called from intranet server, this is for security reason and for obtain a simplest and transparent implementation to our resource. Also we have some applications that only can be used from intranet server, and If we use reverse proxy then this applications doesn't work because appears that client ip is proxy and not intranet ip server. Can you detail a an example how can I do this? I have searched information but I can't find information about this example.thanks
    – hrost
    Jun 8, 2012 at 15:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .