0

We have a Web infrastructure with a farm of Web Servers. They are behind a loadbalancer which does SSL offload. We also have a IPS and obviously a set of firewalls.

Now, for security reason we have been asked to look into the possibility of adding a reverse proxy. I insist this is for security reason only as we are not planning to use any caching.

My question is: Is it worth the effort? Is there any added value to an additional layer and if yes would it justify the time spent?

1

1 Answer 1

0

If your webserver is (pre-)forking or uses light weight processes (threads) then using an event based proxy (e.g. ATS, nginx, NOT varnish) in front gives a lot of protection against sloloris type attacks. But in the absence of any caching (or DOS attacks) it's going to slow down your traffic.

Why so anti caching?

2
  • Caching was just not part of the original scope, I am happy to add it if not having it penalise the performance.
    – Momo
    Sep 12, 2013 at 14:30
  • update--Caching was just not part of the original scope, I am happy to add it if not having it penalise the performance significantly. Overall I had the feeling that the reverse-proxy would be redundant with the LB+IPS. I should add that our webservers are in the DMZ only accessible by the LoadBalancer
    – Momo
    Sep 12, 2013 at 14:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .