Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking at the Barracuda Web Application Firewall to sit in front of a LAMP server at a colo facility.

From what I gather in the documentation, you can set it up in bridged mode or routed mode, where routed mode is quoted as being "preferred as it's more secure".

Assuming that you have a firewall in front of the Barracuda, the design in my head looks like this:

LAMP server ---- Barracuda ------ firewall/router


Barracuda: LAN: WAN: GW:

Firewall: WAN: LAN:

So basically the Barracuda is the inside DMZ firewall for the LAMP box, which does NAT (inside/outside), and routes to the outside firewall, which in turn does NAT (inside/outside). Double-NAT seems a bit sub-optimal when addressing/routing it this way, but I've seen plenty of diagrams (without IPs mind you) that describe this [server <- reverse proxy <- firewall] configuration.

Is this correct? What about a "normal" reverse proxy like nginx or Apache + mod_proxy? Is that normally bridged or routed? Not sure what's the best way to accomplish this.

share|improve this question
up vote 1 down vote accepted

A "normal" reverse proxy is routed as well, and this is usually regarded as the most optimal configuration for most applications.

There's a few reasons for a "bridged" setup, however most of them are application specific. A bridged setup doesn't modify the request / response (or shouldn't) in any way, whereas a Proxy server acts as a middle man, which can sometimes cause issues.

I don't have a Barracuda Application firewall myself, however i can't assume its much different then a Apache + Mod_Proxy + Mod_Security server.

share|improve this answer
Does my IP addressing make sense? – WuckaChucka Jun 23 '10 at 1:28
Not exactly used to reading it displayed like that, but yes. – GruffTech Jun 23 '10 at 2:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.