Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a really crappy VPS, and a really good computer at my office (with a really good internet connection), but behind a NAT.

Is it possible to expose my good computer by doing this:

  1. The good computer connects to the VPS (and keeps the connection alive)
  2. The users connects to the VPS, and sends http(s) requests to the VPS.
  3. The VPS just passes that http(s) requests to the good computer (including some identifications, so the servers can distinguish connections)
  4. The good computer passes that http(s) response to the VPS
  5. In turn, the VPS receives the http(s) response, and passes back to the client.

Is it possible to do this? (btw, the VPS and the good computer are located in different countries)

And also, is this "reverse proxy"? I heard that reverse proxy is for protecting the internal network by putting a middle server.

And will this affect SSL configurations? (or make SSL impossible?) I'm intending to run nginx on the good computer.

share|improve this question

closed as off topic by EightBitTony, Tim Brigham, Wesley, voretaq7 Jul 28 '12 at 0:24

Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Which protocol should be used to connect to the Good machine ? RDP ? VNC ? SSH ? SFTP ? HTTPS ? –  Dom Jun 6 '12 at 10:38
    
I'm thinking about http, https, and ssh. –  user269334 Jun 6 '12 at 10:55
    
btw, Do I need to set up encryption between the VPS and the good computer??? –  user269334 Jun 6 '12 at 10:56
2  
This sounds like it may be violating security precautions in your corporate network; you really should clear this with your manager if you want to do this above the board. –  Mike Pennington Jun 6 '12 at 12:04

2 Answers 2

Yes - it's just a VPN, trying to implement a VPN tunnel over HTTP is a bit silly though:

 [client]
    ^
    |
    | HTTP[S]
    v
 [VPS running proxy]
    ^
    | VPN
    |
    V
 [Good computer]

If there's NAT between the VPS and the good computer, then using a tunneling VPN protocol is the way to go.

IIRC, neither squid nor varnish support SSL - while you can add, say, stunnel to terminate the SSL, it'd make a lot more sense to use nginx as the proxy.

Do make very sure that the VPS only proxies connections to the designated host.

share|improve this answer

Personally I'd only bother with a squid reverse proxy for the http and https workloads as it will save the transfer of data over your office connection. SSH traffic is low volume so that would be fine to go direct as long as you are using shared key authentication rather than password authentication.

An alternative strategy (if protecting your internal network is important) would be to use a DMZ within your local network. The good PC would be in the DMZ and serve clients directly.

None of this is best practice of course. Reverse proxies are usually used for load balancing and freeing CPU or bandwidth from the main webserver not for hiding a server. You've got to remember that your plan will add latency to every request especially with VPN between the local machine and the VPS.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.