Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm considering various layouts to expose various HTTP API services (running on their own differents servers) through a frontend server dedicated to manage permissions on behalf of the API services.

I've considered various options, from the classical ones like Nginx, Apache, etc. to HAProxy, passing by the various Python webserver solutions like Tornado, Twisted (which gives me the opportunity to implement my own ACL system easily). The foundamental feature is high performance and scalability, and the ability to manage fine grained ACL rules (similar to the HAProxy ACL system)

I would like to know what is a suggested approach to setup what I need, and if (opne source) ready-to-use solutions are already available dedicated to this.

(I'm the user that asked the question). thanks for both the answers. I've just discovered the features of mod_security. I'm going to read the Book. I wasn't sure that WAF were the right tools, but I think it is ;)

The only problem I fear to face is the need of a server restart when I apply chnges to the rules. I hope it isn't required.

HAProxy seems ok, but I prefer something crossplatform. I will give both the solutions a try.

share|improve this question

You did not clearly describe your problem. What is the problem with haproxy? From your statement:

The foundamental feature is high performance and scalability, and the ability to manage fine grained ACL rules.

I can say just use haproxy and it should be OK. It is powerful, flexible, and open source solution. You just need to make sure it has all needed features.

share|improve this answer

Don't really sure that I understand what is your question. You want to filter HTTP requests according to various things?

Use web application firewall, filter with mod_security on apache (mod_proxy for passthrough). It's very powerful and effective. Example: If you are using web services/XML/SOAP/WSDL, then you can even add template XML file to mod_security and it will filter request content according to it. You can forward requests from mod_security to other servers, proxy, block, deny, count arguments, values etc

Additionally with this you can use reverse proxy like squid or varnish, extract REMOTE_ADDR with mod_extract_forwarded on apache et cetera...

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.