my question is about proposed implementation of high available and secure FrontEnd to WebApps behind a firewall. The components of the network and their relationships are as follows:
1) 2 WebApps servers behind a firewall (BackEnd), denoted by GUI1 and GUI2, running Web Applications
2) 2 machines LB1 and LB2 located in DMZ configured with floating IP in active/standby mode for redundancy. Their task is
- to give an additional layer of security serving as a proxy (they are performing NAT on packets coming from GUI)
- to handle the traffic basing on inspection of cookies (in fact the only requirement is to achieve cookie-based session persistence, not sophisticated LB techniques)
- The only acceptable communication method with GUI that is allowed (clearly through the FireWall) is via reverse SSH tunnel.
- The traffic incoming to FrontEnd is most often https (and some http)
The question is: what kind of software (open source) is the best option to be implemented on frontend machines LB1 and LB2, to realize these goals? Recall, in short:
- SSL termination (as necessary for inspecting cookie)
- Cookie Based LB
- active/standby mode
I have no practical experience in this field, however it seems that NginX on LB1 and LB2 (to solve SSL and cookies issue) together with HearBeat (to achieve the desired redundancy property) should work.
I am aware that the proposed architecture is somehow similar to HAproxy or LVS (configured as two redundant instances), however I need a solution that guarantees dealing with all described tasks simultaneously (for instance, HAproxy does not support SSL termination).
Any comments and suggestions are welcomed. Thanks!