Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have multiple tomcat servers (X, Y, Z). They all make API calls to some servers (A, B, C).
What I need to happen is this: Servers X,Y,Z are on AWS EC2. Servers A,B,C I have no control on where they are but their requirements are that they need IPs of servers X,Y,Z so they can specifically whitelist them.

Now let's say my X server changes the IP then I have to go back to the server where I have no control over and request for them to whitelist another IP addy.

Now what I need is some reverse proxy(Highly Available) that when server X sends a request to server A then server A only sees the IP of the proxy. And then when server A sends a response back to server A it also sends a response to this proxy server and then proxy server knows to forward it back to original requester server A.

How can I do something like this ? This is all centos 6 and again servers A,B,C are all partners and I have no control over those servers. I just want to be able to give them 1 or 2 ips (Proxy servers). And proxy servers basically will act as a gateway for the API calls between servers XYZ and ABC.

Thanks in advance!!!

share|improve this question
1  
You are thinking of a normal (forward) proxy, not a reverse proxy. –  Michael Hampton Oct 23 '12 at 23:25

2 Answers 2

The best way is to have a proxy server (squid) between x,y,z and abc. that way api calls are sent through proxy server and you only need to white list the ip address of the proxy server.

share|improve this answer
    
I was looking at squid already but don't see any config examples that would do this. Have you ever done that before ? Any configuration examples you might have ? Thanks –  Vovans Oct 23 '12 at 23:59

Do you have a good reason to believe that your new proxies will change their IP addresses less frequently than your X/Y/Z servers? If not, then adding proxies won't save you any work.

I suggest that you create a domain name in DNS and ask A/B/C to resolve it periodically (or on-demand) and automatically update their whitelists when it changes. Meanwhile, you publish the current X/Y/Z addresses as that domain name. It's less work in the medium-to-long term, and there's a clear path to making it more secure (DNSSEC and IPSECKEY) in the future.

share|improve this answer
    
Well, that is not an option. As I said that the partners want IPs specifically. I want to put 2-4-6(whatever needed) boxes in a very highly available mode in Rackspace or Amazon with support and just deal with those IP addresses. The XYZ servers I want to be able to auto-scale remove/add on the fly without partners changes. –  Vovans Oct 24 '12 at 19:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.