Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My goal is fairly typical, so I am hoping that someone else may have implemented a similar setup before.

External client Foo will be connecting to Bar, which is a server with an appropriate firewall exception, and thus visibility into the internal network where app server Baz ( sits. Baz offers a Java app via JNLP.

Current setup

xinetd is running on Bar on port 8080, which redirects through the firewall to internal system Baz port 443, where JNLP is started, and it's fed back to the client Foo, where the Java app kicks off fine and all is well. The Foo client's interaction on the JNLP file does use the same connection which is being 'routed' by xinetd, so no asymmetic routing or anything nasty going on with this setup. Just no protection for the app, which is less than desirable.

xinetd config:

service baz-app {
    disable = no
    type            = UNLISTED
    flag            = IPv4
    socket_type     = stream
    wait            = no
    user            = root
    port            = 80
    #Not functional yet.
    #only_from      =
    redirect        = 443
    log_on_failure  += USERID

Desired setup

Some authentication to protect the App. We've successfully implemented the following:

Apache + mod_ssl + mod_proxy + mod_authz_ldap with Kerberos principal. This is running on port 443, and authentication works fine. The config then should Proxy to the internal system Baz's port 443, where the JNLP should be passed back.

Here is the relevant Apache config:

SSLProxyEngine         on
ProxyPreserveHost      on
<Location />
    ProxyPass   # Baz's internal address.
    .... all authentication options follow ....

The Problem

Using the aforementioned 'Desired Setup', the JNLP does get passed back, although as the ProxyPreserveHost option is set to on, the JNLP file which Foo's WebStart kicks off, expects to connect back to the hostname of Bar on port 443 (which then is just a loop), but unfortunately without the ProxyPreserveHost option, then Foo's WebStart tries to connect to the internal address of Baz (which is blocked on the Firewall to any host other than Bar). Marvel at the desperate length of my plight.

I've tried many many permutations of the above config, even throwing xinetd in to stop the loop by adding another level of redirection, (which results in strange, undocumented(probably) weirdness which I can't even begin to fathom).

At this point i'm finding it tough to see the wood for the trees, and can't seem to extricate myself from this strange Catch 22.

Any advice most welcome.



share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.