Apache Module to hold connections | backend to DMZ - DMZ to backend

Question

I'm looking for an Apache module or plugin which offers me the following functionality. I have an Architecture which includes the following components:

• Internet: mobile device
• External Firewall
• DMZ: Apache based reverse proxy
• InternalFirewall
• Internal Net: backend (Glassfish Application Server)

I only want to open an OUTBOUND Port in the internal Firewall (backend to reverse proxy) - the backend should send a Request to the Apache Reverse Proxy which the Proxy keeps alive. This connection should be used to establish a two-way-communication between the reverse proxy and the backend ( without opening an inbound port in the internal firewall).

The general procedure should be something like this: The backend establishes a communication with the reverse proxy when the it is instantiated. The reverse proxy holds thats request until the mobile handsets does a request against the network. Once the reverse proxy receives that request it sends it to the backend and awaits the answer of the backend.

The backend sends the calcuations or what-so-ever to the handset (over the reverse proxy). The reverse proxy uses this request and keeps-it alive to repeat that circle.

Is there a module for Apache or Nginx which delivers this "relay" functionality?

Answer 1

Is it really that important to not allow the external to establish the initial connection? Your still going to be allowing a two way channel of data to flow no matter who initiates the connection. Your clients inside will be actively trying to open connections to the outside allowing the DMZ to send data to a port on the internal network. Clients can be compromised just like servers can. It's probably safer using known standard protocols than custom client/server setups. Definitely easier to debug/support standard stuff in the long run, unless you happen to come up with the 'next big thing'.

You could also use some convoluted ip tunnel setup that is established from the inside to satisfy the firewall rule, but again I have to ask why bother. You still end up with a port on the inside the DMZ can send data to.

That being said, there is a another web server called Mongrel2 which can use ZeroMQ to talk to Handlers, backends that do some processing. This is done with PUSH/PULL and PUB/SUB sockets so the publisher (proxy/dmz server) will bind to a port and wait for subscribers (clients/backends/workers) to connect and then messages will be sent to connected clients.

There were some ZeroMQ modules being developed for Nginx/Apache when I last looked but they were a bit green and didn't function in the same way. They were more a standard proxy type setup where apache/nginx would be a client of remote queues as it would be a client of a remote http server in a proxy setup.