Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have an application (App 'A') that runs on multiple nodes behind a load balancer.

The App sends API requests to another application (App 'B') which currently only accepts API requests from a single IP address. Because App 'A's outbound IP address changes depending on which node the request is sent from, App 'B' cannot authenticate it due to its single API access IP configuration limitation.

Is it possible to set up a proxy server to catch all API requests from App 'A' (regardless of IP address or a set IP Range, or netblock) and forward them to App 'B' via its own static IP?

If so which server/software is best suited to this purpose?

Many thanks,

Eli

share|improve this question
add comment

3 Answers

This depends on the proxy and on the application. If there is an easy destinguishable information in the API request (e.g. all requests go to "/api/") then you might be able set up a rule for this in your proxy.

share|improve this answer
    
Yep. All requests are forwarded to a set URL over SSL (443). Is there any particular proxy that is better at this than another? –  Elijah Paul Mar 6 '13 at 18:06
    
Probably not, but I don't know every proxy software. There are too many solutions for me to give you a definite answer. –  Christopher Perrin Mar 6 '13 at 23:34
add comment

You can achieve this via a load-balancer (e.g. Linux ipvsadm).

Look at the LVS-documentation-page either NAT or TUN might work in your scenario.

share|improve this answer
add comment

The App sends API requests to another application (App 'B') which currently only accepts API requests from a single IP address. Because App 'A's outbound IP address changes depending on which node the request is sent from, App 'B' cannot authenticate it due to its single API access IP configuration limitation.

Your authentication model is broken.
You could whitelist all the possible IPs App A could use, but you'd be better off switching to something more robust, like SSL certificate-based authentication, and give each authorized client a discrete token to authenticate with.


Is it possible to set up a proxy server to catch all API requests from App 'A' (regardless of IP address or a set IP Range, or netblock) and forward them to App 'B' via its own static IP?

Sure - that's not fixing the problem though, it's just funneling everyone in the world through a proxy (Which means if Andrew Attacker finds his way to your proxy he can now molest your API, free of the IP restrictions. Unless of course you implement some kind of authentication on the proxy, which reduces to the case above where you give each client a discrete authentication token…).

You could use pretty much any HTTP proxy server you like for this - an exhaustive list is beyond the scope of Server Fault (Google is better at that sort of thing).

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.