Tag Info

New answers tagged

0

Aside from using a large quantity of expensive public IPv4 addresses, your options are: Fix the devices. Anything that doesn't support SNI at this late date is either too old to be on the Internet or too broken. Use a UCC certificate. These can have multiple hostnames, and even multiple domains, on a single certificate, and all of them can then share an IP ...


0

You will need a public address for each one, or a wildcard certificate that covers all their domains. The fundamental problem is that the server answers SSL before it knows which host name the client is asking for - without that, the only way to tell is if the connection comes into a different place. This means running each website on a weird port (e.g. ...


1

A simply test is sufficient: location / { if ($http_user_agent ~ "MSIE 6.0" ) { set $browser-version outdated; } if ($http_user_agent ~ "MSIE 7.0" ) { set $browser-version outdated; } if ($http_user_agent ~* "(android|bb\d+|meego).+mobile|avantgo|bada\/|blackberry|blazer|compal|elaine|fennec|hiptop|iemobile|ip(hone|od)|iris|kindle|lge ...


1

The rule order matters in Squid. Once a rule allows or denies an ACL then the remaining rules are ignored. Create an ACL for the computer IP address that you don't want blocked. Put the rule that allows it before your content blocking rules. acl dontblock src 10.10.1.20/32 #IP of computer that shouldn't have any content blocked http_access allow dontblock ...


0

Some hosting providers are (or used to be) quite generous with IPv4 ip-addresses. You demonstrate a need (and with some just asking was enough need) and pay the nominal charge and there you go. The number of IPv6 addresses you can get is of course not an issue yet and there's no real limit to the number of IP-addresses you can assign to a single server...


0

Re-answering, since previous answer is almost the same :) In addition to the previous answer I see some options for you here You can try using "tunnel" option for ssh authorized_keys file per each user. tunnel="n" Force a tun(4) device on the server. Without this option, the next available device will be used if the client requests a tunnel. ...


0

When you set up the proxy connection through ssh to your VPS, all the proxies connections will be started as a new connection from the proxied server, which will always use the main IP address. You can create firewall rules that could force the connection to go out using the second IP address though.


0

I had this problem. I change My nameserver in /etc/resolv.conf to: nameserver 8.8.8.8


1

I think you solve your problem in a pretty universal way by putting your reverse proxy configuration inside a <Location> tag and make use of how internally Apache merges directives and sets precedence. <Location> directives are applied last and should overrule the <Directory> directive. <VirtualHost *:80> ServerName ...


0

I've just found this is a bug in Apache 2.4 in ProxyErrorOverride https://issues.apache.org/bugzilla/show_bug.cgi?id=53420


0

New day, new ideas. I checked Tomcat's Valve documentation and it provided the answer in https://tomcat.apache.org/tomcat-7.0-doc/api/org/apache/catalina/valves/RemoteIpValve.html in internalProxies: By default, 10/8, 192.168/16, 169.254/16 and 127/8 are allowed ; 172.16/12 has not been enabled by default because it is complex to describe with regular ...


1

Because you're setting the 'Host' header via proxy_set_header, you can change your proxy_pass directive to be the actual IP address of your backend server, rather than relying on DNS. Take for example; location / { proxy_pass http://10.0.0.2; proxy_set_header Host www.example.com; # ..various other required directives omitted } This will initiate a ...


0

I ended up doing the following in my squid.conf: http_port 3128 accel defaultsite=my.httpsServer.com protocol=HTTPS vport=8443 allow-direct no-vhost request_header_add X-Custom-Header "customheadervalue" all It seems to be working fine. All my requests to the proxy (made over http) are rewritten in https with the custom header parameter. This seems to be ...


1

In most scenario's with SSL Squid isn't forwarding the request on your behalf, which is what allows Squid to modify the traffic and insert additional headers on plain HTTP request. With HTTPS/SSL/TLS Squid allows your browser to CONNECT directly to the HTTPS host. Squid only forwards the encrypted traffic between your browser and the remote server, which, ...


0

I fixed the issue eventually by removing the version of dante I had installed via apt and replacing it with one I downloaded from the dante website and compiled from source. There must be a bug in the version in ubuntu's repositories.


0

I am answering my own question, so other can benefit from; Initially i thought this was issue with cloud-front and its mechanism. It turns out to be: [After enabling loggin in both elb and cloudfront, i saw that] If you point your domain to cloud-front, and cloud-front having origin as ELB [load balancer] it sends request to respective EC2 Instances, and ...


0

Yes, squid will answer on as many ports as you would like; just add them into its configuration. The problem with this approach is that there is no access control; anyone who manages to find the IP address and port can then use (or more likely, abuse) the proxy.


0

What you are asking is mostly possible, but there is a few caveats. I tried writing such a proxy myself several years ago, but there is a few challenges, that I never completely resolved. The way I see it, the property which would define the difference between a proxy and a full relay is this: The proxy never on its own takes responsibility for the mail. A ...


0

You can have postfix to rewrite headers to get to desirable results, but it will NEVER be transparent as that would break some RFC. Postfix manual - generic(5) Postfix manual - canonical(5)


0

I'm unable to upvote Sorin's response... In our local situation running Apache 2.2, and the primary app requires proxypreservehost (CQ/AEM author) to login, but a partner we proxy to requires their host in the host header. We don't need to do this with regex though, a regular <Location...> works fine. From documentation ...


0

Assuming you're using a the ProxyPass Apache directive you can exclude certain sub directories and file system paths from being forwarded by using an exclamation mark !. That will allow you to serve them from the local file system on the proxy server instead. # Exclude file.js and serve that from the local filesystem ProxyPass /app/dir/file.js ! # proxy ...


2

Nginx is very good at that. For instance: server { listen 80; server_name www.example.com location / { proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $remote_addr; proxy_set_header Host $host; proxy_pass http://127.0.0.1:81; proxy_read_timeout 4m; } location ~ /\.ht { ...


1

You could set up a redirect on that subdomain to the correct address, for eg. if you use PHP you cold go: <?php header('Location: http://<youraddress>:<port>'); ?> but then that would actually change the address in the address bar, so if its a cosmetic thing for the URL its not the best option.


1

The auth_http does two main things: It authenticates users (including various options to effectively delay users on failed authentication). And it determines which backend to use (and which username and password to use in backend authentication, if at all). While in some cases authentication can be handled directly by a backend, it's not something always ...


1

To get the HTTP requests to redirect instead of proxying, you should do two things: Move your proxying config (SSLProxyEngine through ProxyPassReverse into the SSL virtual host in /etc/httpd/conf.d/ssl.conf, so that it'll only apply there Create an HTTP virtual host which will redirect - probably in a new .conf file in /etc/httpd/conf.d: <VirtualHost ...


1

If you just need to force nginx to refresh cache, you could use proxy_cache_bypass. It will make nginx to fetch new data from backend and put them in cache.


0

What OS is the client you are using? Is the ssh client staying open while you are trying to connect with your browser? If you are using the openssh client to create this tunnel, you may want to add in a -N flag to create the tunnel without requiring a command: ssh -ND 8888 mysite@test.mysite.net -vv You may also want to check the output of netstat ...


0

In order to fix this issue, most likely caused by Reverse Proxy with Shiny-server and Apache. Add the disable_websockets true; as shown below. **NOTE: ** This seems to only work with newer versions of Shiny-Server (Shiny Server Professional v1.2.0 i believe). # Define the user we should use when spawning R Shiny processes run_as shiny; disable_websockets ...


0

You can use ssh port forward for archive this ssh -L localportinmypc:hostname_of_the_behind_the_firewall:remoteport hostname_of_my_firewall Now after this: sftp -o Port=localportinmyp localhost or ssh -p localportinmyp


1

Normally the proxy server does the resolving (at least for plain HTTP, although I'm not 100% sure about HTTPS) so you simply point your proxy to a customized DNS server. In Squid with the configuration directive dns_nameservers. The clients need to be explicitly configured to use the proxy. DNSmasq is relatively light weight DNS server that can use a ...


0

I'm updating the question with a definitive answer, as the time passed the proxy feature was integrated into joomla, and it's now present on Joomla 3.3 (you just have to check it in general configuration settings), the ticket with the discussion can be found here So basically, as of joomla 3.3 proxy is working


1

By default, non-transparent proxy inserts "Via:" field to HTTP request header. Of course, this is configurable option that can be disabled, for example: http://www.squid-cache.org/Doc/config/via/ Transparent proxy tries to be invisible, so cannot be detected: "A 'transparent proxy' is a proxy that does not modify the request or response beyond what ...


2

A silent proxy may be indistinguishable from NAT. But some may add headers, that allow to identify that request comes through proxy.



Top 50 recent answers are included