Tag Info

New answers tagged

1

In case you use nginx as a load-balancer, the stream will be : Redirect : Step 1 : Client => LB (HTTP request) Step 2 : LB => Client (HTTP reply) Step 3 : Client => Backend (HTTP request) Step 4 : Backend => Client (HTTP reply) Proxy : Step 1 : Client => LB (HTTP request) Step 2 : LB => Backend (HTTP request) ...


0

So apparently, the issue was caused by (and this is as reported by my host) some "code" in some plugins that are not compatible with php+APC cache... Don't know if that's really true, but when we changed the handler back to suPHP, the issue resolved! So for (future) people on wordpress + VPS, keep this in mind. If you are going to install some kinda opcode ...


0

No, you must allow the referrals in the firewall. Neither ADLDS not openLDAP will authenticate users. The simplest solution is to put a DC from the other domain in the hub site.


1

You are correct that with the REDIRECT, Squid cannot see the original intended destination IP; instead it will resolve the host provided by the client in the Host: HTTP header, which is mandatory in HTTP 1.1.


0

That is very similar to the gateway. When client host does not know where the destination host reside, it send the packet to the default gateway. And gateway define where that packet should be sent. Transparent proxy do the same. All packets to the xxx.xxx.xxx.xxx:80 are diverted to the port 3128 instead of port mentioned in the packet header. Squid ...


0

1 - you need to plan name resolution. If the clients don't connect to a DNS server that does Internet names, this is expected. TMG can do that for HTTP URLs, but not random no-name stuff, unless you install the Firewall Client on the client computers. 2 - Confused question. Firewall where is on to break this? If you're using the firewall client (is that the ...


5

You are tackling this problem at the wrong layer. Literally, layer 4 when you should use layer 7. Don't log TCP connections in iptables. Instead, capture HTTP traffic and inspect the Host header in the requests that the clients are making.


7

I'm not sure i get the whole picture but since you are writing about websites i think you are using a tool that is not exactly suitable for the task. imho you are looking for that information (the visited domain name) at the wrong level: you should have a proxy and analyze its logs to gather that info. A proxy is 'near' the client and has the exact and ...


5

You cannot easily determine what the user typed into their browser's URL bar using just an IP address log: You can't tell if someone accessing 104.16.13.13 got there by typing aviation.stackexchange.com or tex.stackexchange.com (the best you can determine is that it's a CloudFlare IP address). In order to get the information you seek you would need to ...


0

Biggest problem with your idea is that if you expect the reverse proxy to send cookies to the backend, but the client wouldn't send cookies to the frontend (unless the backend cookie domain was inferior to the frontend). I would suggest that mod_proxy would likely be too difficult to use, and in this case you'd get to your goal faster with mod_rewrite. ... ...


0

This is a sample after a real wold configuration that works for me I had to use individual ProxyPassReverse directives to get redirections/links to work. Even the final / seems important. <Proxy balancer://mycluster> Order deny,allow Allow from all BalancerMember http://192.168.151.101 BalancerMember http://192.168.151.102 BalancerMember ...


0

cockpit uses websocket to push active data like memory, cpu, swap, storage usage back and forth between server and client but when a proxy sits in between, it has to be configured likely. To configure Cockpit proxy over NGINX, create a server virtual block, and add the following lines to it. This config would deliver specific set of work environments. Do ...


0

Following apache recommendations (http://httpd.apache.org/docs/2.2/mod/mod_proxy.html), if your apache only works as ReverseProxy you must configure this: ProxyRequests Off # Then the config you actually have <Proxy balancer://mycluster> BalancerMember http://192.168.151.101 BalancerMember http://192.168.151.102 BalancerMember http://192.168.151.103 ...


0

The feature you want (if I read your question correctly) is Tproxy - this effectively makes squid IP transparent - it will look like the client is making the proxied requests. To be honest, it's a bit of a faff to set up (more than a couple of directives), but it does work.


0

Short answer: Based on my research, squid does not support anything like tinyproxy's "BindSame". Details: I have been researching this very topic because I am in precisely the same situation as you: I want to use tinyproxy for the BindSame configuration, but I need authentication, which tinyproxy does not support. Unfortunately, my conclusion is that squid ...


0

I haven't tried output filters with forward proxying, but it works with reverse proxying, so you might want to give the following a try: #add this outside of any VirtualHost tags ExtFilterDefine proxiedcontentfilter mode=output cmd="/usr/bin/php /var/www/proxyfilter.php" #add this in your VirtualHost tag SetOutputFilter proxiedcontentfilter In ...


0

I am now looking for a program that can help us prevent, or atleast immediately when download has finnished, scan the file for unwanted files. Start with Next-Generation Firewall Install UNTANGLE as Router. With it, You can prevent downloading files with extensions like mp3, mov etc. Beside that You can setup MIME scanning to block files with fake ...


4

There's an apache module called mod_substitute that can do this. Here's a short example: <Location "/"> AddOutputFilterByType SUBSTITUTE text/html Substitute "s/uat.site.co.jp/jp.uat.site2uk.co.uk/ni" </Location> Or, when combined with mod_proxy: ProxyPass / http://uat.site.co.jp/ ProxyPassReverse / http://uat.site.co.jp/ Substitute ...


3

If you haven't restarted Apache, be sure to do that, but if you've already done so, you could try a global output filter that runs a custom PHP script to do your replacing just to see if that solves it for some reason. EDIT: based on your comment, it could be that substitute isn't working because the content is compressed. To turn off compression, add ...


0

Thanks to this thread I found a method that worked for me. Putting the timeout and connectiontimeout= on the same line as the ProxyPassMatch works like so: ProxyPassMatch ^/(.*\.php(/.*)?)$ fcgi://127.0.0.1:9009/var/www/$1 timeout=3600 connectiontimeout=3600


2

The issue with Lukas's solution is HttpRewriteModule , which automatically turns everything with http(s) at the front into a 302. If you instead do the rewrite in two stages - the second one 'break' - it should work. e.g. rewrite ^(.*)$ "://registry.npmjs.org$1" break; rewrite ^(.*)$ "http$1" break; proxy_pass http://proxy.abc.lan:1234; I suspect there's ...


0

You could use a trio of nginx, etcd & confd to get this done. There is a great blog post titled "Load balancing with CoreOS, confd and nginx" that walks you through running three containers. You need a shared "data" container, where you can store the dynamically generated nginx configurations You need a container running confd, that will read values ...


0

Clients was defined, i've downloaded source of squidGuard and compiled them. Fixed !


0

Maybe you forgotten that in your squidGuard.conf: src clients { ip 10.10.101.0/24 }


1

You haven't posted any addition details since asked for a couple of weeks ago so I'll try to answer as best I can (and recommend the question be closed): Security: If your goal is to secure your Asterisk server then a proxy server / kamailio is not the answer. See Asterisk Security for details on how to do this. Network: If your problem is NAT traversal ...


0

I think you'll want to use Apache 2.4, and use its mod_proxy_wstunnel module. http://httpd.apache.org/docs/2.4/mod/mod_proxy_wstunnel.html I would even think it preferable to have you API endpoint on a different hostname (eg. api.example.com versus www.example.com), which would mean that you can separate you API traffic from non-API traffic, and use ...



Top 50 recent answers are included