0

We have a Web infrastructure with a farm of Web Servers. They are behind a loadbalancer which does SSL offload. We also have a IPS and obviously a set of firewalls.

Now, for security reason we have been asked to look into the possibility of adding a reverse proxy. I insist this is for security reason only as we are not planning to use any caching.

My question is: Is it worth the effort? Is there any added value to an additional layer and if yes would it justify the time spent?

1
0

If your webserver is (pre-)forking or uses light weight processes (threads) then using an event based proxy (e.g. ATS, nginx, NOT varnish) in front gives a lot of protection against sloloris type attacks. But in the absence of any caching (or DOS attacks) it's going to slow down your traffic.

Why so anti caching?

2
  • Caching was just not part of the original scope, I am happy to add it if not having it penalise the performance. – Momo Sep 12 '13 at 14:30
  • update--Caching was just not part of the original scope, I am happy to add it if not having it penalise the performance significantly. Overall I had the feeling that the reverse-proxy would be redundant with the LB+IPS. I should add that our webservers are in the DMZ only accessible by the LoadBalancer – Momo Sep 12 '13 at 14:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.