1

I am using squid as proxy server for blocking patterns in a url (like: block .jpg,.bmp, etc). Now I want to route the whole traffic from my 2nd server (which runs apache) through the proxy server.

So, when a visitor accesses a .jpg file for example, the proxy server blocks the request.

The setup:

  • Server #1 runs squid3
  • Server #2 runs apache2

How can i configure apache for routing all traffic through a specific proxy?

  • so basically you want to setup a reverse proxy so that all requests from clients go through the proxy instead of arriving directly on the Apache server? – Ale Nov 19 '14 at 22:28
  • yes. i want to "block" specific patterns. and when the server uses the proxy not every client needs to configure the proxy. example: user request -> proxy -> (is allowed) yes = -> apache -> client ; no = ->blocked – pila Nov 19 '14 at 22:31
  • Looks like an XY problem. If your goal is to block some patterns then you can do so directly in Apache's configuration; a reverse proxy is way overkill for this. – user186340 Nov 21 '14 at 20:54
1

The configuration you want is a reverse proxy. The main points to configure such a system are:

  • the DNS name of the web server must point to the IP address of the squid proxy
  • the squid proxy has to be configured to listen for requests on port 80 (supposing you want to use the standard HTTP port) and forward the requests to the apache server (reverse proxy mode, using the httpd-accelerator module). For an example see here. If you want to support encryption (HTTPS), you'll need to have your SSL certificates/keys on the Squid proxy, and configure it accordingly.
  • make sure that the apache server is inaccessible from your clients (e.g., by using a private IP address, assuming that your clients are outside that private network, or a firewall)
  • anything needing the client's IP address on Apache must look to the X-Forwarded-For header added by squid, as the client IP address will be the one of the squid server. This includes the logs, if you want to look at them on the apache server and not on the squid proxy.
  • is this solution possible for infinite servers? so that the squid does not need to have every apache ip? i want that squid automatically detects the source and points traffic back to the server – pila Nov 19 '14 at 22:46
  • do you mean for infinite clients (i.e., that you don't need to anticipate who is connecting to your proxy)? in this case, yes: that's what a reverse proxy is for, you just have to configure the apache server's address in it (as from your question I guess there's only one of them) – Ale Nov 19 '14 at 22:49
  • okay thanks i will test this tomorrow and then comment back – pila Nov 19 '14 at 22:50
  • how do i set the cache_peer option in squid for every host? it is possible that i do not know all users using this proxy server.. – pila Nov 20 '14 at 15:49
  • cache_peer is the IP of the apache web server you want behind your proxy -- you don't care about who your clients are. that's why it's named a reverse proxy: you configure who your server is, and clients will only access that server (but you don't need to preconfigure the clients) – Ale Nov 20 '14 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.