According to website of the open source firewall, ModSecurity; it can be deployed in 2 ways, Embedded and Proxy server (citation below)
ModSecurity supports two deployment options: embedded and reverse proxy deployment. There is no one correct way to use them; choose an option based on what best suits your circumstances. There are advantages and disadvantages to both options:
...The embedded option is a great choice for those who already have their architecture laid out and don't want to change it. Embedded deployment is also the only option if you need to protect hundreds of web servers. In such situations, it is impractical to build a separate proxybased security layer. Embedded ModSecurity not only does not introduce new points of failure, but it scales seamlessly as the underlying web infrastructure scales. The main challenge with embedded deployment is that server resources are shared between the web server and ModSecurity.
Reverse proxies are effectively HTTP routers, designed to stand between web servers and their clients. When you install a dedicated Apache reverse proxy and add ModSecurity to it, you get a proper network web application firewall, which you can use to protect any number of web servers on the same network. Many security practitioners prefer having a separate security layer. With it you get complete isolation from the systems you are protecting. On the performance front, a standalone ModSecurity will have resources dedicated to it, which means that you will be able to do more (i.e., have more complex rules). The main disadvantage of this approach is the new point of failure, which will need to be addressed with a high-availability setup of two or more reverse proxies.
I understand how reverse proxy firewall works
Xuser at home
Yreverse proxy server acting as firewall that fetches website from Z
Zmain web server which hosts the website
In reverse proxy,
X <-- Y is visible to
X but background
X --> Y --> Z is hidden from
Can reverse proxy firewall secure more than one web servers, if yes then how?
(because I set IP address of the web server
Y, and each
Ycan handle one IP address of
Z, but the above citing says, reverse proxy deployment can protect any number of web servers)
- What is Embedded firewall, and how is it different from reverse proxy firewall?
- What is the difference between reverse proxy ModSecurity and Mod_Proxy?