As was stated by user373333, you'd need to use something to listen on the edge and proxy into the network.
They used haproxy
, I prefer nginx
because you can serve SSL individually, control certs a little better, and there's less chaos because you can configure sites individually. That, and I have much more familiarity with nginx
than haproxy
for this - we had to have such a deployment on a specific piece of software we deployed where we had one ingress IP address for web traffic, and that was it, but we had eight or nine web administration pages on internal IP addressed servers.
Depending on your OS on what I would call a dedicated external-facing system, you'd install nginx
.
Add the following stanzas to the end of your nginx.conf
's http
section, which theoretically should be in /etc/nginx
; update these accordingly for your domains:
# First Server
server {
listen 443 ssl;
server_name server1.example.com;
ssl_certificate /path/to/SSL/cert;
ssl_certificate_key /path/to/SSL/cert/privkey;
# Secure SSL configs
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:AES128+EECDH:AES128+EDH";
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off; # Requires nginx >= 1.5.9
ssl_dhparam /etc/ssl/dhparam.2048.pem; # To protect against LOGJAM
location / {
add_header X-Forwarded-For $remote_ip
add_header X-Forwarded-Proto https;
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options SAMEORIGIN;
add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
proxy_pass https://internal.ip.address.1:443/;
}
}
# Second Server
server {
listen 443 ssl;
server_name server2.example.com;
ssl_certificate /path/to/SSL/cert;
ssl_certificate_key /path/to/SSL/cert/privkey;
# Secure SSL configs
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:AES128+EECDH:AES128+EDH";
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off; # Requires nginx >= 1.5.9
ssl_dhparam /etc/ssl/dhparam.2048.pem; # To protect against LOGJAM
location / {
add_header X-Forwarded-For $remote_ip
add_header X-Forwarded-Proto https;
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options SAMEORIGIN;
add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
proxy_pass https://internal.ip.address.2:443/;
}
}
# Catch all for all other responses, return 410 GONE message.
server {
listen 80 default_server;
listen 443 default_server;
server_name server1.example.com;
ssl_certificate /path/to/a/bogus/self-signed/SSL/cert;
ssl_certificate_key /path/to/a/bogus/self-signed/SSL/cert/privkey;
# Secure SSL configs
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:AES128+EECDH:AES128+EDH";
ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off; # Requires nginx >= 1.5.9
ssl_dhparam /etc/ssl/dhparam.2048.pem; # To protect against LOGJAM
return 410;
}
You'll need to run openssl dhparam -out /etc/ssl/dhparam.2048.pem 2048
either as superuser or with sudo
, depending on your system, but once you've done this and have the dhparam.2048.pem
file created, you can then restart the NGINX process on your system, and test your sites. Make sure that all the port 80 and 443 traffic is forwarded to this system, so it can properly hand off to internal systems.