0

Here's my situation: I've got a network-based device with a web-page interface, and the developers of this device, in their wisdom, did not include any kind of access-control or encryption for the web interface -- i.e. anyone on the same LAN can point their web browser to http://the.ip.address.of.this.device and immediately start controlling it in (potentially undesirable) ways.

At the same time, I've got a client that wants to deploy this device so that he can control it via a public/untrusted WiFi network (e.g. from the guest-wifi network of his business). To avoid unauthorized access to this device, he (quite reasonably) wants the device's web interface to use https/TLS encryption and he wants the web page to require a password before granting access.

Given that I can't (easily) update the firmware on this device, my idea to solve this problem is that rather than putting this device directly on the LAN, I'll put a front-end proxy-device on the LAN, and connect my insecure device only to the second Ethernet port on the proxy-device. Then I can have some sort of web-proxy software running up on the proxy-device, such that when a client makes an authenticated https connection via wifi to the proxy-device, it will forward that connection (as an unencrypted/http: connection) to the insecure device.

That seems like it will be a workable (if inelegant) solution; my question is, how is this sort of thing usually done? i.e. do I need to set up my own Linux PC and install and configure TLS termination proxy software on it, or is there an easier way to do it? (I ask because all of the software listed in that Wiki page seems like it is designed for high-volume business needs, i.e. thousands of simultaneous clients, and it sounds like it might be overkill for this use case, where the number of simultaneous clients will range from zero to maybe two at the outside, and each client will be doing only very lightweight operations)

2
  • 2
    Look into reverse proxies and/or Web Application Firewalls (WAF). Either could be used to control access and provide the security you're looking for. Just be sure there's a network level control (dedicated vlan, private subnet, etc) to ensure only the two devices can communicate. Sep 22, 2018 at 2:51
  • Thanks, those search terms led me to the following ServerFault question which is similar to mine: serverfault.com/questions/239749/… Sep 22, 2018 at 2:56

0

You must log in to answer this question.

Browse other questions tagged .