Difference between revisions of "SBN - Proxy Server Notes"
Jump to navigation
Jump to search
(Created page with "= Reverse Proxy (Outside Access to internal servers) = Start with a standard Web Server install... We'll be basing our procedure on [https://www.d...") |
|||
| (18 intermediate revisions by the same user not shown) | |||
| Line 1: | Line 1: | ||
| − | = Reverse Proxy (Outside Access to internal servers) = | + | =Reverse Proxy (Outside Access to internal servers)= |
Start with a [[SBN - Web Server Notes|standard Web Server install]]... | Start with a [[SBN - Web Server Notes|standard Web Server install]]... | ||
| Line 7: | Line 7: | ||
Enable the proxy modules: | Enable the proxy modules: | ||
| − | * <code>sudo a2enmod proxy proxy_ajp proxy_http rewrite deflate headers proxy_balancer proxy_connect proxy_html</code> | + | *<code>sudo a2enmod proxy proxy_ajp proxy_http rewrite deflate headers proxy_balancer proxy_connect proxy_html</code> |
(possibly add <code>mod_authz_host</code> to the list...) | (possibly add <code>mod_authz_host</code> to the list...) | ||
| − | Create the virtual | + | Create the virtual host to point incoming connections at the internal server you want to proxy: |
| − | * | + | *[[WebServer - Proxy VirtualHost Configuration|Proxy VirtualHost Configuration]] |
| + | *See also: [[WebServer - Name-based Virtual Host Support|Name-based Virtual Host Support]] | ||
| − | & | + | You may have noted while setting up the '''VirtualHost''' that we're pointing at a set of [[NetMan - SSL Certs|cert files]] that need to be on '''both''' machines. I would suggest that you obtain the certs on the main web server & copy them to the machine being proxied as this will (to some extent) simplify updating them. |
| − | + | * [[NetMan - SSL Certs#Installing on a Webserver that will be proxied|Installing on a Webserver that will be proxied]] | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
Also, 2 log files in a new folder... | Also, 2 log files in a new folder... | ||
| − | * <code>sudo mkdir /var/log/apache2/Proxy</code> | + | *<code>sudo mkdir /var/log/apache2/Proxy</code> |
| − | (this folder will be populated | + | (this folder will be populated automagically when you restart Apache...) |
Now, restart Apache: | Now, restart Apache: | ||
| − | * <code>sudo service apache2 restart</code> | + | *<code>sudo service apache2 restart</code> |
| − | At this point, you should be able to browse to ''' | + | At this point, you should be able to browse to '''Proxy.foo.bar''' from outside your network. |
| − | == Access Control by IP == | + | ==Special considerations for the ESXi WebUI== |
| + | [[ESXI - WebUI Through a Proxy|ESXi uses WebSockets]] | ||
| + | |||
| + | ==Access Control by IP / HostName== | ||
You can control who can access your proxy via the <Proxy> control block as in the following example: | You can control who can access your proxy via the <Proxy> control block as in the following example: | ||
<Proxy "*"> | <Proxy "*"> | ||
| − | + | Order deny,allow | |
| + | Deny from all | ||
| + | Allow from 192.168.0.1 | ||
| + | Allow from 192.168.0.2 | ||
</Proxy> | </Proxy> | ||
| − | Simply replace '''192.168.0.1''' with the | + | Simply replace '''192.168.0.1''' & '''192.168.0.2''' with the IPs of the machines allowed to access this proxy. |
| + | |||
| + | [http://httpd.apache.org/docs/2.2/howto/access.html#host Reference] | ||
| + | |||
| + | In theory, You could also replace the IP addresses with hostnames (or partial hostnames). '''BUT''', those hostnames need to be visible across the internet... | ||
| − | == Upcoming tricks... == | + | ==Upcoming tricks...== |
| − | * Multi-Site Server Management from a Central Server | + | *Access control by User Login |
| + | **[https://httpd.apache.org/docs/2.4/howto/auth.html Apache Authentication and Authorization] | ||
| + | *Multi-Site Server Management from a Central Server | ||
| − | == Further Reading == | + | ==Further Reading== |
| − | * [https://httpd.apache.org/docs/2.4/mod/mod_proxy.html Apache Module mod_proxy] | + | *[https://httpd.apache.org/docs/2.4/mod/mod_proxy.html Apache Module mod_proxy] |
| − | * [https://httpd.apache.org/docs/2.4/mod/mod_authz_host.html Apache Module mod_authz_host] | + | *[https://httpd.apache.org/docs/2.4/mod/mod_authz_host.html Apache Module mod_authz_host] |
| + | *[https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html Apache Reverse Proxy Guide] | ||
Latest revision as of 20:59, 15 July 2020
Contents
Reverse Proxy (Outside Access to internal servers)
Start with a standard Web Server install...
We'll be basing our procedure on Configuring Apache To Proxy Connections
Enable the proxy modules:
sudo a2enmod proxy proxy_ajp proxy_http rewrite deflate headers proxy_balancer proxy_connect proxy_html
(possibly add mod_authz_host to the list...)
Create the virtual host to point incoming connections at the internal server you want to proxy:
You may have noted while setting up the VirtualHost that we're pointing at a set of cert files that need to be on both machines. I would suggest that you obtain the certs on the main web server & copy them to the machine being proxied as this will (to some extent) simplify updating them.
Also, 2 log files in a new folder...
sudo mkdir /var/log/apache2/Proxy
(this folder will be populated automagically when you restart Apache...)
Now, restart Apache:
sudo service apache2 restart
At this point, you should be able to browse to Proxy.foo.bar from outside your network.
Special considerations for the ESXi WebUI
Access Control by IP / HostName
You can control who can access your proxy via the <Proxy> control block as in the following example:
<Proxy "*"> Order deny,allow Deny from all Allow from 192.168.0.1 Allow from 192.168.0.2 </Proxy>
Simply replace 192.168.0.1 & 192.168.0.2 with the IPs of the machines allowed to access this proxy.
In theory, You could also replace the IP addresses with hostnames (or partial hostnames). BUT, those hostnames need to be visible across the internet...
Upcoming tricks...
- Access control by User Login
- Multi-Site Server Management from a Central Server
