Apache Reverse Proxy

Question

I was am planning to deploy Reverse proxy using Apache, but before i do it on Prod env i tried to implement in my home lab.I have two vms running on Redhat.

192.168.56.70 mainsite.example.com  mainsite
#192.168.56.70  mainsite2.example.com mainsite2
192.168.56.71 areverseproxy.example.com areverseproxy

on Backend Apache server i made a virtuial host, contents of that VHost

<VirtualHost *:80>                                                      
  #  DocumentRoot "/var/www/html/"                                      
  # <Directory "/var/www/html/mainsite">                                
  #  AllowOverride None                                                 
  #  # Allow open access:                                               
  #  Require all granted                                                
  # </Directory>                                                        
                                                                        
    #DirectoryIndex "/var/www/html/mainsite/index.html"                 
    ServerName mainsite.example.com                                     
    ServerAlias mainsite                                                
    Redirect permanent / https://192.168.56.70                          
    ErrorLog "/var/log/httpd/mainsite.example.com-error_log"            
    CustomLog "/var/log/httpd/mainsite.example.com-access_log" common   
</VirtualHost>                                                          
                                                                        
<VirtualHost *:443>                                                     
SSLEngine on                                                            
SSLCertificateFile /etc/pki/tls/certs/ca.crt                            
SSLCertificateKeyFile /etc/pki/tls/private/ca.key                       
    DocumentRoot "/var/www/html/mainsite"                               
    <Directory "/var/www/html/mainsite">                                
    AllowOverride None                                                  
    # Allow open access:                                                
    Require all granted                                                 
    </Directory>                                                        
                                                                        
    #DirectoryIndex "/var/www/html/mainsite/index.html"                 
    ServerName mainsite.example.com                                     
    ServerAlias mainsite                                                
    ErrorLog "/var/log/httpd/mainsite.example.com-error_log"            
    CustomLog "/var/log/httpd/mainsite.example.com-access_log" common   
</VirtualHost> 

And on Reverse Proxy Server i added these lines to enable Reverse proxy

<IfModule mod_proxy.c>
    ProxyRequests Off
    <Proxy *>
        Require all granted
    </Proxy>
    # backend server and forwarded path
    ProxyPreserveHost On
    ProxyPass / http://mainsite.example.com/
    ProxyPassReverse / http://mainsite.example.com/
</IfModule>

If i try to open URL http://192.168.56.71 it will redirect to https://192.168.56.70 which is ok if i dont have Reverse proxy server but in reverse proxy scenario it should be https://192.168.56.71

Can any one guide what changes i have to made on Reverse Proxy server so the URl remains https://192.168.56.71 if i type URL http://192.168.56.71

Thanks a lot

After deploying on Prod Server

Error

[Mon May 31 09:16:26.650015 2021] [proxy_http:error] [pid 104179] (103)Software caused connection abort: [client 192.168.22.140:40286] AH01102: error reading status line from remote server 172.16.1.140:443
[Mon May 31 09:16:26.650214 2021] [proxy:error] [pid 104179] [client 192.168.22.140:40286] AH00898: Error reading from remote server returned by /

Answer 1

You should have two virtual hosts on reverse proxy server. I would recommend to delete global proxypass directives on a reverse proxy and specify them for each virtualhost.

The virtual host on port 80 should redirect to port 443 on the same host (areverseproxy.example.com) in the same way as you did it on the backend server. However, nobody should enter the 80 port on backend any more, if you make the reverse proxy properly, unless backend is accessible via internet, too.

The virtual host on port 443 should have a reverse proxy configuration.

On the reverse proxy you should have something like this:

<VirtualHost *:80>                                                      
    ServerName areverseproxy.example.com                                     
    ServerAlias areverseproxy                                                
    Redirect permanent / https://192.168.56.71                          
    ErrorLog "/var/log/httpd/areverseproxy.example.com-error_log"            
    CustomLog "/var/log/httpd/areverseproxy.example.com-access_log" common   
</VirtualHost>

<VirtualHost *:443>
    ServerName areverseproxy.example.com   
    ServerAlias areverseproxy                                                

    ErrorLog "/var/log/httpsd/areverseproxy.example.com-error_log"            
    CustomLog "/var/log/httpsd/areverseproxy.example.com-access_log" common   

    SSLEngine on
    SSLCertificateKeyFile conf/ssl.key/areverseproxy.example.com.key
    SSLCertificateFile conf/ssl.crt/areverseproxy.example.com.crt

    SSLProxyEngine on
    SSLProxyCheckPeerCN off
    SSLProxyCheckPeerExpire off
    SSLProxyCheckPeerName off

    ProxyRequests off
    ProxyPreserveHost on
    ProxyPass / https://192.168.56.70:443/
    ProxyPassReverse / https://192.168.56.70:443/
</VirtualHost>

You will probably not have a valid HTTPS certificate on backend host. Therefore, you need SSLProxyCheck* directives. If backend has valid certificates with names, than you can delete SSLProxyCheck* directives, but in that case, the ProxyPass and ProxyPassReverse directives should not point to an IP number, as in the example, but to the hostname from the certificate.

You also may not need HTTPS between proxyreverse and backend, if they are on the same protected network. If they are not, keep the HTTPS between reverse proxy and backend to protect traffic.

Remember, clients will communicate with reverse proxy only, so it is important that you have the correct HTTPS certificates for the reverse proxy, not for the backend.