0

I was am planning to deploy Reverse proxy using Apache, but before i do it on Prod env i tried to implement in my home lab.I have two vms running on Redhat.

192.168.56.70 mainsite.example.com  mainsite
#192.168.56.70  mainsite2.example.com mainsite2
192.168.56.71 areverseproxy.example.com areverseproxy

on Backend Apache server i made a virtuial host, contents of that VHost

<VirtualHost *:80>                                                      
  #  DocumentRoot "/var/www/html/"                                      
  # <Directory "/var/www/html/mainsite">                                
  #  AllowOverride None                                                 
  #  # Allow open access:                                               
  #  Require all granted                                                
  # </Directory>                                                        
                                                                        
    #DirectoryIndex "/var/www/html/mainsite/index.html"                 
    ServerName mainsite.example.com                                     
    ServerAlias mainsite                                                
    Redirect permanent / https://192.168.56.70                          
    ErrorLog "/var/log/httpd/mainsite.example.com-error_log"            
    CustomLog "/var/log/httpd/mainsite.example.com-access_log" common   
</VirtualHost>                                                          
                                                                        
<VirtualHost *:443>                                                     
SSLEngine on                                                            
SSLCertificateFile /etc/pki/tls/certs/ca.crt                            
SSLCertificateKeyFile /etc/pki/tls/private/ca.key                       
    DocumentRoot "/var/www/html/mainsite"                               
    <Directory "/var/www/html/mainsite">                                
    AllowOverride None                                                  
    # Allow open access:                                                
    Require all granted                                                 
    </Directory>                                                        
                                                                        
    #DirectoryIndex "/var/www/html/mainsite/index.html"                 
    ServerName mainsite.example.com                                     
    ServerAlias mainsite                                                
    ErrorLog "/var/log/httpd/mainsite.example.com-error_log"            
    CustomLog "/var/log/httpd/mainsite.example.com-access_log" common   
</VirtualHost> 

And on Reverse Proxy Server i added these lines to enable Reverse proxy

<IfModule mod_proxy.c>
    ProxyRequests Off
    <Proxy *>
        Require all granted
    </Proxy>
    # backend server and forwarded path
    ProxyPreserveHost On
    ProxyPass / http://mainsite.example.com/
    ProxyPassReverse / http://mainsite.example.com/
</IfModule>

If i try to open URL http://192.168.56.71 it will redirect to https://192.168.56.70 which is ok if i dont have Reverse proxy server but in reverse proxy scenario it should be https://192.168.56.71

Can any one guide what changes i have to made on Reverse Proxy server so the URl remains https://192.168.56.71 if i type URL http://192.168.56.71

Thanks a lot

After deploying on Prod Server

Error

[Mon May 31 09:16:26.650015 2021] [proxy_http:error] [pid 104179] (103)Software caused connection abort: [client 192.168.22.140:40286] AH01102: error reading status line from remote server 172.16.1.140:443
[Mon May 31 09:16:26.650214 2021] [proxy:error] [pid 104179] [client 192.168.22.140:40286] AH00898: Error reading from remote server returned by /
0

You should have two virtual hosts on reverse proxy server. I would recommend to delete global proxypass directives on a reverse proxy and specify them for each virtualhost.

The virtual host on port 80 should redirect to port 443 on the same host (areverseproxy.example.com) in the same way as you did it on the backend server. However, nobody should enter the 80 port on backend any more, if you make the reverse proxy properly, unless backend is accessible via internet, too.

The virtual host on port 443 should have a reverse proxy configuration.

On the reverse proxy you should have something like this:

<VirtualHost *:80>                                                      
    ServerName areverseproxy.example.com                                     
    ServerAlias areverseproxy                                                
    Redirect permanent / https://192.168.56.71                          
    ErrorLog "/var/log/httpd/areverseproxy.example.com-error_log"            
    CustomLog "/var/log/httpd/areverseproxy.example.com-access_log" common   
</VirtualHost>

<VirtualHost *:443>
    ServerName areverseproxy.example.com   
    ServerAlias areverseproxy                                                

    ErrorLog "/var/log/httpsd/areverseproxy.example.com-error_log"            
    CustomLog "/var/log/httpsd/areverseproxy.example.com-access_log" common   

    SSLEngine on
    SSLCertificateKeyFile conf/ssl.key/areverseproxy.example.com.key
    SSLCertificateFile conf/ssl.crt/areverseproxy.example.com.crt

    SSLProxyEngine on
    SSLProxyCheckPeerCN off
    SSLProxyCheckPeerExpire off
    SSLProxyCheckPeerName off

    ProxyRequests off
    ProxyPreserveHost on
    ProxyPass / https://192.168.56.70:443/
    ProxyPassReverse / https://192.168.56.70:443/
</VirtualHost>

You will probably not have a valid HTTPS certificate on backend host. Therefore, you need SSLProxyCheck* directives. If backend has valid certificates with names, than you can delete SSLProxyCheck* directives, but in that case, the ProxyPass and ProxyPassReverse directives should not point to an IP number, as in the example, but to the hostname from the certificate.

You also may not need HTTPS between proxyreverse and backend, if they are on the same protected network. If they are not, keep the HTTPS between reverse proxy and backend to protect traffic.

Remember, clients will communicate with reverse proxy only, so it is important that you have the correct HTTPS certificates for the reverse proxy, not for the backend.

5
  • really really appreciate your reply and in so short time i deployed in my Lab and it is working fine, On Production our original plan was that cyber team will access Solarwinds through VPN-->SolarWinds then plan changed Now it is VPN-->ReverseProxy and ReverseProxy will connect to SolarWinds. SolarWinds have SSL , Any more advice for this novice
    – OmiPenguin
    May 27 '21 at 6:42
  • The Redirect permanent should probably not point at an IP either, but at the hostname. You can theoretically have IPs in certificates, but it's not a real-life common usecase anymore. May 27 '21 at 7:29
  • @UlrichSchwarz You are right, and it is written in the answer. However, in the answer it is written that this is needed for the certificates. I think it is not needed only for that. It would be fine to have them also for SNI hosting if there will be more virtualhosts on the backend host.
    – nobody
    May 27 '21 at 7:58
  • @nobody can you look into error i posted above, thanks
    – OmiPenguin
    May 31 '21 at 6:25
  • There is no information, how your production servers are configured. It can be anything. I will give you just some ideas where to look. On the configuration on test servers, you have http instead of https in your ProxyPass and ProxyPassReverse directives. Try to make a manual http/https request from your proxy server to backend server to make sure, the connection is working. If you do not have graphical interface, use elinks (or wget or curl). I guess authentication on the backend does not cause problems on proxy? ProxyPass requires no absolute links on a web page, etc.
    – nobody
    Jun 1 '21 at 5:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.