Reverse Proxy Guide. Version 2.0 April 2016

Transcription

1 Version 2.0 April 2016 Reverse Proxy Guide

2 Copyright 2016 iwebgate. All Rights Reserved. No part of this publication may be reproduced, transmitted, transcribed, stored in a retrieval system, or translated into any language in any form or by any means without the written permission of iwebgate as provided by the explicit terms and conditions of our license agreement. Basic Rights of Use Thank you for choosing iwebgate. Registration of your product is required during the installation process outlined in this document. Registration of a single product entitles you to begin using the product for the specific purposes of the product. Additional licensing might be required to use additional features. For more information about iwebgate, visit us at Trademarks Microsoft, Windows, Windows NT, and Vista are registered trademarks of Microsoft Corporation. Other brand and product names are registered trademarks or trademarks of their respective holders. Statement of Conditions To ensure proper operational function and/or reliability of the product is maintained, iwebgate reserves the right to make changes to the product described within this document, via electronic means or otherwise, without notice. iwebgate does not assume any liability that may occur due to the use, or application of, the product described herein.

3 Table of Contents Introduction 4 1. Upload Signed Certificate in VSP 4 2. Adding & Changing DNS Entries 6 3. Configure Reverse Proxies in VSP 6 4. Add MFA to the Proxy Connect to the Proxy 12

4 Introduction This guide will show how to use the Virtual Segmentation Platform (VSP) to set up a reverse proxy. The VSP connects to back-end webservers via HTTP or HTTPS, but it will only allow client connections to the Reverse Proxy via HTTPS. The steps for establishing an proxy with the VSP are: 1. Upload Signed Certificate 2. Add a DNS Entry 3. Configure the Reverse Proxy in VSP 4. Add MFA to the Proxy 5. Connect to the Proxy Since this is a guide of how to setup a reverse proxy, additional information on the VSP can be found in its detailed manuals. Requirements: Certificate/Private Key for the domain of the proxied website signed by a Certificate Authority (e.g. *.p12 or *.pfx) Administrator login credentials to the Virtual Segmentation Platform (VSP) Access to a DNS hosting service 1. Upload Signed Certificate in VSP Log into the Virtual Segmentation Platform (VSP) with your administrator credentials. 4

5 Click Certificate Manager on the Administration menu of the Virtual Segmentation Platform (VSP). Click Upload Signed Certificate in Certificate Manager. Click Choose File to open File Explorer to select the certificate off your device before clicking Upload. Make sure to assign the certificate by clicking Assign 5

6 2. Adding & Changing DNS Entries Using your DNS hosting services, create an A-record named vsp and provide your VSP s IP address. The VSP s IP address can be found in the URL of the platform. Change and www records to reflect the VSP s IP address as well. 3. Configure Reverse Proxies in VSP Since the back-end web server has been configured to redirect all requests from to two reverse proxies need to be created. Reconnect to the VSP in your web browser using the vsp DNS entry previously added (vsp.example.com). 6

7 Click Reverse Proxy from the Proxy LP menu in the VSP. In Proxy LP s Reverse Proxy main menu, click Add next to Backends. Type a name for the Backend and whether your internal servers are using SSL. The Load Balancing options will take effect if there are more than one server in this backend group. The options for loading balancing are: Round-Robin Least Connected IP-Hash The reverse proxy forwards each request onto the next server in the pool, and treats all servers as equals. Will direct connections to the server with the fewest connections used. This is effective in smoothing distributution when a server becomes bogged down. Ensures that user sessions from the same IP address are sticky to a single backend server. 7

8 In the Server section of Backends, click Add to input information on a new internal web server. Type the server s IP address and port; select any additional options such as making the backend act as a backup server before clicking OK. When finished adding servers, click Save to return to the Reverse Proxy main screen. 8

9 In the main Proxy menu, click Add in Frontends. Make sure Host Proxy option is clicked and enter the HTTP proxy information. 1. Type and the domain name in Name. 2. Provide the address URL the proxy will connect to in External Setup - Address. 3. In Port, type the number 80 since the connection is HTTP. 4. Choose a back-end server in Internal Setup - Address. 9

10 After adding the HTTP proxy, click Add in Frontends to enter the HTTPS proxy information. Make sure Host Proxy option is clicked and enter the HTTPS proxy information. 1. Type and the domain name in Name. 2. Provide the address URL the proxy will connect to in External Setup - Address. 3. Type the address for the back-end server in Internal Setup - Address. 4. In Port, type the number 443 since the connection is HTTPS. 10

11 Add MFA to the Proxy Proxies can use multi-factor authentication (Google Authenticator) to strengthen the security of the connection. To configure proxy authentication, click Configure MFA in the main Reverse Proxy module. Select the desired 1 st Factor Type. This is the authentication users must first enter to get through to the backend proxy servers. 11

12 Users accessing the proxy will need to enter the Time Based One-Time Password received through the Google Authethicatior app. 5. Connect to the Proxy Connect to the proxy (example.com) from a web browser. Time-to-live (TTL) determines the length of time that a DNS record is cached. You may have to wait for the TTL of the previous records to expire before being able to connect to your proxy. 12

13 Version 2.0 April 2016