0

I am looking for a piece of software that I can use to forward all HTTP connections, similar to a reverse proxy. However, unlike a typical reverse proxy, the server forwarding the requests cannot initiate connections to the backend. I am essentially trying to safely transform a server that runs on an internal network into a public server.

Essentially, this would need to work as:

  1. Public server listens for a socket connection from the server inside the firewall.
  2. The private server connects to the public server.
  3. The public server then starts listening for HTTP requests on the internet.
  4. The public server then multiplexes all incoming HTTP requests across the socket connection established in step 2, such that the server inside the firewall believes those requests came to it directly.

If I can't find this software already implemented I'll have to do it, but figured I'd ask here first.

Thanks!

0

As far as I know, there isn't any software that does this. The issue here is that HTTP is not a symmetrical protocol, it has very clear expectations for which end does what, so you can't really reverse the lower-layer connection direction and have it still work.

You might be able to achieve something similar to what you want by running a VPN link between the public and private systems and using a firewall to restrict connections over that link to only work to the port that the private web server is running on. Port-forwarding using an SSH tunnel from the private system to the public one would be the easiest means of doing this.. Something like the following will get you the tunnel and port-forward:

ssh -R 127.0.0.1:8888:127.0.0.1:80 -N user@public

And then you can have something like nginx on the public system just point at 127.0.0.1:8888 as the upstream server.

All that aside, you may be overthinking this. If your public system is on a proper isolated DMZ network and you've got any remotely decent router and firewall involved, you can easily restrict that public system to only connecting to the exact port needed on the internal system, which will give you pretty much the exact same level of security as you would have by doing what you're talking about.

  • Sorry for the extremely late reply. Agreed, it's overthinking it, but my employer says it must be this way. The SSH tunnel appears to serve my needs. Thanks! – malexdev Apr 14 '18 at 3:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.