Comment

Comment on Help with reverse proxy architecture

It’s not an odd question actually it’s a very good question.

Many people don’t realize that “internal” services are just as exposed as “external” ones. That’s because a reverse proxy doesn’t care about domain name resolution, it receives the domain name as a HTTP header and anybody can put anything in there. So as long as an attacker can guess your “private” naming scheme and put a correct domain name in their request, they can use your port forward to reach “private” services. All it takes is for that domain name to be defined in your reverse proxy.

In order to be safe you should be adding allow/deny rules to each proxy host to only allow LAN IPs to access the private hosts (and also exclude the internal IP of the router that’s doing the forward, if your router isn’t doing masquerading to show up as the remote IP of the visitor).

Whether the proxies are one or two doesn’t help in any way, they just forward anything that’s given to them. If you want security you have to add IP allow/deny rules or some actual authentication.

source

Sort:hotnew top

tofubl@discuss.tchncs.de ⁨9⁩ ⁨months⁩ ago
This is exactly the answer I was looking for. Thanks a bunch.

So but in that way, having a proxy on the LAN that knows about internal services, and another proxy that is exposed publicly but is only aware of public services does help by reducing firewall rule complexity. Would you say that statement is correct?

source
- lemmyvore@feddit.nl ⁨9⁩ ⁨months⁩ ago
  Oh yes, if they’re completely separate and the internal proxy can’t be reached from port forward that’s fine.
  
  I was stuck thinking about two chained proxies for some reason.
  
  source
  - tofubl@discuss.tchncs.de ⁨9⁩ ⁨months⁩ ago
    I never specified, I think, and probably wasn’t too clear on it myself. Thanks for your insights, I’ll try to take them to my configuration now.
    
    source
- markstos@lemmy.world ⁨9⁩ ⁨months⁩ ago
  The comment above is accurate how domain names can be passed to Nginx that would resolve to private IP addresses. But that doesn’t mean they need to exposed. Nginx has a listen directive that specifies what IPs are listened on. So If your Reserve Proxy has both a public IP and private IP. then the private services can have a a listen directive like this:
  
  server { # Whatever your proxy's private IP is listen 10.0.0.1; server_name my-private-service; }
  
  No matter what hostname is passed in, Nginx would only reply to requests that can reach the Nginx host at it’s private IP address.
  
  source
  - tofubl@discuss.tchncs.de ⁨9⁩ ⁨months⁩ ago
    This is a good hint, I’m going to take a look at that. Thank you!
    
    source