Barracuda Networks SSL VPN, Administrator'S Manual

Page: 45 / 124

Resources 45
Web Forwards
Web Forwards provide a secure way of remotely accessing a company’s intranet resources e.g. a Web
mail service, internal company Twiki or intranet site and as such are an essential tool in helping
reduce the risk of unauthorized access to the corporate network. Simply put, Web Forwards redirect
HTTP traffic. By creating a Web Forward the publisher can make an internal Web resource accessible
to remote users – without ever having to publish the resource on to the Web.
Take for example a company intranet or an internal Web-based application. Without Web Forwards
users can only access these resources internally within the LAN. The ability to access these remotely
would mean having to publish these company resources on the Internet. Making a company’s
sensitive internal resources available over an untrusted publicly accessible network leaves the system
vulnerable to attacks.
Publishing Web Forwards on a VPN instantly minimizes the chances of the internal network being
compromised since:
• Remote users have to sign in to the user portal through strict authentication techniques.
• During the course of the session the communication channels are secured through SSL.
• The appliance’s policy settings can restrict those users that can even access the Web Forward.
Because different Web applications have different behavior it is necessary to have different types of
Web Forward to access them. There are currently 4 types of Web Forward available which address
this problem. Each type of forward is explained below
Tunneled
Does it use the Barracuda SSL VPN Agent?
Yes. If not already running, the Agent is downloaded and started on the client machine.
How it works
The Agent opens up a tunnel from the client to the target resource and points the Web browser at the
client end - this provides the secure connection. All HTTP traffic passes unaltered through the tunnel
between the client machine and the target resource; the Barracuda SSL VPN acts as a simple relay
between the two.
Usage
Suitable for static intranets.
NOTE: The unique feature is that no content is processed. This does mean, however, that if the target
site has links to external sites and those are selected, then those pages will be out of the secure SSL
tunnel boundary and will not be securely accessed.
Reverse Proxy
A Reverse Proxy is a gateway to an HTTP server or network of servers. It acts as the final IP address
for requests from outside the network thus enabling controlled access from the Web. One of the most
immediate benefits of using a Reverse Proxy is that clients have a single point of access to the HTTP
servers.