418
14.8 Reverse proxy
The reverse proxy provides internet access to local web servers. Security is the primary
concern for access to web servers in the LAN. For DMZ web servers the reverse proxy
can act as a load balancer. The reverse proxy accepts HTTP and HTTPS connections.
The backends can also be contacted using either HTTP or HTTPS.
A table gives you an overview of all available objects. If there are more than 10 entries,
a navigation bar will appear below the right bottom hand corner of the table where you
can page through the entries or open the table in fullscreen mode. Pick an entry by
clicking either its title or the pencil icon to enter the detail view. Add new objects by
clicking "New Entry" below the table on the left. Use the dustbin icon to delete entries.
Reverse proxy port
The proxy will listen for encrypted requests (HTTPS) on the port specified here. Leave
empty, if HTTPS is not used.
Internet access to the selected port has to be granted in SX-
GATE's firewall configuration.
The well-known HTTPS port 443 is already used by SX-GATE's
administration web server. Hence a different port must be used
here (e.g. 44300). Possibly also the well-known port 80 for HTTP
is already in use. Please check in menu "System > Services"
on tab "Server" if the service "HTTP server" is enabled. If this is
the case, port 80 can not be used by the reverse proxy. Use a
different, unused port like e.g. 8888.
If internet access to SX-GATE's administration web server is not required, the firewall
can redirect connections from the Internet on port 443 to the reverse proxy. Add
an appropriate DNAT rule to the firewall configuration of the Internet interface. If
for example SX-GATE's internal IP is 192.168.0.254 and the reverse proxy listens
for HTTPS connections on port 44300, the following DNAT rule would achieve this:
"HTTPS:*->*->192.168.0.254(44300)". The same applies to HTTP connections to port
80, if the reverse proxy is listening to a different port.
Microsoft's Outlook Web App (OWA) must be addressed via port
443. Hence the DNAT rule is required for this application.
Connection
Select the kind of connections expected on this port.
