Firewalling HTTP traffic using reverse Squid proxy

A common technique for protecting network resources is to place them behind a port-based firewall. Unfortunately, the practice of denying access by port number does not work well for a Web server. You need to keep port 80 open so that outside users can access the server, but if you pass all messages addressed to port 80 to the interior network, you defeat the whole purpose of a firewall. If you are going to protect a Web server with a firewall, you need an application/protocol-based firewall that allows more diverse and selective access rules. One type of firewall that provides this kind of protection is known as a proxy firewall. In this article, I will describe how to set up Squid as a proxy firewall in front of your Web server.

Squid is a popular freeware Web-content caching program. The role of Squid as a forward Web server proxy/cache is well known. In its forward proxy configuration, Squid accesses Internet data on behalf of a client on the local network. The configuration I describe in this article is exactly opposite from the common forward-proxy scenario. This article describes the case in which the Web server is on the local network and the client is connecting from the Internet. In other words, Squid is acting as a reverse proxy.

By Rajeev Kumar at Unix Review.

[ Read more ]