Firewalling HTTP traffic using reverse Squid proxy

Wednesday, 11 February 2004, 10:37 AM EST

A common technique for protecting network resources is to place them behind a port-based firewall. Unfortunately, the practice of denying access by port number does not work well for a Web server. You need to keep port 80 open so that outside users can access the server, but if you pass all messages addressed to port 80 to the interior network, you defeat the whole purpose of a firewall. If you are going to protect a Web server with a firewall, you need an application/protocol-based firewall that allows more diverse and selective access rules. One type of firewall that provides this kind of protection is known as a proxy firewall. In this article, I will describe how to set up Squid as a proxy firewall in front of your Web server.

Squid is a popular freeware Web-content caching program. The role of Squid as a forward Web server proxy/cache is well known. In its forward proxy configuration, Squid accesses Internet data on behalf of a client on the local network. The configuration I describe in this article is exactly opposite from the common forward-proxy scenario. This article describes the case in which the Web server is on the local network and the client is connecting from the Internet. In other words, Squid is acting as a reverse proxy.

By Rajeev Kumar at Unix Review.

[ Read more ]


The price of the Internet of Things will be a vague dread of a malicious world

Regulatory practices assume untrustworthy humans living in a reliable universe. People will be tempted to lie if they think the benefits outweigh the risks, but objects won't.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Thu, Oct 8th