Does a reverse proxy pass keep the backend server anonymous?

Question

If I have an NGINX server at 1.1.1.1 and in the NGINX server you have the config that forwards on http traffic to 2.2.2.2:

upstream 123 {
    server 2.2.2.2;
}

server {
    listen 80 default_server;
    location / {
        proxy_pass http://123;
        proxy_set_header        Host            $host;
        proxy_set_header        X-Real-IP       $remote_addr;
        proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

For an outsider who only knows the address 1.1.1.1. Is it possible for them to find out that the IP address 2.2.2.2 is the one that it is redirected to?

Answer 1

If properly configured, then yes, the IP address of the backend server would be hidden. This is the operating principle behind DDoS protection services like Cloudflare: Hide the real server behind a proxy server that can tolerate a large volume of traffic while filtering out bad requests.

That said, if it's imperative that your backend server IP remains hidden then you need to make sure it is not being leaked, either by your web application or by any DNS records that you have. If the backend server is publicly reachable, you should configure its firewall to only accept requests from the proxy server. This will prevent it from being discovered through a scan of all public IP addresses looking for a server that serves the same webpage as your proxy.

Answer 2

I assume you're saying 1.1.1.1 is forwarding all requests to 2.2.2.2 in an attempt to keep the 2.2.2.2 server IP/location anonymous. Correct?

In that case, the user would think they were communicating with 1.1.1.1. As long as you were only serving static html or documents that should be fine. The problem occurs when you throw something which does backend processing into the mix such as PHP. If there's any vulnerability in the PHP which an attacker could leverage to run $_SERVER['SERVER_ADDR']; then the user would see 1.1.1.1 reporting the hidden 2.2.2.2 ip address.

NOTE: I've edited this answer, the earlier answer was incorrect as I misinterpreted this question.

Answer 3

Using a reverse proxy in web servers allows you many features. One of these is automatic data traversal to multiple servers through reverse proxies and load balancers. The server should be completely anonymous at this point. The only way the attacker could find out the proxied server is if there was a vulnerability in the framework that allows them to run code that would leak the IP address. This leads to a much bigger question you should try to get answered:

Is my backend server secure against injection attacks?

• YES: then your backend servers are anonymous
• No: Then your backend server could be leaked to very determined individuals