In my topology I have a secured area where all the servers are. There is also a DMZ with a few reverse proxy servers. I now need to make one of the servers in the secure area open to make HTTP calls to the Internet (to a specific IP address).

I can think of two possible implementations:

  1. tunnel at the router level
  2. set up a forward proxy in the DMZ

Which way would be preferred?

  • What kind of secured area? How are the http-calls secured? What do you mean by tunneling on the router level?
    – Tobi Nary
    Dec 2, 2017 at 16:42
  • 1
    I think you mean a reverse proxy as opposed to a forward proxy. Reverse proxies are meant to hide your backend servers from the client; forward proxies are meant to hide the client from the server. Dec 2, 2017 at 17:00
  • If you do not plan to implement any specific scanning or filtering both solutions are OK. Typically a proxy level allows easier authentication of the App however existing routers/firewalls only need an additional outgoing (NAT) rule so the investment is probably smaller.
    – eckes
    May 1, 2018 at 22:45

2 Answers 2


A normal proxy (aka forward proxy) is an infrastructure service. I mean it's a service "somewhere underneath" your customer/business service. Just like internal DNS or monitoring or iLO/iDRAC.

How much separation is needed from the hostile world? Much vulnerability appears at the point where your systems listen. Manage that first, think about other reasons later.

Allowing a normal proxy to listen to requests from DMZ adds risk. Since the financial cost doesn't change much, I'd say place it deeper.

Deeper could mean in web application server segment, but it would be best to place it in separate infrastructural segment (depending on cost).

Having resolved the listener part, now the connector part. It follows you can "tunnel at the router level", which is probably better known as "route that traffic".


On a data point of view, both ways will be close: you want to allow a machine in the private zone to send HTTP requests to a well known external server. This adds a small surface attack to that machine from anyone that could pretend to be the external server. Only you can know whether that risk can be accepted, but this is generally seen as acceptable once identified.

The difference between using a direct route and passing through a proxy is simple:

  • direct route: no additional machine involved, but you leak a private address on the internet. Furthermore, if you are using truely private address in the secure network (like 192.168.xxx.yyy) this is not an option at all.
  • proxy: you only send external addresses on internet but you add a new configuration point. You now have to:
    • allow HTTP from the internal machine to the proxy
    • inject proxy rules into the proxy

Only my opinion, but I would prefere the proxy option. Leaking private addresses is not among best practices.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.