In my topology I have a secured area where all the servers are. There is also a DMZ with a few reverse proxy servers. I now need to make one of the servers in the secure area open to make HTTP calls to the Internet (to a specific IP address).

I can think of two possible implementations:

  1. tunnel at the router level
  2. set up a forward proxy in the DMZ

Which way would be preferred?

  • What kind of secured area? How are the http-calls secured? What do you mean by tunneling on the router level? – Tobi Nary Dec 2 '17 at 16:42
  • 1
    I think you mean a reverse proxy as opposed to a forward proxy. Reverse proxies are meant to hide your backend servers from the client; forward proxies are meant to hide the client from the server. – Philip Rowlands Dec 2 '17 at 17:00
  • If you do not plan to implement any specific scanning or filtering both solutions are OK. Typically a proxy level allows easier authentication of the App however existing routers/firewalls only need an additional outgoing (NAT) rule so the investment is probably smaller. – eckes May 1 '18 at 22:45

A normal proxy (aka forward proxy) is an infrastructure service. I mean it's a service "somewhere underneath" your customer/business service. Just like internal DNS or monitoring or iLO/iDRAC.

How much separation is needed from the hostile world? Much vulnerability appears at the point where your systems listen. Manage that first, think about other reasons later.

Allowing a normal proxy to listen to requests from DMZ adds risk. Since the financial cost doesn't change much, I'd say place it deeper.

Deeper could mean in web application server segment, but it would be best to place it in separate infrastructural segment (depending on cost).

Having resolved the listener part, now the connector part. It follows you can "tunnel at the router level", which is probably better known as "route that traffic".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.