Currently We are facing 1 requirement from our customer which I don't know which was the particular way to implement this. Hence, I would like to share my story here with you all

  • Requirement

We deliver 1 special iOS application for our customer. They require this IPAD only has access to some special endpoints otherwise all websites should be restricted. In this case the special endpoint is AWS IP address where it hosted our application API backend.

  • Our solution

We using the specific SIM card where it only has access to the ISP Datacenter. From there 1 peering connection between ISP Datacenter and our AWS Account was established. After all the IPAD devices able to access backend systems through this peering (AWS Direct Connect). Otherwise they cannot access anywhere else.

  • Problem

Unfortunately, due to some changes (Yah i know we all hate the change) our application need to bundle with some third party applications from outside such as api.auth0.com etc. Needless to say the IPAD devices could not reach these endpoints. As I explained at above the SIM card being used on the IPAD just has capability to reach the own AWS infrastructure which was peered with ISP Data Center.

  • My Question is

What should I implement in this scenario

My current solution : I am going to install SQUID proxy on our AWS infrastructure which is included some ACLs. Then Ipad device will use this proxy to go outside. Clearly, We able to control the traffic base on ACL.

The disadvantage thing is : If I use global proxy it meant all traffic will go through SQUID instance so We gonna add more single point failure into our system flow. While We can connect directly to our backend services now We have to go through another layer (Squid). Even We can do HA for Squid to make sure this instance will never be broken but I definitely don't like that.

The other solution : I thinking about SOCKS - with SOCKS implementation I can configure Global Proxy on IPAD pointing there instead of PROXY IP server. But I did not find any major solution for SOCKS with whitelisting (access control list)

Looking forward to any feedback Thank

  • You might try with a proxy.pac file to specify which sites should be reached using a proxy and which not. – Steffen Ullrich Jan 10 at 12:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.