3

There are 2 machines - both running Windows Server.

Machine1 can access the internet. Machine2 cannot access the internet, but can access Machine1.

Machine2 needs to continuously access one external https GET URL on the internet. So the way I was thinking of doing this is by running a lightweight proxy server on Machine1 using this as a proxy for Machine2 to access the external URL. (I know that a better/more secure solution may be to have let Machine2 access the internet with a firewall blocking everything except the required connection - but unfortunately that is not possible in this case because various reasons)

After searching around, it seems that the general approach is to use a Webserver (Apache/nginx/IIS) running on Machine1 as a forward proxy server - there seem to be very few independent proxy servers available any more - the few independent proxies available don't seem to in active developement or support.

Is this approach secure - i.e. can Webservers be locked down securely enough so that they only serve as proxies and not add anly additional security issues? What kind of problems should I be wary of?

Improve this question
1
  • Yah this one is perfect solutions But i think if you have good knowledge of linux then use linux proxy and also configure firewall configurations on linux
    – Manthan Patel
    Aug 2, 2013 at 7:02

1 Answer 1

Reset to default
5

Assuming that you're running a relatively modern version of windows server (2008 or 2012) I think you can do this with inbuilt server functionality.

The netsh interface portproxy command allows you to setup proxying/port forwarding on a windows server. If possible I'd say go with a solution that uses OS functionality as it reduces the complexity and doesn't give you another piece of software to maintain/patch .

As to the approach of using a webserver as the proxy, that could work ok. If you go that way it would be a case of locking down the server as much as possible and then making sure it was added to the patching process to make sure it gets updated.

Improve this answer
4
  • I checked out the netsh interface proxy command. Looks like it will not be a general purpose proxy because it will forward only to one outgoing IP address - is this correct? Not that it matters to my use case - but just want to understand this better
    – user93353
    Aug 2, 2013 at 8:56
  • 1
    no I don't believe it would work as a general proxy, but should work ok in your case.
    – Rory McCune
    Aug 2, 2013 at 9:49
  • great! Thank you. Last question - it should be able to handle multiple requests and concurrent requests etc, right?
    – user93353
    Aug 2, 2013 at 9:52
  • BTW - for future users - this also works on Win2003 Server as long as you install and enable IPV6 on it (ipv6 is needed even if both the input & output ports are ipv4).
    – user93353
    Sep 6, 2013 at 6:50

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .