How does the reverse proxy change internal and external security posture with a reverse proxy compared to not having a reverse proxy?

For example, you have a publicly accessible iis server, what is the differences with or without being behind a reverse proxy?

closed as unclear what you're asking by schroeder, RoraΖ, Xander, Eric G, Iszi Mar 17 '15 at 18:31

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • I think you are going to have to explain your question further – schroeder Mar 17 '15 at 14:50
  • added more details – Kamic Mar 17 '15 at 15:47

There are a couple of advantages.

If your host sits behind a reverse proxy, you are implementing the "defence in depth" model.

Let's say your web server has an exploitable vulnerability which you have not patched yet. If your web server was directly accessible without being behind a reverse proxy, your host's vulnerability can be exploited, resulting in a compromised web server and potentially leaving all other hosts on the same subnet at risk. Furthermore, if your web server needs to communicate with a datasource (such as a database), you will be putting your data at risk.

If on the other hand, your host is sitting behind a reverse proxy, any vulnerabilities exploited would leave your reverse proxy compromised, and not your "actual" web server. This is usually in a segregated DMZ with very restricted access.

Further more, implementing a reverse proxy allows you to add additional security controls to your website without using up resources on your web server. These include web application firewalls, HIDS and more. You can also implement additional layers of authentication easily in such a scenario, should you need to.

Not the answer you're looking for? Browse other questions tagged or ask your own question.