trafficserver-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Eagen, Dave" <David.Ea...@biworldwide.com>
Subject RE: Limit access based on source and destination
Date Tue, 10 May 2016 18:24:15 GMT
Thanks, that's a great point. 

-----Original Message-----
From: Reindl Harald [mailto:h.reindl@thelounge.net] 
Sent: Tuesday, May 10, 2016 1:11 PM
To: users@trafficserver.apache.org
Subject: Re: Limit access based on source and destination



Am 10.05.2016 um 20:04 schrieb Eagen, Dave:
> We have TrafficServer 6.1.1 running as a forward proxy and would like 
> to restrict access to some destination IPs. Those IPs should be 
> reachable through the proxy only for a different set of source IPs. I 
> can see in ip_allow.config that I can control whether a given set of 
> source IPs are able to use the proxy server at all but not how I can 
> allow them to use the proxy for everything except the restricted destination IPs.
>
> How can we implement this kind of access control?

such restrictions really don't belong to the proxy but on the backend server, running a reverse
proxy without translate source ip addresses is in general unwise and so if you setup is done
right you make your restrictions on the backend server as if there would be no proxy at all
(directly on the backend server or inside the application sicne REMOTE_ADDR for scripts is
also transprant translated)

or in other words: your backend config and application should not need to be aware that there
is a proxy at all in front

https://httpd.apache.org/docs/2.4/mod/mod_remoteip.html

for leagy servers running apache in outdated versions there is a "mod_rafp" 3rd party module
available


This e-mail message is being sent solely for use by the intended recipient(s) and may contain
confidential information.  Any unauthorized review, use, disclosure or distribution is prohibited.
 If you are not the intended recipient, please contact the sender by phone or reply by e-mail,
delete the original message and destroy all copies. Thank you.

Mime
View raw message