Reference13r2:Services/Reverse-Proxy

From innovaphone wiki
Jump to navigation Jump to search
There are also other versions of this article available: Reference12r1 | Reference13r1 | Reference13r2 (this version) | Reference14r2 | Reference15r1


The reverse proxy is used to forward H.323, SIP, LDAP and HTTP requests it receives to other hosts, based on system information like gatekeeper name host name, path or domain. This way it can be controlled which services may be accessed thru the reverse proxy. A reverse proxy may be located at the boundary of an private and a public network, or inside the private network, if the respective ports are forwarded to it by the NAT Router/Firewall. It can be even configured on the same device as the PBX itself. In this case the other services on the device should use non-standard ports, so that the reverse proxy can receive the requests on the standard port and forward them locally to the non-standard ports.

General Parameters

No IPv4
Turn off IPv4 for the reverse proxy function
No IPv6
Turn off IPv6 for the reverse proxy function
H.323/TCP, H.323/TLS
Ports for incoming H.323 TCP or TLS Connections. Use 1720 and 1300 for the standard ports.
SIP/TCP, SIP/TLS
Ports for incoming SIP TCP or TLS Connections. Use 5060 and 5061 for the standard ports.
LDAP, LDAPs
Ports for incoming LDAP TCP or TLS Connections. Use 389 and 636 for the Standard ports.
HTTP, HTTPS
Ports for incoming HTTP TCP or TLS Connections. Use 80 and 443 for the Standard ports.
Log Forwarded Requests
activate protocol dependent logging for successfully forwarded / accepted requests
Log Rejected Requests
activate protocol dependent logging for rejected / non-accepted requests
Blacklist Expiration
Time in minutes after which an entry put in the blacklist automatically, will be removed from the blacklist.
Suspicious Requests/min
Threshold to put an address into the blacklist
Public NAT router address
Required for SIP if RP is behind NAT. External SIP clients will receive this value in Route header of SIP messages. You can configure DNS name or IP address and port here.
If not configured, RP writes it's own local IP address and port into Route header of SIP messages. This works only if RP has a public local IP address.

Hosts

List of configured hosts. Click on the host Name to edit or delete. Use new to add new host

Out
Destination IP for this rule following by the plain text port
TLS
Port for encrypted traffic
Check Certificate
If the Check Certificate checkmark is set, for the internal connection TLS is used only if the received certificate matches the user name within the protocol. This way a host receiving a request through the Reverse Proxy using TLS can assume that the connection was authenticated using a valid certificate, which matches the user.
App Login
Experimental feature to allow access only if a myPBX session has been previously authenticated. Not supported for myApps.
Default
This rule will be used if only the Domain without a path or file in the URI was requested. The empty path is then replaced by the specified URL when the request is forwarded (e.g. an entry http://<host>/web/index.htm with the Default check-mark ticked will match requests with no path and the request is forwarded with the path set to /web/index.htm). Note that also, an implicit rule is created that forwards all requests for files in and beneath the folder where the default document is in (in the example rule, requests to all files under http://<host>/web will be forwarded)
MTLS
Request MTLS on incoming connections. The requesting client has to provide the TLS Server Name on the incoming TLS connection. The Server Name is used to match to the host. If the checkmark is set, MTLS is requested then. If no Server Name is provided or no valid client certificate a connection for this host is rejected. The name od the received and validated certificate is forwarded as X-Remote-Cert HTTP header.
Network
adddr:network to restrict a configured protocol to certain networks

Counter

Current top ten address with suspicious requests

Addresses

Blacklist/Whitelist addresses