11

I'm trying to learn about why reverse proxy servers are useful. I just read...

Security and anonymity – By intercepting requests headed for your backend servers, a reverse proxy server protects their identities and acts as an additional defense against security attacks. It also ensures that multiple servers can be accessed from a single record locator or URL regardless of the structure of your local area network. https://www.nginx.com/resources/glossary/reverse-proxy-server/

Why is it helpful that the identity of your backend servers are hidden? Couldn't one just still attack them through the reverse proxy server like how any normal client visiting the app would access them?

Improve this question
4
  • Proxy won’t allow access to everything on that server. Especially non-www resources. Commented Dec 19, 2017 at 19:19
  • @SamiKuhmonen So basically the proxy ensures that all communication is via HTTP or HTTPS and since the identity of the back-end servers are hidden it's okay or at least safer to have them freely accept other types of traffic? Commented Dec 19, 2017 at 19:22
  • That is one of the benefits. But I’m not sure if this is really an SO matter since it’s more about security and network matters rather than programming. Commented Dec 19, 2017 at 19:23
  • @SamiKuhmonen My bad. I'll use the appropriate StackExchange site from now on. Do you mind explaining any other benefits? Commented Dec 19, 2017 at 19:28

2 Answers 2

Reset to default
13

You can fine-tune the access restrictions for every request, apply rate-limiting and load-balancing so a possible attack may not bring down your whole infrastructure. Especially the load-balancing aspect is key. Additionally, the only server visible to the internet is the reverse proxy, so it's not a trivial task to map your entire server structure as it would be if you exposed them all.

A common use-case is setting the reverse proxy up as the SSL gateway so you can communicate via HTTP behind the firewall. Failover for non-responding servers is also possible. Adding additional servers to the setup is trivial this way.

Apart from this, the immediate benefit is a centralized setup that you don't have to replicate for all the servers behind the firewall. Also, a reverse proxy enables you to expose only HTTP/HTTPS port for one external IP address but have multiple services running with local IPs you can route wherever you want.

Please note that this question likely belongs on Server Fault since it's related to network and server infrastructure.

Improve this answer
Sign up to request clarification or add additional context in comments.

3 Comments

@herrOkay. So basically it's way easier to setup and since the server's identity is hidden nobody will be able to find it and therefore 1. the server won't be overloaded by an attacker 2. you don't need to encrypt the communication b/w back-end services.
@herrOkay I didn't know about Server Fault. Thanks!
@MattGoldwater: Basically. Even on single-server setups is greatly simplifies routing. When running a Python, Node.js or similar applications, you should always put a reverse proxy in front of it because a web server is very good at serving web content while the minimal server implementations of those frameworks are not. With the help of NAXSI, you can set up Nginx as a kind of web firewall. Compare: n0where.net/nginx-web-application-firewall-naxsi
6

“A reverse proxy can hide the topology and characteristics of your back-end servers by removing the need for direct internet access to them. You can place your reverse proxy in an internet facing DMZ, but hide your web servers inside a non-public subnet.” [ 1 ]

“By intercepting requests headed for your backend servers, a reverse proxy server protects their identities and acts as an additional defense against security attacks. It also ensures that multiple servers can be accessed from a single record locator or URL regardless of the structure of your local area network.” [ 2 ]

There is a question related to this topic here. Hope it helps

Improve this answer

Comments

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.