Open Source Security: Reverse Proxies

today we're going to talk about open solar security but specifically I was trying to come up with what wasn't a very practical thing that we could talk about and demonstrate and learn how to do using open source tools that that's really going to give us you know something that we can take home and use and obviously it's going to provide some security for us so you may have heard of reverse proxies you may have not you may not have heard of reverse proxies we're specifically going to set one up using engine X today but before we talk about how to do that I want to talk about what a reverse proxy does not do so I will talk specifically about how it actually works but it's really important to know that this is not the end all security tool in the open-source quiver or you know in technology in general because things like an SQL vulnerability in your application the reverse proxy is going to you know get the stuff from you know I think I can get a pen here so we have you know the web here and this is you know we're all evil things happen bla bla bla if if you get a request and it comes through your router and then goes through your reverse proxy to your server and there is an SQL vulnerability on your server the reverse proxy server will quite happily transmit that that vulnerability back and forth Thanks it's not going to protect you from an application-level security issue okay so it's not a way to protect everything inside of your your assist your network from evil things on the cloud it's just one tool that does that does a few different things now where this this open source tool that we're using today again it's nginx there are other open source tools that will do reverse proxy like Apache you can set up a reverse proxy with Apache but there are other tools like Microsoft for example has reverse proxying tools and so this could be a Microsoft box and it could be using something like you've probably heard of threat management gateway I think there's there's a whole bunch of other initials that Microsoft has now I think it was replaced with something called ISA there's there security tools and they do reverse proxying they also have firewalling built in and they can sniff application traffic and they can do other things but one of the big things that those products will do is provide a reverse proxy all right so what does a reverse proxy do if it doesn't save us from application level vulnerabilities well it does a few things how it actually works is a request comes in from let me turn on my pen let's get a different color because that was pretty harsh looking Oh get green okay so a request comes in from the internet comes into our router through let's say we have a single IP address the nginx reverse proxy takes that request and it says okay you're looking for my blog server and then it takes a request to the blog server and the blog server says oh somebody wants to see the blog and it returns the blog to the nginx reverse proxy it goes out through the web and back to the person who is requesting it now it might seem like you're just adding one silly step but it does something pretty cool so where the security comes in this is where I have a problem with my pen today we're going to use red because this is where like the firewall is right generally at the router level we have a firewall and this firewall is going to you know just allow a single pork to come through but when a request comes in they're going to see an engine X web server that's what they're going to see or an engine X proxy server but they're going to see nginx even if your back-end server is really running Windows and sometimes this comes into play if you have an older server or an older embedded application that you really can't update and secure if you can put a reverse proxy in there it anonymizes that traffic so the people on the internet don't know that you're running you know Windows NT they don't know that that is what the service that they're accessing is actually running on what they see is this nginx proxy machine and that's what they they interface they just interface with the proxy and the proxy interfaces with the server and that allows you that anonymizing back-end it can also do things like load balancing so you can have one nginx you know proxy server and you can have multiple computers in the back you can have you know server one server to server 237 and it can say okay I've sent one connection here I'm going to send one here I'm going to send one here we're going to do things a little bit differently today again there it's very flexible this is some of the things they can do what we're going to do is solve a problem and of course we also get the security features like I talked about with this but we're solving a problem when you're trying to access multiple computers behind a single router or a single IP address on your network and so that's where we're going to introduce you to Fredrik okay so here's Fredrik here's a guy over here he's wearing glasses I'd like to say he looks like me but Fredrik has more hair than I do so Fredrik is inside a local limit a local LAN okay so we're inside a LAN right now and inside his land he can access these three different servers now you'll see this server up here it's a DNS name it has a DNS name of Pookie now I'm a Garfield fan so you know a lot of my stuff has to do with Garfield but Pookie is the name of the server when he goes to HTTP Pookie he gets directly to that because he's on the same LAN I'm the same thing with this server it's at this IP address 192.168.1.1 he goes to that IP address he gets that webserver and then down here as well when he accesses this over notice this one is on port 8000 okay so this is actually a different port but he can still directly connect to it because he's on the same LAN hopefully that makes sense these are just multiple servers inside you know the building that he works at the school that he attended the problem happens when he is outside and this is the problem that we're going to solve because here we have a router right this is this is the router that has a single IP address that's facing the outside world so when he's home that's the only IP address that he can hit now you can do a couple things to access multiple servers inside your network one you can just forward port 80 because that's the the web traffic port is port 80 I'm gonna try to draw an 80 here and it's going to be really ugly Wow okay that's great I'm not using a pen I'm using a mouse if you couldn't guess but port 80 can be transferred and like open a pin hole in the firewall so that port 80 traffic goes right to this 192 168 1.5 okay now you could also open port 8000 oh wow you should not draw with a with a mouse but port 8000 you could open up another pinhole so that he can access you know this single IP address port 8000 and then get to this server the problem is what about this one up here he wants to get to the pookie server but if you know it's already forwarded port 80 into this one 92168 1.5 well that's a problem because you can only forward port 80 to one internal computer so he's either going to be able to access this 1.5 or Pooky but he can't access both of them on a single IP address using port 80 and that's a real problem because sometimes there are multiple things inside his network that he wants to do and then there's another problem too if you start poking all of these holes into your firewall you don't you don't want to open up you know port 80 in port 8000 and there's another server so let's make that on port 623 and in others in other port so let's do that on port 8080 88 you don't want to open up all of these holes in your firewall ideally you want to have the least number of ports going through your firewall that you can possibly have because you want to protect your internal network so a reverse proxy is a great solution and here we go here's how it works we using a reverse proxy so we still have the same servers this one is named based it's called Pookie it's accessed on port 80 this is one I two and six 81.5 on port 80 and this is one on two and sixty-eight 1.70 and on port 8000 here is our reverse proxy now it sits behind the firewall the firewall is right here and here is our router so frederick is at home and he won't need to access all three of these servers so what the proxy does is it just creates a virtualized named based website so it uses name-based virtual ization just like you can set up virtual hosts on a webserver it's virtual hosting but they're reverse proxies and it uses just the single IP and they all use port 80 so that means we only have to open up the single port in our firewall to get back and forth and the proxy will then point to the internal servers based on whatever name Fredrik asks for on the outside hopefully that makes sense and I do have a demo but I want to describe what our demo is going to be like because it's starting to get complicated like oh my goodness look at all these arrows so what we're going to do is we're going to have these three servers they're actually set up we'll look at those I have those set up on my network already they're just very simple web servers this pookie server is running on port 80 and it responds when you go to Pookie this one's on you know IP based and it responds on port 80 this is IP based and it goes on port 8000 and what we're going to do is we're going to use names DNS names blue purple and green alright and we're going to those all map to the single IP address that is on the nginx server however when Frederick says I would like HTTP colon slash slash blue it's going to get the website from this nginx server because that's its IP address and the nginx server saying you want blue I will give you Pookie and Frederick says hey I want HTTP colon slash slash purple and then the nginx server says you want purple I will give you one I to one six 81.5 and the same thing with this green if you go to HTTP be green it's going to give you that it's only using the single IP address and it's only using the single port 80 but it's allowing us to access all those multiple services behind the single IP address all right hopefully that makes sense as to what we're doing and you know what exactly is going on but we're going to actually do the demo now because that's where the fun really comes into play is the demo so Frederick you stay here well maybe come back to you to clarify after the fact but let's switch over to my computer okay so the scenario that I just described is laid out here and I made shortcuts on here just to show you so one 92168 1.17 that is running a web server if I click on that the green background here says I'm running a server on this IP address and I'm running on port 8000 notice that it's like port 8000 up here in the URL if we click on the shortcut link to one 92168 1.5 you notice there's no port which means it's port 80 because that's a default port and it says I'm server this and I'm running on port 80 and then of course Pookie is name based if we go to HTTP Pookie it says I'm the Pookie server and I'm running on port 80 so that is awesome now this machine that we're sitting on is going to be our nginx reverse proxy which means that we're going to access all of the we're going to point that single IP address is going to be 127.0.0.1 it's going to be our localhost but right now there's nothing installed on this server we go to local else is going to say dude there's there's no server running here you can't you can't access localhost at all same thing with all of these various URLs here although see how it's blue green purple if we come over to the command line and we ping blue it is already mapped so the DNS name is set up 127.0.0.1 so the the DNS name is actually all set up and if you want to see where I did that it's in etc hosts all I did is add purple green and blue into this DNS hosts file which allows us to quickly add a DNS entry in here that's just a little bonus cool thing that you can do if you're on Linux but anyway clear this screen what we need to do is install nginx on our machine so that we can tell nginx which machines we want to point to in the background so first things first sudo apt-get install you have to spell install correctly install nginx my password it's going to install good my internet connection is working it's going to install its installed everything properly it's working and now we should have nginx running let's see we click on localhost aha welcome to nginx so we have a web server running but we want to setup reverse proxies with these names on them that are going to point to this single IP address and redirect it into the background so let's go into etc nginx now inside here if you're not familiar with nginx it's it's configured a lot like Apache but it's going to be in the etc nginx folder I'm running oh sorry this is Ubuntu you 16:04 that I'm running this is the mate' version but this is Ubuntu you can do this Entebbe and you can do the son sent to us I'm just a boon to fan so I'm using Ubuntu but inside here you'll notice there's this cool file that they give us it's called proxy params let's look at that really quick because I want to show you proxy params but there's a set of configuration directives that we are going to have to add for our virtual host in order to turn it into a reverse proxy now the nice thing is it's already set up here right we can just include this file and have these settings in place so proxy set header host HTTP host there are a lot of other options that could be added into here but we are doing the most basic level of reverse proxying and so we can just use the default in stuff that they include in that file so let's quit out of here just if you want to look at these really quick though it's doing like a forwarding the proxy and it'll say you know it's it's proxying for what external IP address and where is it going to and what IP address should I give it as the remote address so it gives the internal server a bunch of information and that's just inside this proxy params file what we're going to do is we're going to set up a new website now normally we would put it inside sites available and then we would create a symbolic link to the sites enabled folder I'm just going to go right into sites enabled and inside here we'll see a default I'm just going to create them in here to save the time of linking and doing symbolic linking so if it's inside the sites in enabled folder it's going to be an active site so let's actually start by creating a file so sudo VI let's let's do the first one and call it blue comp all right so here we have blue I'm using VI is my editor because I've done it for like 25 years but whatever editor you like just know that you're going to have to use sudo privileges in order to edit these so I'm using VI and what we need to do is create a virtual host file just like if we were creating a virtual web host file it's configured the same way but instead of stead of sending webpages to the user it's redirecting it in the background using that reverse proxy mechanism to a different server alright so we need to configure it just like a virtual host so server open brackets listen on port 80 again 80 is the default web port that's the port that we want it to listen on for incoming connections server underscore name and this is where we say okay you're going to be requesting a website from my single IP address but it's important to know that when a web browser asks for a website it asks for it by name so even though it's going to be connecting to 127.0.0.1 that request is also going to include the name of the website that it wants in our case that's going to be blue the server name is just blue that's a DNS name and that's what it's we're going to be requesting so server name is blue put a couple spaces here now we have to say okay what do I want to happen when we actually you know this is we've just set up a website here the it's named blue on listening on port 80 what do I want it to do when it connects well when it connects to the location forward slash like the root of the quote-unquote website we want it to do the following so we're going to open brackets and inside the brackets we're going to say proxy underscore pass and then where we want it to redirect to we want it to and I guess redirect is a bad name where we want it to funnel the traffic to and from because it's not just like handing it off it's actually going all of the traffic is going through this nginx server so our proxy pass we're going to say I want to send it to HTTP colon slash slash and let's see blue was Pookie so Pookie and that is where I wanted to go semicolon at the end of every line of the configuration here all right and now we need to say include etc nginx proxy rams I think it was underscore so proxy params that's the name of that file that contains those those few lines now we could just copy and paste that in if we wanted to just open up that proxy params file and you know copy the text and paste it right in here instead of using an include file we could but it's cleaner if we just include the proxy params file from the etc nginx folder so we do that I'm going to close this location stanza and now we actually need to close the entire server stanza and it's this vim actually does a nice job of highlighting what we're closing so we've we've created a virtual host that is named blue so listening on port 80 and at the root level it's going to pass all of the requests to an internal server called pookie and of course we've included those parameters from that proxy params file so let's say this awesome and now if we do sudo service nginx restart okay it's restarted now let's go to a browser and see how it worked let's actually clear everything I'm going to clear all recent history so we're not getting any cached information and we have a blank screen here all right so if we go to pookie we know that we're going to get that blue screen that says pookie but what if we go to HTTP blue now because remember before it said there's nothing running here but now if we go to blue which resolves to the localhost boom it actually takes us and gives us the pookie information says I'm the pookie server I'm running on port 80 but look up here it's actually HTTP colon slash slash blue which we know resolves to this computer itself right it's it's it's resolving to 127.0.0.1 it's not resolving to Pookie's address however because we've set up that reverse proxy it's now going through nginx and nginx is retrieving the site and bringing it back to us let's quickly do the other ones and actually let's just copy because I'm lazy right let's say copy blue comp to purple comm and sudo copy blue comp to green comp and now if we look in here we have all of these websites available but we do need to edit it we did blue already so let's let's look at green pseudo VI green Kampf and now we still want it to listen on port 80 remember we only want to have to put that one hole through our through our firewall so port 80 but we want it to go to the DNS name of green and here we want not to pass it to Pookie but we want to pass it to you remember what the green one was 192.168.1.2 get to a whole different port port 8000 alright so we're going to save this one so does this make sense it's listening on port 80 for somebody asking for the website called green and what it's going to give to them is this website on this port so we'll save that and we'll quickly do one more VI purple Kampf now the server name is going to be you probably figure this out purple and this time instead of going to Pookie we're going to go to one nine two one six eight 1.5 which is a completely different computer altogether it's a completely different system not the one that we're on but that's where it's going to direct us so we'll save this one so you know service nginx restart ok and now the moment of truth all right so we know that blue works we click on blue and we get the pookie server what if we click on green we click on green and now it says I'm the server on 192 168 1.17 and I'm running on port 8000 however look up here there's no port 8000 this is just HTTP colon slash slash green and this is just connecting to nginx nginx in the background is connecting to the other webserver across the network and of course purple should work the same way unless I did a typo boom I am server one 92168 1.5 running on port 80 but of course we know that we're just getting information directly from nginx because purple resolves to our engine X server now at this IP address hopefully that makes sense and look localhost is not responding it says welcome to nginx but localhost is not one of these DNS names so of course it doesn't give us anything other than the default nginx website we can have all of these reverse proxies live right alongside a standard website and UNIX is very powerful and very flexible and allows us to do all of that with one single IP address that we can poke through our server so I'm getting close on time let's go back and stop sharing cool okay so hopefully everybody sees this now and now let's see if this makes sense that we we did it let's see if it makes sense so over here Frederik says give me HTTP colon slash slash blue we connected using our server I reconnected using our single IP address my pin isn't working area we connected to the nginx server on 127.0.0.1 but because we were asking for blue it said oh I have a I have a reverse proxy configured for that so I'm going to reach out to Pookie and that's the information I'm going to send you same thing with purple it reached out and gave us this website and then even with green even though it was on a different port number on this side over here it's all still on port 80 and it says you want you want this on port 8000 I'll get that and then I'll return this to you so we're able to serve a whole bunch of different servers using a single IP address in a single port going through the firewall so that's just one of the multiple things that nginx can do to to make your system that much more flexible but also that much more secure because again it's hiding what kind of server is back here all they see is this computer right here all they see is the nginx server and that's what they point to so anyway nginx is awesome I urge you to play with it because you know what it's completely free it's open source it's very powerful I like to use nginx as my reverse proxy as opposed to setting up Apache as a reverse proxy because nginx is so fast and so efficient you can use a tiny little server and it will redirect traffic to you know multiple servers in the background so you can use a fairly small system here and not worry about you know loading up with RAM and hard drive space and all that stuff lots of CPU you don't need that because it just redirects and and sends traffic back and forth so that that truly is all there is to setting up nginx and I again I urge you to do it on your system play with it test it out and even at home let's say you can only have one port come through your firewall at home but you want to be able to access multiple servers inside your house while you're out and about hey set up a reverse proxy and you're going to be able to access all of those things based on names it's powerful it's awesome and it's free and with that I will hand it back over to Jack because I could just talk about nginx and stuff all day but my time has come to an end we didn't have any any tough questions so that's good that means that either everybody fell asleep or I was fairly clear in what I was talking about normally you would not use 127.0.0.1 as your nginx server again that's just because it's a great way to learn in a lab environment normally this would be you know its own computer using an IP address that you can forward into and and it would be accessing other computers on on your network but anyway Jack I'll hand it over to you thank you everybody for listening and paying attention I hope this was helpful

Channel: CBT Nuggets

Views: 51,710

Keywords: how to, reverse proxy, proxy vs reverse proxy, forward proxy vs reverse proxy, reverse proxy vs load balancer, reverse proxy setup, reverse proxy unraid, proxy vs reverse proxy vs load balancer, reverse proxy tutorial, reverse proxy explained, reverse proxy explained simply, reverse proxy pfsense, reverse proxy nginx docker, reverse proxy synology

Id: 2fL8Otb9mTE

Length: 25min 54sec (1554 seconds)

Published: Tue Jul 26 2016