Apache Reverse-Proxy: server configuration

By configuring a reverse-proxy like extra layer of protection, you improve the security of your web application by minimizing the risk of attack. Apache HTTP Server has many modules and extensions that support different proxy functions. This guide explains how to set up and configure an Apache reverse proxy step by step.

What is mod_proxy?¶

Apache is a web server open source as well known as it is widespread. It is used for making web content available on the Internet. It is found on many operating systems such as Windows, Linux and macOS and there are several plugins and extension modules.

The mod_proxy module allows the Apache server to act as a reverse-proxy, forwarding requests to another server and sending the response back to the client. This procedure is very useful if you want, for example, to distribute the load between several Web servers. Enough to improve performance or implement an architecture high availability.

Apache mod_proxy consists of several modules with their own functionalities. Here are some of the most important modules :

• mod_proxy : provides the main functionality of the reverse-proxy and forwards requests to another server;
• mod_proxy_http : provides proxy functions for HTTP and HTTPS protocols;
• mod_proxy_ftp : has proxy functions for the FTP protocol;
• mod_proxy_connect : for SSL encrypted connections;
• mod_proxy_ajp : used to redirect requests to AJP compatible application servers;
• mod_proxy_wstunnel : for using web sockets;
• mod_proxy_balancer : load balancing functions;
• mod_cache : implements a caching filter;
• mod_headers : modifies HTTP header lines;
• mod_deflate : compresses HTTP responses.

Setting up an Apache reverse proxy step by step¶

This tutorial assumes that you have already installed Apache on your system. For this purpose, you will find detailed information on how to configure an Apache web server in our Digital Guide.

Step 1: Update Package List¶

First of all, you need to update the list of available packages.

Type the following command in a terminal window:

$ sudo aptitude update

Then update the packages installed on your system:

$ sudo aptitude upgrade -y

Step 2: Download Build Essential¶

Then you have to install the package Build Essential. It is a package of tools and libraries necessary for creating and compiling applications on Linux.

$ sudo aptitude install -y build-essential

Step 3: Install modules and dependencies¶

Now you need to download and install the modules and libraries necessary for the Apache reverse-proxy.

$ sudo aptitude install -y libapache2-mod-proxy-html libxml2-dev

Step 4: Enable Modules¶

Before enabling extensions, verify that they have been installed correctly. The following command displays the list of available modules:

When executing the order a2enmod, the system asks which modules you want to install. You can list the desired extensions in a single line:

$ proxy proxy_ajp proxy_http rewrite deflate headers proxy_balancer proxy_connect proxy_html

But you can also activate each module separately:

$ a2enmod proxy
$ a2enmod proxy_http
$ a2enmod proxy_ajp
$ a2enmod rewrite
$ a2enmod deflate
$ a2enmod headers
$ a2enmod proxy_balancer
$ a2enmod proxy_connect
$ a2enmod proxy_html

Some modules are enabled by default. With a2enmodyou make sure that they are activated.

Step 5: Change the Default Configuration¶

Implementing the Apache server proxy functions involves modifying the standard configuration file 000-default.confin the */etc/apache2/sites-enabled* directory.

$ nano /etc/apache2/sites-enabled/000-default.conf

This is done by setting up a virtual proxy host with extensions mod_virtualhost and mod_proxy. You can adapt the code to your liking.

<VirtualHost *:*>
        ProxyPreserveHost On

        # Servers to proxy the connection, or;
        # List of application servers:
        # Usage:
        # ProxyPass / http://[IP Addr.]:[port]/
        # ProxyPassReverse / http://[IP Addr.]:[port]/
        # Example:
        ProxyPass / http://0.0.0.0:8080/
        ProxyPassReverse / http://0.0.0.0:8080/

        ServerName localhost
    </VirtualHost>

To push on Ctrl+ XAnd Yto save changes and close the text editor.

Step 6: Configure Load Balancing¶

If you operate multiple backend servers, it is better to distribute the load using the load-balancing.

To do this, you can use the following code as a model to insert it into the standard configuration file:

<Proxy balancer://mycluster>
        # Define back-end servers:

        # Server 1
        BalancerMember http://0.0.0.0:8080/

        # Server 2
        BalancerMember http://0.0.0.0:8081/
    </Proxy>

    <VirtualHost *:*>
        # Apply VH settings as desired
        # However, configure ProxyPass argument to
        # use "mycluster" to balance the load

        ProxyPass / balancer://mycluster
    </VirtualHost>

Step 7: Configure SSL¶

If you want to use Apache SSL to encrypted connections and certificatesyou must enable a second virtual host.

Listen 443

    NameVirtualHost *:443
    <VirtualHost *:443>

        SSLEngine On

        # Set the path to SSL certificate
        # Usage: SSLCertificateFile /path/to/cert.pem
        SSLCertificateFile /etc/apache2/ssl/file.pem


        # Servers to proxy the connection, or;
        # List of application servers:
        # Usage:
        # ProxyPass / http://[IP Addr.]:[port]/
        # ProxyPassReverse / http://[IP Addr.]:[port]/
        # Example:
        ProxyPass / http://0.0.0.0:8080/
        ProxyPassReverse / http://0.0.0.0:8080/

        # Or, balance the load:
        # ProxyPass / balancer://balancer_cluster_name

    </VirtualHost>

Step 8: Restart Apache¶

Once setup is complete, restart the web server Apache for the changes to be taken into account.

$ service apache2 restart

Now the Apache reverse-proxy should forward requests to your backend servers.