Hi everyone, and welcome to the Stop Refactoring channel.
In this issue we discuss web proxies .
As mentioned in the previous issue of "Large Website Security", for the sake of network security, generally large websites need to isolate the network area to prevent attackers from directly controlling the server.
The application and database of the website system will be placed in this network security area . This creates a proxy problem .
External network requests need to come in, and third-party service calls need to go out. In this installment we discuss the agency problem in detail, and we discuss it in this order:
1. Reverse proxy, external network requests come in
2. Forward proxy, requesting external network services
Reverse proxy, receiving external network requests
External network requests need to go through the unified gateway to reverse proxy into the network isolation zone. The gateway can be a load balancing service or service software such as Nginx.
If it is Nginx, the configuration of the reverse proxy is like this.
What needs to be explained here is that if the external network request is https , then it is not necessary for all services of the entire website system to be https. It is only necessary to ensure that https is configured at the gateway layer , and the internal calls of the system still use http .
If cloud services such as load balancing are used, https only needs to be configured in the load balancing service, and the call of the website system itself is still http, because there is no benefit to using https communication inside the website system, but it will reduce performance.
Forward proxy, calling external network services
Sometimes, the website system needs to call third-party services, and the super-large website system will separate several network isolation areas, and the disaster recovery backup needs to be backed up by the network isolation area.
In the above scenarios, the website system has to call a server outside the network isolation zone. At this time, it needs to forward proxy to the target server through the same proxy server .
The forward proxy can use Nginx as the service software. There are generally two ways of forward proxy, one is the 7-layer proxy, and the other is the 4-layer proxy.
The network layered model is generally divided into 7 layers according to the OSI model.
The seventh layer is the application layer , which is the commonly heard HTTP, HTTPS, RTMP, SMTP and other protocols.
The fourth layer is the transport layer , that is, basic protocols such as TCP and UDP.
The corresponding layer 7 agent and layer 4 agent are the corresponding two network layers.
If you are using a layer 7 proxy , the Nginx configuration is like this.
This configuration is consistent with the reverse proxy configuration above , and can proxy to multiple target servers by matching url keywords.
The website system calls the external network service and needs to point the IP/port to the proxy server . Of course, we recommend using the domain name call, and the call can be directed to the proxy server by modifying the server host file.
Of course, in addition to modifying the IP pointing, you can also set http_proxy, https_proxy and other parameters to set the proxy, but this method is not recommended, because it is not very good to manage.
The other is the 4-layer proxy Nginx configuration is like this, but a port needs to correspond to a target server , and the website system calls external network services also need to point the IP/port to the proxy server.
And because the layer 4 proxy is based on the basic protocols of TCP/UDP, TCP-based requests such as HTTP and RTMP can share a proxy port .
Of course, the layer 4 proxy configuration is more complicated than that of the layer 7 proxy, requiring a port corresponding to a target server.
But we recommend layer 4 proxy more .
One is that the performance and stability will be relatively high, and the other is better management. Since a port corresponds to a target external network service, if there are some unexpected problems, you can directly close the corresponding port on the proxy server to disconnect immediately Specify the external network service without affecting the call of other external network services.
Summarize
In this issue, we talked about the proxy scheme of the website system, which is actually one of the contents of the previous issue of website system security. This issue discusses it in more detail.