Topic: Apache reverse proxy

[mario198787]

Hello,

I try to configure my Apache with modsec as a reverse proxy. Thus, I added in a

[mraddi]

Good morning,

do you have added/enabled the Apache-modules mod_proxy.so + mod_proxy_http.so ?
Depending on your Linux-distribution it is uncommenting two lines in a config-file or using the command a2enmod (with sudo/as root)

Best regards
Matthias

[mario198787]

I have added modules and still nothing. Maybe I give more details (maybe sth is wrong). I have such a configuration:
[img] https://ibb.co/tmQQqZM [/img]

PC1:

[tangent]

Maybe I'm missing something, but when you say on PC1 you put the following in a browser:

http://192.168.1.1/index.html?exec=/bin/bash

you see nothing in the error.log file on PC2; why would you?

PC1 is accessing PC3 directly at the network level, and not going through your Apache proxy on PC2.

Presumably, the following URL request from PC1 also logs errors on PC2?

http://192.168.1.2/index.html?exec=/bin/bash

If your intention is to hide the server on PC3, and proxy web requests through PC2, then you'll need to disable IPV4 forwarding on PC2, e.g.

[mario198787]

So,run command

[tangent]

Indeed, I'd expect you now get a timeout trying to access PC3 (192.168.1.1) from PC1 (192.168.0.1). That sysctl command has revoked IP forwarding from PC2.

With PC2 (192.168.0.2) acting as your reverse proxy, web requests from PC1 (or other clients on the 192.168.0.0 network) should be passed to the Apache server on PC3, and your mod_sec rules should be carried out as part of that process.

Based on your posts, isn't this what you were trying to achieve?

Note, I wouldn't expect clients to access PC2 via the 192.168.1.1 interface, and if that's important to you, you'll need to update the Apache configuration on PC2 to only listen on the 192.168.0.2 interface.

[mario198787]

Generally, my goal is to on PC2 security issue when I try to from PC1 open the page hosted on PC3. Now I cannot do this because of timeout. You have written that I should reconfigure Apache on PC2 to only listen on the 192.168.0.2 interface. To be honest, I don't quite understand. PC3 can be accessible via 192.168.1.2 which is an interface of PC2.

[tangent]

If you're confused, then I have to confess to being even more so.

Yes, PC2 needs both interfaces, but if you're using PC2 to act as a reverse proxy to filter web requests through to PC3, then why would you want to access PC3 directly from PC1?

To me the timeout from PC1 (192.168.0.1) going directly to PC3 (192.168.1.1) is confirmation the client has to go through the Apache reverse proxy at PC2 (192.168.0.2).

I thought that was your objective.

[mario198787]

OK. So, my intention is that PC1 should connect (on the HTTP level) with PC3 via PC2 (through reverse proxy with modsec) and get a response from PC3 (get a page in the browser, not a timeout). And as I understand you, it works like that now (timeout reason).

[James Blond]

The default gateway might be the issue.

[mario198787]

Why do you think that default gateway is a problem? Without it, I haven't got a connection with network 192.128.1.0.