1. Virtual host


Prev	Chapter 4. Application Delivery Controller (ADC)	Next

1.1. Virtual web server

Web server Read only	Protocol and Fully qualified domain name (FQDN) for the website the proxy is configured for.
Website status Drop down list	Controls if the website is served by the Web Security Manager node. Enabled The Web Security Manager node serves requests to the website. Disabled Requests to the website are served with a default 404 not found error message.
Proxy name Input field	The name of the website proxy when listed in overview tables and reports. Valid input An alphanumeric string Default value The first part of the virtual host address - ie. if the host address is intranet.domain.tld, the proxy name defaults to "intranet".
HTTP(s) listen IP Drop down list	The IP address the virtual host is bound to. Applies only to HTTPS proxies. Valid input An IP address from the drop down list. Default value The first IP-address in the drop down list.
HTTP listen port Input field	The port number the virtual HTTP host is listening to. Valid input A valid TCP/IP Port number Input example `80` Default value The port number set for the server when created.
HTTPS listen port Input field	The port number the virtual HTTPS host is listening to. Valid input A valid TCP/IP Port number Input example `443` Default value The port number set for the server when created.
Update certificates Button	Click to update or add SSL server certificate. See Section 1.2, “SSL Certificate” for details.

1.2. SSL Certificate

In the SSL certificate section the current SSL certificate in use is displayed. To upload a new certificate click the Manage certificates button.

The SSL section is only shown for SSL enabled website proxies.

1.2.1. Importing the SSL certificate

To import a certificate go to Web Firewall->Websites->Settings->Servers.

In the section Virtual web server select Update certificates.

Depending on the format of the certificate select the appropriate action in the bullet list.

1.2.1.1. Importing the PKCS12 format

If the certicifate is in the PKCS12 format follow the guidelines below:

Enter the path to the certificate file in the PKCS12 file input field.
Enter Passphrase in the Passphrase input field.
Click Save settings in the lower button pane.

1.2.1.2. Importing the PEM format

If the certificate is in the PEM format follow the guidelines below:

Open the .PEM file in a text-editor. Copy the public certificate section of the certificate.

The public key/certificate is the section of the certificate file between (and including) the certificate start and end tags. Example:
```
-----BEGIN CERTIFICATE-----
 Certificate characters
-----END CERTIFICATE----- 
```
Select Import SSL certificate In the Web Security Manager management interface

Paste the SSL public key/certificate into the SSL-certificate field.
Now copy the (SSL) private key section of the certificate. The (SSL) private key is the section of the certificate file between (and including) the private key start and end tags. Example:
```
-----BEGIN RSA PRIVATE KEY-----
 Private key characters 
-----END RSA PRIVATE KEY-----
```
Enter the passphrase for the private key in the passphrase field (if the original private key was encrypted).
If a certificate authority chain is provided with your certificate enter the entire list of certificates (more than one certificate may be provided) in the SSL authority certificate(s) chain field

1.2.2. Exporting certificate from web server

When creating a proxy for an existing HTTPS web server you need to move the SSL-certificate from the web server to Web Security Manager. This is done by exporting the SSL-certificate from the web server and importing it into Web Security Manager.

Web Security Manager supports importing of PKCS12 and PEM encoded server certificates.

To export a certificate from the web server please refer to the vendors guidelines:

Microsoft

Microsoft guidelines can be found on these addresses:

IIS 5.0: How to back up a server certificate in Internet Information Services 5.0
IIS 6.0: Exporting a Client Certificate for One-to-One Mapping

Export the certificate to a .PFX file (default) which is PKCS12 encoded.

Apache

For web servers running Apache:

Obtain the SSL-certificate file from the web servers file system. By default the file is PEM-encoded.

1.3. Virtual host aliases

To configure Web Security Manager to handle requests for host aliases to the proxied domain name (e.g. www.mydomain.com) add a list of aliases in this section.

For instance if the web system answering requests to www.mydomain.com also serves requests to mydomain.com, www.mydomain.net and mydomain.net with the same content of www.mydomain.com, the alias domain names, when added in this section, will be proxied by Web Security Manager as aliases to the "main" virtual host.

Virtual host aliases

Input area

A list of host names.

Valid input

Hostnames separated by new-line.

Wildcard character * can be used to substitute the server name and sub domains.

Input example

mydomain.com

www.mydomain.net

*.mydomain.net - matches www.mydomain.net, www.intra.mydomain.net, a.b.c.d.e.f.mydomain.net...

10.10.10.20

Default value

<none>

The proxied requests for virtual host aliases are filtered and forwarded without modification of the host header.

1.3.1. Wildcards

The wildcard character * can be used to match the server name part of the domain name (e.g. www). If for instance the the domain names www. domain.net, www2.domain.net, www3.domain.net and webserver.domain.net all point to the same server with the same server the wildcard expression *.domain.net can be used to match all HTTP requests pointing to domain.net - provided, of course, that the DNS records of the respective hosts all point to Web Security Manager.

1.4. Timeouts

Client READ header timeout Input field	Max time to wait for the client request header. Unit Seconds Valid input Number in range 2 - 7200 Default value `60`
Client READ body timeout Input field	Max time to wait for the client request body. Unit Seconds Valid input Number in range 2 - 7200 Default value `60`
Client SEND timeout input field	Max time to wait for a client send to complete. Unit Seconds Valid input Number in range 2 - 7200 Default value `60`

1.5. HTTP Request and Connection Throttling

1.5.1. HTTP request throttling

HTTP request throttling status Info	Displays the global HTTP throttling status.
Maximum burst rate Input field	How many requests the client is allowed to exceed the allowed request rate with. If for instance the maximum burst rate is set to 20 and the request rate is limited to 5 request per second then the client may issue 20 requests for one second but will then have to wait 4 seconds until the rate is balanced. When a client for instance loads an html page it typically results in a lot of sub-requests for graphic elements, style sheets, javascript, etc. Setting a reasonable burst rate will allow for fast page loads when the request rate is limited. Unit requests / second Valid input Number in the range 0 - 1000000 Default value `20`
Throttling action Drop down list	How to handle clients exceeding limits. Delay Slow down the client by delaying responses Default selection Error 503 Return HTTP error 503
Throttling zone Drop down list	Client request rate is tracked across website proxies using four global databases, throttling zones. To account for different usage patterns throttling limits are defined separately for each global throttling zone.

1.5.2. HTTP connection throttling

HTTP connection throttling status Info	Displays the global HTTP connection throttling status.
HTTP connection throttling zone Drop down list	Client request rate is tracked across website proxies using four global databases, throttling zones. To account for different usage patterns throttling limits are defined separately for each global throttling zone.

1.6. Trusted proxy

If Web Security Manager is deployed behind another reverse proxy, by default, Web Security Manager will insert the source IP from that proxy in the X-Forwarded-For header sent to the backend web server. If the X-Forwarded-For header is already present the source IP will be appended to the header.

While this behaviour conforms to standards it is not always desirable. It is therefore possible to configure trusted proxies from which Web Security Manager will simply forwarded the X-Forwarded-For header as is.

Trusted proxy 1 and 2

Input fields

Trusted source IPs from which X-Forwarded-For header will be forwarded as is to the backend web server.

Valid input: IP address
Default value: none

1.7. Redirects

Tell the client to get the requested resource somewhere else.

The Redirect feature is used to instruct clients to make a new request with a different URL. It is often used to redirect HTTP requests for resources requiring encryption to corresponding pages on an SSL encrypted connection - HTTPS.

1.7.1. Match types

Web Security Manager allows for either prefix, regex or vhost regex based matching of client requests.

Prefix

If prefix match is selected the requested URL is matched left to right beginning with a slash (/secret).

Regex

If Regex match is selected the requested URL is matched using a regular expression. Anything goes here so it is basically possible to match asp files in a specific directory and instruct the client to request a php file in another directory on another server using HTTPS instead of HTTP.

Do not select Regex match type unless you really need it. Prefix is cheaper CPU wise.

Vhost regex

The vhost regex type allows for matching on elements in the virtual host name and redirecting to a different virtual host optionally with some of the matched elements in the target url - like redirecting foo.alertlogic.com to http://www.alertlogic.com/foo or foo.alertlogic.net to http://www.alertlogic.com/net/foo.

The syntax is dependent on the match type selected.

1.7.2. Prefix match

Enable external redirects Check box	When checked Web Security Manager will redirect client requests based on redirect rules configured.
Proto Drop down list	For website proxies serving both HTTP and HTTPS select the protocol to match. If for instance you only want to serve a specific page using the HTTPS protocol match the corresponding HTTP page and redirect to HTTPS on the same site.
Match type Drop down list	See above.
Match Input field	The client request to match. If prefix match is selected the requested URL is matched left to right beginning with a slash (/secret). Only complete path segments are matched so prefix match type is basically matching on a "directory" basis. Valid input A case-sensitive (%-decoded) path beginning with a slash Input example `/secret` - will match requests for /secret, /secret/, /secret/secret_file1.php, etc.. Will NOT match /secret_file.php. `/` - will match requests for any resource, useful for setting up an HTTP proxy which redirects all requests to the same "location" on an HTTPS proxied website. Default value `<none>`
Redirect externally to Input field	The new URL path the client is redirected to. If prefix match is selected the new URL path corresponds to the prefix matched. If /secret is entered in the match field (above) then the part of the request following the prefix (/secret) is sent to the new URL path. Valid input An absolute URL beginning with a scheme and hostname, but a URL-path beginning with a slash may also be used, in which case the scheme and hostname of the current server will be added. Input example `https://ssl.somename.tld/moresecret` - In combination with the prefix match example above /secret requests for /secret will be redirected to https://ssl.somenane.tld/moresecret, /secret/secret_file1.php will be redirected to https://ssl.somenane.tld/moresecret/secret_file1.php, etc. `https://ssl.somename.tld/` - In combination with the prefix match example / above will redirect any request to https://ssl.somename.tld. Default value `<none>`

1.7.3. Regex match

Enable external redirects Check box	When checked Web Security Manager will redirect client requests based on redirect rules configured.
Proto Drop down list	For website proxies serving both HTTP and HTTPS select the protocol to match. If for instance you only want to serve a specific page using the HTTPS protocol match the corresponding HTTP page and redirect to HTTPS on the same site.
Match type Drop down list	See above.
Match Input field	The client request to match. If Regex match is selected the requested URL is matched using a regular expression. The supplied regular expression is matched against the requested URL-path, and if it matches, the server will substitute any parenthesized matches into the redirect URL path sent in the redirect response to the client. Valid input A valid regular expression Input example `(.+)\.jsp` - will match requests for any url path ending in .jsp. The path and filename but not the extension will be in the substitute variable $1 (for instance a request for /secret/secret_java1.jsp will result in $1 containing /secret/secret_java1 making it possible to redirect to https://ssl.somename.tld$1.php resulting in the client being redirected to https://ssl.somename.tld/secret/secret_java1.php). Default value `<none>`
Redirect externally to Input field	The new URL path the client is redirected to. If Regex match is selected the parenthesized matches in $1, $2, etc. is substituted into the new URL path allowing fine grained and complex redirect rules. Valid input An absolute URL beginning with a scheme and hostname optionally with $1, $2, $3, etc. as placeholders to substitute matches into. Input example `https://ssl.somename.tld$1.php` - In combination with the regex match example (.+)\.jsp requests for any url path ending in .jsp will be redirected to https://ssl.somename.tld/ but the extension jsp will be php. For example /secret/secret_java1.jsp will be redirected to https://ssl.somename.tld/secret/secret_java1.php. Default value `<none>`

1.7.4. Vhost regex match

Enable external redirects Check box	When checked Web Security Manager will redirect client requests based on redirect rules configured.
Proto Drop down list	For website proxies serving both HTTP and HTTPS select the protocol to match. If for instance you only want to serve a specific page using the HTTPS protocol match the corresponding HTTP page and redirect to HTTPS on the same site.
Match type Drop down list	See above.
Match Input field	The vhost part of client request to match. If vhost regex match is selected the vhost part of the client request is matched using a regular expression. If it matches, the server will substitute any parenthesized matches into the redirect URL path sent in the redirect response to the client. Valid input A valid regular expression Input example foo\.alertlogic\.com www\.alertlogic\.(\w){1,5} Default value `<none>`
Redirect externally to Input field	The new URL path the client is redirected to. If the match expression contains parentheses the parenthesized matches are placed in the variables $c1, $c2, $c9. These variables can be used in the redirect URL to allow for fine grained and flexible redirects. Valid input An absolute URL beginning with a scheme and hostname optionally with $c1, $c2, $c9 as placeholders to substitute matches into. NOTE that placeholder variable names are different from the regex type above. Input example `http://www.alertlogic.com/foo` In combination with the match example foo.alertlogic.com redirects requests for the hostname foo to a corresponding subdir. `http://www.alertlogic.com/$c1` in combination with the match www\.alertlogic\.(\w{1,5} will redirect www.alertlogic.net/somepath?somequery to www.alertlogic.com/dk/somepath?somequery Default value `<none>`

1.7.5. Examples summary

The examples from the table above are summarized below. Substitute "ssl.somename.tld" with correct address.

On an HTTP proxy redirect all requests to the corresponding location on an HTTPS proxy

Match type: prefix

Match: /

Redirect externally to: https://ssl.somename.tld/

On an HTTP proxy redirect all requests for resources in /secret to /moresecret on an HTTPS proxy

Match type: prefix

Match: /secret

Redirect externally to: https://ssl.somename.tld/moresecret

On an HTTP proxy redirect all requests for .jsp to a .php script with the same name and location on an HTTPS proxy

Match type: regex

Match: (.+)\.jsp

Redirect externally to: https://ssl.somename.tld$1.php

Virtual host redirect - redirect requests to somehost.somename.cc to www.somename.tld/cc/somehost/

Match type: vhost regex

Match: (\w+)\.somename\.(\w){1,5}

Redirect externally to: http://www.somename.tld/$c2/$c1

1.8. Lower button bar

Save settings

Click Save settings to save settings.