Proxy Servers
Summary
PDF p.136Proxy servers perform application layer filtering by deconstructing, analyzing, and rebuilding packets before forwarding them. They can be forward proxies, handling outbound traffic, or reverse proxies, handling inbound traffic. Proxies enhance security, manage traffic, and can provide caching for frequently requested content.
In plain words
Supplementary — not from your PDFA proxy receives a request, takes it apart, checks it, and rebuilds it before sending it on. A forward proxy handles users' outbound traffic, giving control, logging, authentication and caching. A reverse proxy sits in front of internal servers and handles inbound requests from the Internet. A transparent proxy intercepts traffic without any client setup; a non-transparent one must be configured in the client (manually, or with PAC/WPAD).
Detailed explanation
PDF p.136-
Proxy Server Function
- Store-and-Forward Model: Deconstructs, analyzes, and rebuilds packets.
- Rebuilding: Varies by proxy type (IP/TCP headers, HTTP headers, deep packet inspection).
-
Forward Proxy Servers
- Outbound Traffic: Handles protocol-specific outbound traffic (e.g., web proxy for TCP ports 80 and 443).
-
Benefits
- Traffic Management: Clients connect to a specified point on the perimeter network.
- Security: Provides a degree of security.
- Caching: Retains frequently requested webpages to reduce re-fetching.
- Application Understanding: Must parse and modify application-specific commands (e.g., HTTP).
-
Types
- Non-Transparent Proxy: Client configured with proxy server address and port (e.g., TCP/8080).
- Transparent Proxy: Intercepts client traffic without reconfiguration, implemented as a router or inline appliance.
- Authentication: Can require user authentication, often using single sign-on (SSO).
-
Configuration
- PAC Script: Allows automatic proxy configuration.
- WPAD Protocol: Allows browsers to locate a PAC file.
-
Reverse Proxy Servers
- Inbound Traffic: Handles protocol-specific inbound traffic.
- Deployment: Typically on the network edge, listening for client requests from a public network.
- Filtering Rules: Applies rules and forwards accepted requests to an application server within a secured subnet.
Important terms
taken from the text above- Store-and-Forward Model
- Deconstructs, analyzes, and rebuilds packets.
- Rebuilding
- Varies by proxy type (IP/TCP headers, HTTP headers, deep packet inspection).
- Outbound Traffic
- Handles protocol-specific outbound traffic (e.g., web proxy for TCP ports 80 and 443).
- Traffic Management
- Clients connect to a specified point on the perimeter network.
- Caching
- Retains frequently requested webpages to reduce re-fetching.
- Application Understanding
- Must parse and modify application-specific commands (e.g., HTTP).
- Non-Transparent Proxy
- Client configured with proxy server address and port (e.g., TCP/8080).
- Transparent Proxy
- Intercepts client traffic without reconfiguration, implemented as a router or inline appliance.
- Authentication
- Can require user authentication, often using single sign-on (SSO).
- PAC Script
- Allows automatic proxy configuration.
- WPAD Protocol
- Allows browsers to locate a PAC file.
- Inbound Traffic
- Handles protocol-specific inbound traffic.
- Deployment
- Typically on the network edge, listening for client requests from a public network.
- Filtering Rules
- Applies rules and forwards accepted requests to an application server within a secured subnet.
Examples & real-world scenarios
Supplementary — not from your PDF- A web proxy on TCP 8080 that users must authenticate to.
- A reverse proxy in front of an internal web application.
- A PAC file telling browsers which proxy to use.
Scenario
A company wants to publish an internal web app to the Internet without exposing the app server directly. A reverse proxy at the edge filters requests and forwards only accepted ones to the protected subnet.
Common mistakes
Supplementary — not from your PDF- Mixing up forward proxies (outbound, for users) and reverse proxies (inbound, for servers).
- Thinking transparent means 'no filtering'. It just means clients don't need configuring.
Practical skills
Supplementary — not from your PDF- Pick a forward or reverse proxy for a scenario.
What I should remember
Key Points PDF p.136-
Proxy Server Function
- Store-and-Forward: Deconstruct, analyze, rebuild packets.
- Rebuilding: Varies by proxy type.
-
Forward Proxy Servers
- Outbound Traffic: Protocol-specific (e.g., web proxy).
- Benefits: Traffic management, security, caching.
- Application Understanding: Parse and modify commands.
-
Types
- Non-Transparent: Client configuration required.
- Transparent: Intercepts traffic, no reconfiguration.
- Authentication: User authentication, SSO.
- Configuration: PAC script, WPAD protocol.
-
Reverse Proxy Servers
- Inbound Traffic: Protocol-specific.
- Deployment: Network edge.
- Filtering Rules: Applies and forwards accepted requests.