We have a forward-facing linux box running Apache HTTP server that is acting as a reverse proxy for several back-end servers.
The servers are accessed through specific domain names and ports and are set up as virtual hosts within Apache as such:
Listen 8001
Listen 8002
<Virtualhost *:8001>
ServerName service.one.mycompany.com
ProxyPass / http://internal.one.mycompany.com:8001/
ProxyPassReverse / http://internal.one.mycompany.com:8001/
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F]
</Virtualhost>
<Virtualhost *:8002>
ServerName service.two.mycompany.com
ProxyPass / http://internal.two.mycompany.com:8002/
ProxyPassReverse / http://internal.two.mycompany.com:8002/
RewriteEngine On
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK)
RewriteRule .* - [F]
</Virtualhost>
The proxy server has only one IP address, and both domains are pointing to it. Accessing internal.one via service.one works fine, as does accessing internal.two via service.two.
Now
the problem is that Apache does not take
the requesting domain into account when accessing
the virtual hosts. What I mean is that both domains work for both ports: requests for service.one:8002 proxies to internal.two:8002, and requests for service.two:8001 proxies to internal.one:8001, where ideally both these requests should be denied.
I can get around this by creating more virtual hosts that explicitly deny these requests:
NameVirtualHost *:8001
NameVirtualHost *:8002
<Virtualhost *:8001>
ServerName service.two.mycompany.com
Redirect permanent / http://errorpage.mycompany.com/
</Virtualhost>
<Virtualhost *:8002>
ServerName service.one.mycompany.com
Redirect permanent / http://errorpage.mycompany.com/
</Virtualhost>
But this is not an ideal solution, since we plan to add more services to
the proxy, and each new port would need to be explicitly denied on all
the other domains, and each new domain would need to be explicitly denied on all ports it is not utilizing. As we add more services,
the number of virtual hosts can get out of hand quickly.
My question, then, is whether there is a better way? Can we explicitly tie specific ports to specific domains in a virtual host so that only that domain-port combination is processed, and all other combinations are not?
Things I’ve tried:
Adding NameVirtualHost *:8001, etc. without
the additional virtual hosts.
Setting ProxyRequests On and
Off, as well as ProxyPreserveHost On and
Off
Adding
the server name or IP address to
the virtual host header,
e.g. <VirtualHost service.one.mycompany.com:8001>
Using
the <proxy>
directive inside
the virtual host directive.
Lots and lots of googling.
The proxy server is running CentOS 6.2 64-bit, Apache HTTPD server 2.2.15. As mentioned,
the proxy server has only one IP address, and all
the domains we are using are pointing to it.
