Reverse Proxy Admin Console

[jac2703]

Hi all,

I am trying to use an Apache reverse proxy server for the Admin Console. My config is below, using a deb 6 installation with Apache2 and mod_proxy, mod_html, mod_header.

My config:

<virtualhost *:443>
        SSLEngine On
        SSLCertificateFile    /etc/apache2/ssl-certs/certnew.cer
        SSLCertificateKeyFile /etc/apache2/ssl-certs/key_nopf.key
        SSLProxyEngine on
        ProxyPreserveHost On


        ProxyRequests off
        DocumentRoot /var/www


        ErrorLog ${APACHE_LOG_DIR}/error.log


        # Possible values include: debug, info, notice, warn, error, crit,alert, emerg.
        LogLevel warn
        CustomLog ${APACHE_LOG_DIR}/access.log combined


        ProxyHTMLStripComments on


#-- Proxmox
        ProxyPass /prox/ https://192.168.50.251:8006/
        ProxyHTMLURLMap https://192.168.50.251:8006 /prox
        <Location /prox>
                SetOutputFilter proxy-html
                RequestHeader    unset  Accept-Encoding
                ProxyPassReverse https://www.domain.com/prox
                ProxyPassReverse /
                ProxyHTMLURLMap /            /prox/


                Order allow,deny
                Allow from all


        </Location>

</VirtualHost>

The result is that the login dialogue box is presented but 'Realm' is not filled in nor does it have any values to select in the dd box.

When accessing the Admin site directly, all works fine.

Does anyone have any ideas?

Cheers,

James.

 

[jac2703]

It would seem that due to the Java code which is executed on the client side, that some of the paths are not translated via the proxy. This means that some files are not loaded by the browser as they are pointing to the wrong URL.

Can anyone confirm this, or have any idea of a work around? Has anyone successfully reverse proxy'd Proxmox?

Cheers,

James.

 

[escoreal]

Can anyone confirm this, or have any idea of a work around? Has anyone successfully reverse proxy'd Proxmox?

Hello,

you could try this configuration with Apache 2 on PVE 3.1. Modules: ssl, proxy, proxy_http.

<VirtualHost *:80>
          ServerName <hostname>
          RedirectMatch permanent ^/$ https://hostname
</VirtualHost>

<VirtualHost *:443>
        ServerName <hostname>
        SSLEngine On
        SSLCertificateFile /etc/apache2/ssl/<hostname>.pem
        SSLCertificateChainFile /etc/apache2/ssl/<issuer>_ca_bundle.pem
        SSLProxyEngine on
        SSLProxyVerify none

        ProxyPass / https://127.0.0.1:8006/ nocanon
        ProxyPassReverse / https://127.0.0.1:8006/ nocanon
        ProxyPreserveHost On

        ErrorLog /var/log/apache2/<hostname>/error.log
        CustomLog /var/log/apache2/<hostname>/access.log combined
</VirtualHost>

With the new signed applet no more warnings

esco

 

[felipe]

hi

i tried to set up an reverse proxy like escoreal described. it work i canlog in ssl is green. but i get an error (x sign) after loading the java applet.

thank you
philipp

 

[felipe]

the only difference is that the reverse proxy is not on the proxmox host

 

[escoreal]

the only difference is that the reverse proxy is not on the proxmox host

Hello,

could you post a screenshot?

esco

 

[felipe]

i think the port is not forwarded....

 

[felipe]

<VirtualHost *:443>
ServerName xxxx
SSLEngine On
SSLCertificateFile xxxx
SSLCertificateKeyFile xxxx
SSLCertificateChainFile xxx


SSLProxyEngine on
SSLProxyVerify none


ProxyPass / https://192.168.11.7:8006/ nocanon
ProxyPassReverse / https://192.168.11.7:8006/ nocanon
ProxyPreserveHost On


ErrorLog ${APACHE_LOG_DIR}/error.log
LogLevel warn
CustomLog ${APACHE_LOG_DIR}/access.log combined


</VirtualHost>


it is the same config the only difference is that this is another server with internal/external ip and not the proxmox host ...

 

[felipe]

I SOLVED IT! when i was passign teh config is check that i had ServerName <hostname> not replaced... all worked exept the java.... so i did not notice it before...
Now i still could not connect. so i just did a nat & masquerading from 5900 - 6000 and now it works