You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by David Gianndrea <dg...@comsquared.com> on 2006/06/30 15:32:56 UTC

[users@httpd] Mod_proxy, and ProxyPass not binding to the virtual host ip address

In using this SSL VirtualHost config with the ProxyPass option
we are seeing that the source IP address of the proxy request
does not come from the VirtualHost 10.82.40.101, but from the
main http server IP 10.82.40.100. Does anyone know why this would
be or how to correct it?





<VirtualHost 10.82.40.101:443>
         ServerName webmail.somedomain.com
         DocumentRoot /usr/local/websites/webmail.somedomain.com/htdocs
         ServerAdmin webmaster@somedomain.com
         DirectoryIndex index.html index.htm


         SSLEngine on
         SSLCipherSuite 
ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:!LOW:!SSLv2:!EXP:!eNULL
         SSLProtocol all -SSLv2
         RequestHeader set Front-End-Https "On"
         Header set Cache-Control "no-cache"
         Header set Cache-Control "no-store"
         Header set Cache-Control "private"
         Header set Pragma "no-cache"
#        SSLProxyEngine on
         SSLVerifyClient none
         SSLCertificateFile 
/usr/local/apache2/conf/ssl.crt/webmail.somedomain.com.crt
         SSLCertificateKeyFile 
/usr/local/apache2/conf/ssl.key/webmail.somedomain.com.key
         SSLCertificateChainFile /usr/local/apache2/conf/ssl.crt/mdpca.crt



         <Directory "/usr/local/websites/webmail.somedomain.com/htdocs">

                 Options FollowSymLinks
                 AllowOverride None
                 Order allow,deny
                 Allow from all

         </Directory>




         <Proxy * >
                 Order deny,allow
                 Allow from all
         </Proxy>


         ProxyPreserveHost On
         ProxyRequests Off

         #fts-search
         ProxyPass /fts-search 
http://webmail.subd.somedomain.com:8080/fts-search
         ProxyPassReverse /fts-search 
http://webmail.subd.somedomain.com:8080/fts-search



         DumpIOInput Off
         DumpIOOutput Off
         Loglevel Warn
         ErrorLog /usr/local/websites/webmail.somedomain.com/logs/error_log
         CustomLog 
/usr/local/websites/webmail.somedomain.com/logs/access_log combined
         CustomLog 
/usr/local/websites/webmail.somedomain.com/logs/ssl_access_log "%t %h 
%{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"


</VirtualHost>



---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: [users@httpd] Mod_proxy, and ProxyPass not binding to the virtual host ip address

Posted by Joshua Slive <jo...@slive.ca>.
On 7/1/06, David Gianndrea <dg...@comsquared.com> wrote:
> No it is not an issue for us due to auth, but rather firewall
> rules. I wonder if an enhancement request would possible for
> the next release. Do you know the best way to submit such a
> request?

The bug database / issue tracker:
http://httpd.apache.org/bug_report.html

Requests like this are much more likely to be fulfilled when they come
with patch suggestions.

Joshua.

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: [users@httpd] Mod_proxy, and ProxyPass not binding to the virtual host ip address

Posted by David Gianndrea <dg...@comsquared.com>.
No it is not an issue for us due to auth, but rather firewall
rules. I wonder if an enhancement request would possible for
the next release. Do you know the best way to submit such a
request?

Thanks for the quick response!


Joshua Slive wrote:
> On 6/30/06, David Gianndrea <dg...@comsquared.com> wrote:
>> In using this SSL VirtualHost config with the ProxyPass option
>> we are seeing that the source IP address of the proxy request
>> does not come from the VirtualHost 10.82.40.101, but from the
>> main http server IP 10.82.40.100. Does anyone know why this would
>> be or how to correct it?
> 
> I don't believe there is any way to configure apache to use a specific
> IP address on outgoing requests.  It will simply use whatever the OS
> gives it.
> 
> If you are using this info for authenticating the request, you should
> get the vhost to add something to the request headers to confirm which
> vhost it came from.
> 
> Joshua.
> 
> ---------------------------------------------------------------------
> The official User-To-User support forum of the Apache HTTP Server Project.
> See <URL:http://httpd.apache.org/userslist.html> for more info.
> To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
>   "   from the digest: users-digest-unsubscribe@httpd.apache.org
> For additional commands, e-mail: users-help@httpd.apache.org
> 

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: [users@httpd] Mod_proxy, and ProxyPass not binding to the virtual host ip address

Posted by Joshua Slive <jo...@slive.ca>.
On 6/30/06, David Gianndrea <dg...@comsquared.com> wrote:
> In using this SSL VirtualHost config with the ProxyPass option
> we are seeing that the source IP address of the proxy request
> does not come from the VirtualHost 10.82.40.101, but from the
> main http server IP 10.82.40.100. Does anyone know why this would
> be or how to correct it?

I don't believe there is any way to configure apache to use a specific
IP address on outgoing requests.  It will simply use whatever the OS
gives it.

If you are using this info for authenticating the request, you should
get the vhost to add something to the request headers to confirm which
vhost it came from.

Joshua.

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org