Core: Reverse proxy feature

[datenimperator]

OPNsense could have a reverse proxy feature in addition to NAT port forwarding. This would

• work on a given port and interface
• use a http/https URL as a target
• offer SSL encryption by use of a certificate from OPNsense's list
• use any configurable hostname
• add proper headers so the internal server can figure out the hostname for redirects etc

This would allow us to have a http service inside the network, proxied to the outer world, with an SSL certificate and hostname defined on the firewall but not on the inside network.

[AdSchellevis]

@datenimperator @fraenki is working on a haproxy package implementation, some more information about his progress can be found in his initial pull request https://github.com/opnsense/plugins/pull/10
I'm not sure this covers all your needs, but it might be interesting to look at.

[fichtner]

@fraenki assigned just for feedback tracking purposes :)

[enoch85]

Would it be possible to add Nginx to the system? I use it today on a separate VM and it does reverse proxying very nice!

[AdSchellevis]

@enoch85 I think we can add the port, but its highly unlikely that there will be gui any time soon. just let us know if the port is enough for you.

[fraenki]

@enoch85 If you want to configure the reverse proxy with the OPNsense GUI, I'd recommend to install the HAProxy plugin in OPNsense.

[enoch85]

@AdSchellevis Sorry, what do you mean by port? Could I install Nginx in FreeBSD and configure it from there and then set a seperate interface or something? It would be great to be able to run Nginx directly from OPNsense on bare metal.

[AdSchellevis]

@enoch85 ports is the system we use to build packages from, so if the port is available and we build a package for it, you can install it on the console with something like:

pkg install nginx 

but from there, you have to configure the rest manually, if that works for you, just let me know.

[enoch85]

@AdSchellevis Sure, that would be great! Something to start with anyway, and later on you could implement a GUI ;)

[AdSchellevis]

@enoch85 I've added it to the build list (https://github.com/opnsense/tools/commit/42cca748f6a09dc717b75d6f70411d3704634354) it should be available in the next release.

[fichtner]

@datenimperator Hey Christian, did HAProxy plugin solve your question or are there open points?

Cheers,
Franco

[rduffner]

How do I install that haproxy plugin?
Does it do transparent proxying?
I've downloaded 16.7 and there is no mentioning of plugins anywhere in the GUI...

[fichtner]

@rduffner under System: Firmware: Updates there is a Plugins tab. It may require checking for updates in order for "os-haproxy" to show up

[rduffner]

Ah, there it is - thanks.
The search function in the top right seems to only work for stuff that is already installed...

[datenimperator]

After installing 16.7 I've had a first look at HAproxy. The amount settings necessary to establish a simple web proxy seems overwhelming. I'll give it a try once I have some time to play with it, but this isn't something I'd recommend to anybody without a decent knowledge on network infrastructure.

Maybe there will some some easier solution?

[fichtner]

nothing to do here from core perspective