UPDATED:
Added Details and Links
For sometime I have struggled with how to allow public access to my home web servers and Esp8266 modules without opening up my network to abuse. In the past I have managed public access via my Router, by changing its configuration of Port Forwarding and NAT. This works, but it is a pain to manage and generally requiring a re-boot of the network for each change.
Recently, I have discovered (actually re-discovered) that an Apache2 Web Proxy Server is much easier to manage, but it has a bit of a steep learning curve, with a lot of manual pages to read. One key concept is that Apache2
ReWriteRules are a super-set of the functionality of
ProxyPass, each have their own documentation web pages.
After building the Required Config files
Now, on my Router I allow only Ports:
http 80,
8040,
8160, and a private
ssh port for access from the Internet. Ports
8040, and
8160 are still open for historical reasons, that is, they are used for my published Web Pages at:
http://www.WA0UWH.com:8040, and my Esp8266 Server Farm devices.
The Apache2 Web Server supports:
Virtual Host Names with
Proxy Redirects,
ReWriteRules, and
ProxPass. By setting up "
*.wa0uwh.com" as a CNAME (an aliases) to "
www.wa0uwh.com" at my DNS Provider, I can use any "device name" I would like in the config files to initiate a proxy process. For example: I can now use and publish "
http://node129.wa0uwh.com" for one of my
Esp8266 Web Server modules. The actual connection details and security are all hidden behind the proxy curtains.
The normal web page
port 80 is setup with a default virtual host page of; "
Error 404", only configured
virtual hosts and
named devices are let through the proxy.
Note: The service and/or host that is selected is a combination of both Port Number and Host Name (or alias). For an incoming connection, the file is scanned from top to bottom, only the first match is used to select the service.
The following are excerpts from my Apache2 Default Virtual Host configuration file.
ServerName default.wa0uwh.com
LogLevel alert rewrite:trace1
<VirtualHost *:80>
ServerAdmin webmaster@localhost
DocumentRoot /var/www/DEFAULT/Public
ErrorLog ${APACHE_LOG_DIR}/error.log
CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>
# End
The following are excerpts from my Apache2 Named Virtual Host configuration file.
## Main Web Pages
## Loft Raspberry PI
<VirtualHost *:8040 *:80 >
ServerName rp21.wa0uwh.com
RewriteEngine on
ServerSignature Off
RewriteRule /(.*)$ http://192.168.___.___/$1 [P,L]
</VirtualHost
## Loft Raspberry PI
<VirtualHost *:8040 *:80 >
ServerName rp22.wa0uwh.com
RewriteEngine on
ServerSignature Off
RewriteRule /(.*)$ http://192.168.___.___/$1 [P,L]
</VirtualHost>
# Esp8266 Node on Published Port 8160
<VirtualHost *:8160 >
ServerName node.wa0uwh.com
ServerAlias node*.wa0uwh.*
ServerAlias localhost
RewriteEngine on
RewriteRule /(.*)$ http://192.168.___.___/$1 [P,L]
</VirtualHost>
## Loft Esp8266 Nodes
<VirtualHost *:8040 *:80 >
ServerName node.wa0uwh.com
ServerAlias node*.wa0uwh.com
RewriteEngine on
ServerSignature Off
RewriteCond %{HTTP_HOST} ^node(129|162|164|168|169|170|172)\.wa0uwh\.com [NC]
RewriteRule /(.*)$ http://192.168.___.%1/$1 [P,L]
RewriteRule /(.*)$ - [R=404,L]
</VirtualHost>
## Loft WA0UWH Web Server
<VirtualHost *:8040 *:80>
ServerName www.wa0uwh.com
ServerAlias *.wa0uwh.com
ServerAlias localhost 192.168.__.__
DocumentRoot /var/www/WA0UWH/Public
Alias /gallery /var/www/WA0UWH/Public/Gallery
</VirtualHost>
# End
Note, the above is just an excerpt from my Apache2 Virtual Host config file. For security reasons, the details; actual IPA's (___), BlackListing, Hacker Traps, Web Abuse Traps, and HoneyPots, are NOT included . Google is your friend for suggested configurations.
Now, with simple edits of the Apache2 Virtual Host config file, I can turn
ON or
OFF, devices and/or services as desired, while leaving only the
http and
ssh ports open for public access at the router.
Also note: each of my Raspberry PI Web Servers also have similar Apache2 Virtual Host config files, that is: Proxies are serving Proxies, and most often the actual destination is at different physical locations, and on different Networks! All unseen for my Internet users.
-- Home Page:
https://WA0UWH.blogspot.com
