1

We have a web-service in our intranet that uses a lot of internal web-services itself. There is absolutely no access to the internal network from the internet, but there is a corporate proxy that allows access to the internet via HTTP from our intranet.

Are there solutions to make this intranet web-service available in the public internet?

I see it as some kind of pub-sub reverse proxy made from two components:

  1. Pub-sub queue, hosted in public Internet. It receives HTTP requests from any client in the Internet and stores them in its queue (not responding to the request just yet).
  2. Some kind of long-polling reverse proxy, installed on any server in our internal network. It subscribes to (1) through corporate proxy via HTTP, receives requests from its queue, executes them and sends back the responses.

It's those responses that (1) sends back as replies to the initial queries. So the client doesn't even 'know' that all of this machinery is taking place.

Is there something like this? Is it a bad idea?

1
  • You would want 1 to be the responder as a client generally doesn't like being send random data. If you only have a one way connection between 1 and 2 the correct way would be to talk to IT to get a two way connection.
    – Seth
    Dec 28, 2016 at 8:27

1 Answer 1

1

You can do this correctly through your IT department. Anything else is likely to get you into trouble, but I'll outline that as well.

It sounds like the people who have set up your IT have chosen to lock down the network very tightly. In order to [legitimately] allow this application to work, you would need to work with them to get round the block - and it is quite doable in principle. You would either port forward the port from the external IP on the router to the web server, or, for greater control and security , set up and route it through some kind of proxy [ The exact kind of proxy would depend on what / how you want to filter/limit it - Mod_Proxy + Mod_Security might do what you want, or Squid or privoxy or something else ]

If you can't work with your system administrator, then anything you do will be trying to defeat the network, and will probably land up with someone getting fired or in tears (most likely you unless its you + management against IT, in which case, cover your back). You could either get an alternative network connection for it or set up some kind of VPN [ where the VPN runs over port 80 or 443 so it looks like HTTP traffic ]. There are a lot of reasons this is a bad idea.

It is conceptually possible to write some kind of website - hosted on the wider Internet which can accept requests, then some kind of script for your webserver to pole this system and push the appropriate content statically which can then be fed - either in direct response - but with large delay - to the original request, or for accessing later. It would seem to me that these scenarios are a lot of work to implement, and even more work to secure, and give you very little that doing it properly wouldn't help with.

I note that if only authorised people need to access the webserver, as companies implementing this kind of filtering are typically fairly large, there is probably some kind of VPN allowing people to connect into the network - it may be that the IT department can allow people who need to access this server remotely to connect to it via VPN. This would be fairly common.

2
  • I think you're right, generally. To comment: Our security officials are in another country and they are VERY reluctant to change anything, but at the same time, they are ignore all of the security issues (like my idea). VPN is just not convenient
    – evilkos
    Dec 28, 2016 at 12:10
  • [continuation] ... for the end users. They need to access it like any other web-service (or website). My suggested solution is too much work to do from scratch, so I was interested if something like this already exists. Offtopic: I cannot edit comments for some reason...
    – evilkos
    Dec 28, 2016 at 12:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.