Home / server / Questions / 209329
In Process
jrnk
Asked: 2010-12-06 07:39:27 +0800 CST

Proxy-ing a SOAP server

  • 772

I need to communicate with a httpS SOAP server on a different port than the standard 443. The client app doesn't work (because of restrictions) with different ports than the standard ones for HTTP and HTTPS

How can I setup my linux server running Apache to tunnel all these requests coming in at soap.domain.com to https://soapserver.otherdomain.com:1234/Service.asmx ?

proxy port-forwarding soap

3 Answers

  1. A reverse proxy will help you.

    You can use apache mod_proxy to help you. By using mod_proxy apache will receive the request on the standard HTTP/HTTPS ports and then internally redirect it to the SOAP server.

    http://httpd.apache.org/docs/2.0/mod/mod_proxy.html

    Read up on reverse proxy. It will help you understand better.

    • 1

  2. I'd use a reverse proxy such as haproxy or nginx with proxy_pass option.

    Both will allow you to proxy requests to upstream servers and both will allow HTTPS to soap.domain.com and allow proxying to an encrypted HTTPS upstream server in your case: https://soapserver.otherdomain.com:1234/Service.asmx

    In my experience nginx is the somewhat easier to setup and configure.

    An appropriate nginx configuration may resemble the following:

    listen       443 ssl;
server_name  soap.domain.com;
ssl_certificate     soap.domain.com.crt;
ssl_certificate_key soap.domain.com.key;
ssl_protocols       TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers         HIGH:!aNULL:!MD5;

location / {
    proxy_pass https://soapserver.otherdomain.com:1234;                     
}

    And yes, you can use a self signed certificate

    • 1

  3. I'm not clear where you need to do this - on the SOAP client? On the SOAP server? somewhere in between? The approach is the same regardless - there are multiple ways of doing this.

    • You could use iptables to rewrite the packet addresses.
    • Run a packet proxy daemon (e.g. netcat) to listen on port 443 and connect to port XXX
    • Configure [x]inetd to listen on port 443 and run a generic socket client (e.g. netcat again) connecting to port XXX

    The first method would allow you to preserve the client address seen by the server.

    • 0