Virtual Host

The ADC Virtual Host page includes the following sections. Click on the link to go to the corresponding section to learn more:

• Virtual Host
• Deployment
• Reverse proxy
• Routing proxy
• Virtual web server
• SSL certificate
• Exporting certificate from web server
• Importing the SSL certificate
• SSL settings
• Virtual host aliases
• Wildcards
• Default proxy
• Timeouts
• HTTP request and connection throttling
•  HTTP request throttling
• HTTP connection throttling
• Client source IP
• Transparent proxy
• Proxy protocol
• Trusted proxy
• Redirects
• Match types
• Prefix match
• Regex match
• Vhost regex match
• Examples summary
• Options
• Traffic statistics
• Lower button bar

To go to the documentation for the previous section of the manual, see Deny and Error Handling . To go to the documentation for next subsection in the ADC section, see Load Balancing .

To access the Virtual Host page in the WAF management interface:

1. On the left panel, under Services, click Websites.
2. On the Websites page, click the website you want to manage.
3. Under ADC, click Virtual Host.

To save configuration changes or edits you make to any features and options, you must click Save on the lower-right of the section or page where you are making changes. Click apply changes on the upper-left corner of the page, and then click OK. Your changes will not be stored if you do not properly save your changes.

The virtual host is the website proxy that is accepts requests for the web servers serving the website for which the ADC is proxying requests.

Routing proxy

Routing proxy deployment has all the advantages of reverse proxy both in terms of protection, acceleration, caching and compression. All features available for reverse proxy are also available in routing proxy deployment.

The major difference is that routing proxy deployment does not require more than one IP address for each of the WAF appliances network interfaces and the only change necessary on the network firewall (or router) is to configure it to route traffic to the protected web servers through WAF. Web traffic to the protected servers are picked up and validated while traffic to other protocols like SSH, SMTP and FTP are routed through to the backend web servers.

The ability to route traffic to other services also means that only the HTTP services on the backend web servers are protected by the appliance. Sine the IP addresses and network firewall policy rules leave a small footprint, this deployment option is the best one for complex data centers.

Virtual web server

SSL certificate

In the SSL certificate section, the current SSL certificate in use is displayed. To upload a new certificate, click the Manage certificates.

When you create an SSL website, WAF gives this website a temporary SSL certificate. You are able to substitute the temporary certificate with a signed certificate. These actions are only intended for SSL enabled website proxies, and the SSL section is only shown for SSL enabled website proxies.

Exporting certificate from web server

When you create a website proxy for an existing HTTPS web server, you need to export the SSL certificate from the web server, and import the certificate toWAF. WAF supports the imports of the following formats:

• PKCS12 (or PFX): The standard format that Microsoft IIS servers use. It stores public key, private key, and the key chain in one single encrypted file.
• PEM: Commonly used in *nix based web servers like Apache and Nginx. When ordering certificates, this format is often referred to as “Apache format.”
• Intermediate: A subordinate certificate where the chain begins at the trusted root, through the intermediate and ending with the SSL certificate issued to you.

The following options show you how to export an SSL certificate from the most common servers. To export a certificate from the web server, refer to the vendors guidelines.

Export an SSL certificate from a Microsoft IIS server

When you export an SSL certificate from a Microsoft IIS server, the certificate is usually obtained in PKCS12 (.pfx) format. The instructions for exporting from IIS 7 below includes the SSL certificate chain.

Microsoft guidelines can be found on the links below:

Add the certificate

To add a certificate:

1. Open the Windows Start menu.
2. In the Search box, type MMC and then click OK.
3. Click the File tab, and then select Add/Remove Snap-in.
4. Click on Certificates, and then click Add.
5. Select Computer Account, and then click Next.
6. Select Local Computer, and click Finish.
7. Click OK to close the Add/Remove snap-in window.
8. In the center pane, double-click Certificates (Local Computer) in the center window.

Export the certificate

To export the certificate:

1. Double-click on the Personal folder, and then click Certificates.
2. Right-click the certificate you want would like to backup, and then select ALL TASKS and then Export.
3. Follow the Certificate Export Wizard to backup your certificate to a .pfx file.
4. Select Yes, export the private key.
5. Select Include all certificates in certificate path if possible.

   Do not select the delete Private Key option.

6. Type a password you can remember, and then save the file.
7. Click Finish. You see the following message, "The export was successful."
8. Click OK.

Export an SSL certificate from an Apache server

For apache-based web and application servers with default PEM encoding, the SSL certificate can be copied directly from the file system and imported as is when the default PEM encoding is used.

Obtain the SSL-certificate file from the web servers file system. By default, the file is PEM-encoded.

Keep the contents of the files open. You will need it for the PEM (Apache) certificate upload section.

When you create an SSL website, WAF assigns the website a temporary SSL certificate. You are able to substitute the temporary certificate with a signed certificate.

Depending on the format of the certificate, select the appropriate action in the bullet list.

Importing the PKCS12 format

To import a certificate in PKCS12 format:

1. Select Import SSL certificate (PKCS12 format).
2. Click Choose File to browse your system for the file location.
3. In Passphrase input, type the passphrase.
4. Leave Validate certificate chain selected.
When selected, WAF validates that the certificate chain is complete and ordered correctly. Do not clear this option unless the certificate import generates certificate chain errors that you must adjust manually after import.
5. Click Save settings in the lower right corner of the page.
6. Click apply settings at the top of the page to apply the certificate to the run-time configuration.

Importing the PEM format

To import a certificate in PEM format:

1. Select Import SSL certificate (PEM format).
2. Open the .PEM file(s) in a text-editor. When obtained from the web server, the following extension convention is usually used:

   *.crt – public keys, both server and CA chain

   *.key – the private key

3. Copy the public certificate section of the certificate into the SSL public key/certificate field.

   The public certificate is the section of the certificate file between (and including) the certificate start and end tags.

   -----BEGIN CERTIFICATE-----

   Certificate characters

   -----END CERTIFICATE--

4. Copy the (SSL) private key section of the certificate into the SSL private key field.

   The (SSL) private key is the section of the certificate file between (and including) the private key start and end tags.

   -----BEGIN RSA PRIVATE KEY-----

   Private key characters

   -----END RSA PRIVATE KEY-----

5. In the Passphrase, field type the passphrase for the private key (if the original private key was encrypted).
6. Leave Validate certificate chain selected.
   When selected, WAF validates that the certificate chain is complete and ordered correctly. Do not clear this option unless the certificate import is generates certificate chain errors that you must adjust manually after import.
7. Click Save Settings in the lower right corner of the page.
8. Click Apply Settings at the top of the page to apply the certificate to the run-time configuration.
9. (Optional) In SSL authority certificate(s) chain, if a certificate authority chain is provided with your certificate, enter the entire list of certificates (more than one certificate may be provided).
10. Click Save settings. The imported certificate is displayed in the certificate table along with the certificate chain (if any). Verify that the certificate is imported correctly.
11. Click the Apply settings.

 Importing the intermediate certificate

To import an intermediate certificate:

1. Select Edit Certificate Chain.
2. Open the intermediate certificate in a text-editor. When obtained from the web server, the following extension convention is usually used:

   The public key/certificate is the section of the certificate file between (and including) the certificate start and end tags.

   <-----BEGIN CERTIFICATE--->

   Certificate characters

   <-----END CERTIFICATE--->

3. Click Save settings in the lower right corner of the page.
4. Click apply settings at the top of the page to apply the certificate to the run-time configuration.

SSL settings

Minimum SSL protocol version.

To configure WAF to handle requests for host aliases to the main configured domain name (e.g. www.mydomain.com), add a list of aliases in this section.

When WAF is deployed as a proxy, requests for virtual host aliases are filtered and forwarded without modification to the host header.

Wildcards

You can use the wildcard character * to match the server name part of the domain name (e.g. www). If for instance, the domain names www. domain.net, www2.domain.net, www3.domain.net and webserver.domain.net all point to the same server the wildcard expression *.domain.net is used to match all HTTP requests pointing to domain.net. This is provided that the DNS records of the respective hosts all point to WAF.

Default proxy

When enabled, the proxy is used as the default host for requests of the IP address to which the proxy is configured to listen. The default proxy responds to all requests for virtual hosts that are not configured as primary host name, or as a virtual host for other proxies listening to the same IP address. This allows you to configure a single proxy that serves requests for several host names that the same backend web server serves without adding all the virtual host names in WAF.

HTTP request and connection throttling

 HTTP request throttling

HTTP connection throttling

HTTP requests often pass through one or more proxy servers before reaching the endpoint web server. Examples include web gateways in the client network, content delivery networks (CDN), caching servers, SSL accelerators, layer 7 load balancers and web application firewalls. Each time the request passes through a proxy server, the source IP of the request changes to the IP address of the proxy server. This meanst he source IP from the network connection (socket) cannot be the IP address of the original request. To account for this, the standard is that proxy servers insert the client source IP in a request header named X-Forwarded-For. This is the default behavior of Alert Logic Managed Web Application Firewall (WAF).

Another option is to configure WAF as a Transparent Proxy, which reinserts the client source IP before it forwards the request to the backend web environment.

Play tricks at the network level to inject the client IP as the source of the request to the backend server. This requires modification of default gateway at the backend server to make the response go back through WAF.

Transparent Proxy

WAF inserts the client source IP as the source IP of the request it forwards to the backend web server. Backend web servers must be configured to use WAF as the default gateway to ensure inspection of return web traffic and a response to the client request. IP-Forwarding (routing) must be enabled in WAF. Performance drawbacks because connections from WAF to backend web servers cannot be kept alive and because all traffic, including non-HTTP, from web servers have to pass through WAF. Because WAF must be the default gateway, transparent proxy is only recommended for smaller deployments where WAF is not deployed in combination with a load balancer. You must enable and configure transparent proxy.

You can apply transparent proxy configuration to both routing proxy and reverse proxy deployment modes. When enabled, WAF inserts the client source IP in the request to the backend web server to preserve it. In practice, the transparent proxy spoofs the client source IP which is why this feature is sometimes also called client impersonation.

While transparent proxy preserves the client source IP in the HTTP requests the backend web server receives, it has a few drawbacks of performance and availability risk. Because the original client IP is inserted as the source IP of the connection that is made to the backend, every request to not reuse connections from other client IPs requires a new connection. This negatively impacts the performance. WAF deployed as either reverse or routing is easy to bypass if both nodes in a cluster fails, because only a change a NAT rule or a static route is required. This is further complicated when it is proxying transparently because the backend web servers are configured to use the WAF cluster as a gateway. This means that each backend web server must be reconfigured to restore availability in the unlikely event that both WAF nodes in a cluster fails.

To minimize the availability impact on the web properties the configuration of transparent proxy must performed in the following order:

1. If WAF is deployed as a cluster, create a cluster interface with an VIP that the backend web servers can reach in System> Clustering.
2. Enable IP Forwarding in Services > Network > Network routing.
3. Edit the segmentation table to make sure that routing does not violate network segmentation settings in Services > Network > Network routing. By default, routing cannot traverse network interfaces.
4. Configure backend web servers to use WAF as default gateway.

Since the X-headers are part of the client request WAF receives, and the client can manipulate it, they cannot be trusted. The information that the proxy insert can only be trusted if the client does not control that information. This is if the proxy that receives the request from the client, for instance a load balancer in front of WAF, follows the standard of appending the source IP it receives the request from to the X-Forwarded-For header. In addition, it must overwrite values in X-Forwarded-Proto and X-Forwarded-Port headers with protocol and port information to be trusted. Such a proxies, defined by one or more IPs, are referred to as Trusted Proxies.

The standard for forwarding client source IP from layer 7 proxies. Header is always inserted.

The X-Forwarded-For (XFF) HTTP header field is a standard to identify the originating IP address of a client connecting to a web server through an HTTP proxy or load balancer. This is an HTTP request header the developers of Squid caching proxy server introduced. An effort has been started at IETF for standardizing the Forwarded HTTP header.

When the request passes through multiple proxy servers, each server adds the respective source IP to the X-Forwarded-For header. The X-Forwarded-For header then contains a list of IP addresses the request has passed through. The leftmost IP address is the original client IP. The rightmost IP address is the last proxy in the chain, and the source IP of the request is the address of the last proxy.

This allows the endpoint web server to extract and log the original client IP address from the XFF header for applications that need this data. The endpoint web server no longer needs to extract data for the IP address of the last proxy in the chain from which the request received.

WAF is a proxy-based device that terminates requests from clients and makes requests to the backend web server on behalf of the client. To make the original source IP available to the backend web application, WAF forwards the source IP address to the backend server in the X- Forwarded-For header.

Redirects

Redirects tells the client to get the requested resource elsewhere. The Redirect feature instructs clients to make a new request with a different URL. It often redirects HTTP requests for resources requiring encryption to corresponding pages on an SSL encrypted connection - HTTPS.

When redirecting, WAF sends an HTTP 301 - Permanently Moved response code.