How to Use Apache HTTP Server as Reverse Proxy Using mod_proxy

The mod_proxy module of Apache HTTP server equips your web server with the formidable ability to act as a reverse proxy, enabling the efficient distribution of traffic across multiple backend Servers. This is vital for enhancing the scalability of web applications, optimising performance, and ensuring high availability in live environments. This detailed guide will show you how to set up Apache as a reverse proxy, delve into various practical scenarios, and hone the troubleshooting skills necessary to keep your proxy setup operational.

The Functionality of Apache mod_proxy

A reverse proxy operates as an intermediary between clients and backend Servers, routing client requests to the relevant backend services and sending responses back to clients. Unlike a forward proxy, which acts on behalf of the clients, a reverse proxy serves as the server side of the connection.

Apache’s mod_proxy module offers this capability through a suite of sub-modules:

• mod_proxy_http – Manages HTTP and HTTPS protocols
• mod_proxy_balancer – Facilitates load balancing
• mod_proxy_ajp – Supports Apache JServ Protocol for Java-based applications
• mod_proxy_connect – Allows for CONNECT method support
• mod_proxy_wstunnel – Manages WebSocket connections

Upon receiving a client request, mod_proxy checks the ProxyPass directives, forwards the request to the chosen backend server, obtains the response, and relays it to the original client. This entire process occurs seamlessly for end users, who only notice the address of your Apache server.

A Comprehensive Setup Guide

Establishing Apache as a reverse proxy involves activating the essential modules and configuring the relevant directives. Here’s a straightforward way to proceed:

Activating Essential Modules

To start, activate the proxy modules on your Apache server:

sudo a2enmod proxy
sudo a2enmod proxy_http
sudo a2enmod proxy_balancer
sudo a2enmod lbmethod_byrequests
sudo systemctl restart apache2

For CentOS/RHEL systems, include the following lines in your httpd.conf:

LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_proxy_http.so
LoadModule proxy_balancer_module modules/mod_proxy_balancer.so

Basic Configuration for Reverse Proxy

Set up a fundamental reverse proxy configuration directing all requests to a specified backend server:

    ServerName example.com
    
    ProxyPreserveHost On
    ProxyPass / http://192.168.1.100:8080/
    ProxyPassReverse / http://192.168.1.100:8080/
    
    ProxyPassReverse / http://example.com/

Here’s a breakdown of the critical directives:

• ProxyPreserveHost On – Forwards the original Host header to the backend Servers
• ProxyPass – Associates incoming requests with backend server URLs
• ProxyPassReverse – Adjusts response headers from backend Servers accordingly

Advanced Load Balancing Configuration

In a production context, implement load balancing across several backend Servers:

    ServerName myapp.com
    
    ProxyPreserveHost On
    
    
        BalancerMember http://192.168.1.100:8080
        BalancerMember http://192.168.1.101:8080
        BalancerMember http://192.168.1.102:8080 status=+H
        ProxySet lbmethod=byrequests
    
    
    ProxyPass /balancer-manager !
    ProxyPass / balancer://mycluster/
    ProxyPassReverse / balancer://mycluster/
    
    
        SetHandler balancer-manager
        Require local
    

This setup creates a load balancer using three backend Servers, where the third server is on standby (status=+H). The balancer-manager offers a web interface to oversee and manage the backend Servers.

Practical Examples and Applications

Microservices Deployment

Channel different application paths to designated microservices:

    ServerName api.company.com
    
    # User service
    ProxyPass /api/users/ http://user-service:3000/
    ProxyPassReverse /api/users/ http://user-service:3000/
    
    # Payment service
    ProxyPass /api/payments/ http://payment-service:4000/
    ProxyPassReverse /api/payments/ http://payment-service:4000/
    
    # Default to main application
    ProxyPass / http://main-app:8080/
    ProxyPassReverse / http://main-app:8080/

SSL Handling at the Proxy Level

Manage SSL encryption at the proxy while interacting with backend Servers via HTTP:

    ServerName secure.example.com
    
    SSLEngine on
    SSLCertificateFile /path/to/certificate.crt
    SSLCertificateKeyFile /path/to/private.key
    
    ProxyPreserveHost On
    ProxyPass / http://internal-server:8080/
    ProxyPassReverse / http://internal-server:8080/
    
    # Transmit SSL information to backend
    ProxyPassReverse / https://secure.example.com/
    
    RequestHeader set X-Forwarded-Proto "https"
    RequestHeader set X-Forwarded-Port "443"

WebSocket Support for Real-Time Applications

Enable WebSocket connections for applications requiring real-time communication:

LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so


    ServerName websocket.example.com
    
    # WebSocket connections
    ProxyPass /ws/ ws://backend-server:8080/ws/
    ProxyPassReverse /ws/ ws://backend-server:8080/ws/
    
    # Standard HTTP traffic
    ProxyPass / http://backend-server:8080/
    ProxyPassReverse / http://backend-server:8080/

Contrasting with Alternative Solutions

Apache mod_proxy is particularly advantageous in setups where Apache is already in use for web serving and integrated reverse proxy functions are needed. Although it may not achieve the performance levels of dedicated solutions like Nginx or HAProxy, its compatibility and extensive features make it a solid choice.

Essential Best Practices and Common Mistakes

Security Measures

Adopt these security protocols to safeguard your proxy setup:

# Prevent proxy misuse
ProxyRequests Off
ProxyVia Off

# Limit proxy access

    Order deny,allow
    Deny from all
    Allow from 192.168.1.0/24


# Conceal server information
ServerTokens Prod
ServerSignature Off

# Establish security headers
Header always set X-Frame-Options DENY
Header always set X-Content-Type-Options nosniff

Enhancing Performance

Set up connection pooling and timeouts for optimal efficiency:

# Connection pooling
ProxyPass / http://backend/ connectiontimeout=5 ttl=60

# Configuration settings for timeouts
ProxyTimeout 30
ProxyPassReverse / http://backend/

# Activate compression
LoadModule deflate_module modules/mod_deflate.so

    SetOutputFilter DEFLATE

Frequently Encountered Issues and Resolutions

Issue 1: Unreachable Backend server

Resolution: Set up health checks and failover procedures:

    BalancerMember http://server1:8080 status=+H
    BalancerMember http://server2:8080
    # Health check every 30 seconds
    ProxySet hcmethod=GET
    ProxySet hcuri=/health

Issue 2: Problems with Session Persistence

Resolution: Implement sticky sessions or utilise external session storage:

Header add Set-Cookie "ROUTEID=.%{BALANCER_WORKER_ROUTE}e; path=/"

    BalancerMember http://server1:8080 route=1
    BalancerMember http://server2:8080 route=2
    ProxySet stickysession=ROUTEID

Issue 3: Sluggish Response Times

Resolution: Monitor and fine-tune backend connections:

# Increase worker limits
ServerLimit 16
MaxRequestWorkers 400
ThreadsPerChild 25

# Employ connection reuse
ProxyPass / http://backend/ keepalive=On
ProxyPassReverse / http://backend/

Monitoring and Troubleshooting

Ensure detailed logging is in place for effective troubleshooting:

LogLevel proxy:trace2
CustomLog logs/proxy_access.log "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\" %D"

# Log replies from backend Servers
LogFormat "%h %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\" backend:%{BALANCER_WORKER_NAME}e time:%D" proxy

Utilise Apache’s server-status module for performance monitoring:

    SetHandler server-status
    Require local



    SetHandler server-info
    Require local

For thorough monitoring, consider integrating tools like Prometheus using mod_prometheus or custom log parsing solutions.

Bear in mind that the successful setup of a reverse proxy necessitates continuous monitoring, routine security updates, and performance enhancements tailored to your traffic patterns and application demands. Rigorously test your configuration in a staging setting before moving to production, and always keep current backups of your configuration files.

For further insights, consult the official documentation for Apache mod_proxy and the Apache Reverse Proxy Guide.

This article draws on information and materials from diverse online sources. We acknowledge and appreciate the contributions of all original authors, publishers, and websites. While we have strived to properly credit the source materials, any unintentional oversight or omission does not constitute copyright infringement. All trademarks, logos, and images mentioned are the properties of their respective owners. Should you believe that any content used in this article infringes upon your copyright, kindly notify us immediately for review and swift action.

This article is designed for informational and educational purposes only, and does not infringe on the rights of copyright holders. If any copyrighted material has been used without appropriate acknowledgment or in violation of copyright laws, this was incidental, and we will correct it promptly upon notification. Please note that reproduction, redistribution, or republishing of part or all of the content in any form is forbidden without express written consent from the author and website owner. For permission or further inquiries, please reach out to us.