Configuring the reverse proxy

Why use the reverse proxy server in Kerio Control

With the reverse proxy, you can provision more than one web server placed behind Kerio Control. A single public IP addressAn identifier assigned to devices connected to a TCP/IP network. is used on a default port (80 for HTTPHypertext Transfer Protocol - protocol for exchange of hypertext documents in HTML. and 443 for HTTPSHypertext Transfer Protocol - version of HTTP secured by SSL.).

Kerio Control forwards traffic to different servers based on the hostname. Kerio Control does not support directories.

Configuring the reverse proxy

To configure the reverse proxy, enable it in Kerio Control and add rules for particular web servers:

1. In the administration interface, go to Proxy Server > Reverse Proxy.
2. Select Enable Reverse Proxy.

3. Click Add and create new rules for your servers, as described below.
4. Arrange your rules using the arrows on the right side of the main window. Kerio Control examines rules from the top down. The last asterisk rule directs other traffic to the 4081 port (Kerio Control Web Administration).
5. In Settings, select a valid SSL certificateSSL certificates are used to authenticate an identity on a server.. You need the certificate for proper authentication of Kerio Control when using HTTPS protocol in rules. To avoid problems with browsers, use one SSL certificate with alternative DNS names as a default certificate, as described below.

Adding new rules

Each rule represents one web server behind Kerio Control.

1. In the administration interface, go to Proxy Server > Reverse Proxy.
2. Click Add.
3. In the Reverse Proxy Rule dialog box, type the DNS name of the web server in the Host field.

4. Select the protocol of the server. You can select HTTP, HTTPS, or both. If you are using the HTTPS protocol, select a valid SSL certificate. You need the certificate for proper authentication of Kerio Control when using HTTPS protocol.

5. In the Server field, type the server's private IP address. To secure the connection from Kerio Control to the web server (in the local network), select Use secured connection.
6. (Optional) To route HTTP traffic over to HTTPS protocol, select Force HTTPS Redirection.
7. (Optional) To use antivirus scanning on files uploaded to the web server, select Perform antivirus scanning.
8. Click OK.
9. In the main window, click Apply.

Kerio Control can now use the new rule for your web server.

Configuring a traffic rule

To allow HTTP or HTTPS to the firewall, you must configure traffic rules:

1. In the administration interface, go to Traffic Rules.
2. Select the Web Services rule. If the rule is not available, create the rule to allow HTTP or HTTPS to the firewall, as shown in the figure below.

3. Click Apply.

HTTP/HTTPS traffic is allowed.

Creating SSL certificates with alternative DNS names

If you configure the reverse proxy for your web servers, you can use just one certificate for all the web servers placed behind the reverse proxy.

To create an SSL certificate with alternative DNS names:

1. In the administration interface, go to Definitions > SSL Certificates.
2. Click Add > New Certificate or Add > New Certificate Request.
3. In the New Certificate or New Certificate Request dialog box, type the name for the certificate.
4. In the Hostname field, type the hostname of any of your web servers placed behind the reverse proxy.
5. In the Alternative hostnames field, type the other web server hostnames.Use semicolon (;) to separate the hostnames.
6. You may type the City, State or Province, and select Country and Validity of the certificate.
7. Click OK.
8. In the main window, click Apply.

Once you've created the SSL certificate with alternative DNS names, you can use it as a default certificate:

1. In the administration interface, go to Proxy Server > Reverse Proxy.
2. Change Default certificate to the certificate with alternative DNS names.

Your result should be similar to what is shown below.

Configuring HTTP cache for the reverse proxy

1. In the administration interface, go to Proxy Server > HTTP Cache.
2. Check Enable cache for Kerio Control reverse proxy.
3. Click Apply.

For more information refer to Configuring HTTP cache.