Apache is a tried and tested HTTP server which comes with access to a very wide range of powerful extensions. Although it might not seem like the go-to choice in terms of running a reverse-proxy, system administrators who already depend on Apache for the available rich feature-set can also use it as a gateway to their application servers. In most cases, this will translate to removing an additional layer from their server set up or the need to use yet another tool just to redirect connections.
In this DigitalOcean article, we are going to see set up Apache on Ubuntu 13 and use it as a reverse-proxy to welcome incoming connections and redirect them to application server(s) running on the same network. For this purpose, we are going to use and work with the mod_proxy extension and several other related Apache modules.
Apache HTTP server does not require an introduction, since it is probably the most famous and popular web-server that exists. It is possible to run Apache very easily on many different platforms and set ups. The application comes with a lot of third party modules to handle different kind of tasks (mod_rewrite for rule-based URL rewriting) and one of them, albeit nowadays relatively neglected, is mod_proxy: The Apache Module to implement a proxy (or gateway) for servers running on the back-end.
Tip: According to some articles, Apache’s name comes from server’s “patchy” nature - i.e. it being a collection of application patches (or modules).
Note: To learn more about Apache, you can check out the Wikipedia entry on the subject - Apache HTTP Server.
mod_proxy is the Apache module for redirecting connections (i.e. a gateway, passing them through). It is enabled for use just like any other module and configuration is pretty basic (or standard), in line with others. mod_proxy is not just a single module but a collection of them, with each bringing a new set of functionality.
Some of these modules are:
mod_proxy: The main proxy module for Apache that manages connections and redirects them.
mod_proxy_http: This module implements the proxy features for HTTP and HTTPS protocols.
mod_proxy_ftp: This module does the same but for FTP protocol.
mod_proxy_connect: This one is used for SSL tunnelling.
mod_proxy_ajp: Used for working with the AJP protocol.
mod_proxy_wstunnel: Used for working with web-sockets (i.e. WS and WSS).
mod_proxy_balancer: Used for clustering and load-balancing.
mod_cache: Used for caching.
mod_headers: Used for managing HTTP headers.
mod_deflate: Used for compression.
Note: To learn more about Apache and mod_proxy, you can check out the official Apache documentation on the subject here.
Note: Instructions given here are kept brief, since chances are you already have Apache installed or know how to use it. Nonetheless, by following the steps below you can get a new Ubuntu VPS running Apache in a matter of minutes.
We will begin with preparing our virtual server. We are going to first upgrade the default available components to make sure that we have everything up-to-date.
Update the software sources list and upgrade the dated applications:
- aptitude update
- aptitude -y upgrade
Let’s continue with getting the essential package for application building - the build-essential. This package contains tools necessary to install certain things from source.
Run the following command to install
- aptitude install -y build-essential
Next, we are going to get the module and dependencies.
Run the following command to install them:
- aptitude install -y libapache2-mod-proxy-html libxml2-dev
Before configuring Apache, we are going to enable the necessary modules that we will be using in this tutorial, or which might come in handy in the future.
First, let’s verify that all modules are correctly installed and ready to be activated.
Run the following command to get a list of available Apache modules:
- # You will be presented with an output similar to:
- # Your choices are: access_compat actions alias allowmethods asis auth_basic auth_digest auth_form authn_anon authn_core authn_dbd authn_dbm authn_file authn_socache authnz_ldap authz_core authz_dbd authz_dbm authz_groupfile authz_host authz_owner authz_user autoindex buffer cache cache_disk cache_socache cgi cgid charset_lite data dav dav_fs dav_lock dbd deflate dialup dir dump_io echo env expires ext_filter file_cache filter headers heartbeat heartmonitor include info lbmethod_bybusyness lbmethod_byrequests lbmethod_bytraffic lbmethod_heartbeat ldap log_debug log_forensic lua macro mime mime_magic mpm_event mpm_itk mpm_prefork mpm_worker negotiation proxy proxy_ajp proxy_balancer proxy_connect proxy_express proxy_fcgi proxy_fdpass proxy_ftp proxy_html proxy_http proxy_scgi proxy_wstunnel ratelimit reflector remoteip reqtimeout request rewrite sed session session_cookie session_crypto session_dbd setenvif slotmem_plain slotmem_shm socache_dbm socache_memcache socache_shmcb speling ssl status substitute suexec unique_id userdir usertrack vhost_alias xml2enc
- # Which module(s) do you want to enable (wildcards ok)?
Once you are prompted with the choice of modules you desire, you can pass the below line listing the module names:
The list of modules:
- proxy proxy_ajp proxy_http rewrite deflate headers proxy_balancer proxy_connect proxy_html
Or alternatively, you can run the following commands to enable the modules one by one:
- a2enmod proxy
- a2enmod proxy_http
- a2enmod proxy_ajp
- a2enmod rewrite
- a2enmod deflate
- a2enmod headers
- a2enmod proxy_balancer
- a2enmod proxy_connect
- a2enmod proxy_html
Note: Some modules are likely to be enabled by default. Trying to enable them twice will just ensure that they are active.
In this step, we are going to see how to modify the default configuration file
/etc/apache2/sites-enabled to set up “proxying” functionality.
Run the following command to edit the default Apache virtual host using the nano text editor:
- nano /etc/apache2/sites-enabled/000-default.conf
Here, we will be defining a proxy virtual host using
Copy-and-paste the below block of configuration, amending it to suit your needs:
<VirtualHost *:*> ProxyPreserveHost On # Servers to proxy the connection, or; # List of application servers: # Usage: # ProxyPass / http://[IP Addr.]:[port]/ # ProxyPassReverse / http://[IP Addr.]:[port]/ # Example: ProxyPass / http://0.0.0.0:8080/ ProxyPassReverse / http://0.0.0.0:8080/ ServerName localhost </VirtualHost>
Press CTRL+X and confirm with Y to save and exit.
Note: To learn more about virtual host configurations, you can check out the detailed Apache manual on the subject by clicking here.
If you have multiple back-end servers, a good way to distribute the connection when proxying them is to use Apache’s load balancing features.
Start editing the virtual-host settings like the previous step, but this time using the below configuration example:
<Proxy balancer://mycluster> # Define back-end servers: # Server 1 BalancerMember http://0.0.0.0:8080/ # Server 2 BalancerMember http://0.0.0.0:8081/ </Proxy> <VirtualHost *:*> # Apply VH settings as desired # However, configure ProxyPass argument to # use "mycluster" to balance the load ProxyPass / balancer://mycluster </VirtualHost>
If you are dealing with SSL connections and certificates, you will also need to enable a secondary virtual host with below settings.
Repeat the steps from the previous steps but using these configuration options:
Listen 443 NameVirtualHost *:443 <VirtualHost *:443> SSLEngine On # Set the path to SSL certificate # Usage: SSLCertificateFile /path/to/cert.pem SSLCertificateFile /etc/apache2/ssl/file.pem # Servers to proxy the connection, or; # List of application servers: # Usage: # ProxyPass / http://[IP Addr.]:[port]/ # ProxyPassReverse / http://[IP Addr.]:[port]/ # Example: ProxyPass / http://0.0.0.0:8080/ ProxyPassReverse / http://0.0.0.0:8080/ # Or, balance the load: # ProxyPass / balancer://balancer_cluster_name </VirtualHost>
Once you are happy with your configuration, you will need to restart the cloud server for the changes to go into effect.
Execute the following command to restart Apache:
- service apache2 restart
And that’s it!
You can now visit your VPS and Apache shall reverse-proxy connections to your back-end application servers.
Thanks for learning with the DigitalOcean Community. Check out our offerings for compute, storage, networking, and managed databases.
Join our DigitalOcean community of over a million developers for free! Get help and share knowledge in our Questions & Answers section, find tutorials and tools that will help you grow as a developer and scale your project or business, and subscribe to topics of interest.Sign up now
This textbox defaults to using Markdown to format your answer.
You can type !ref in this text area to quickly search our full set of tutorials, documentation & marketplace offerings and insert the link!
Works like a charm!
I had a problem with the balancer. I always received err_too_many_redirects from my browser. The Problem was the cluster member url contained a slash (/) after the portnumber - i removed those, and added a slash on ProxyPass
After removing those two slashes and adding the other one to VirtualHost section, everything worked fine.
my loadbalancer setup: port 8080 balancing to 8081 & 8082
Below config worked for me for frontend and backend with selfsigned ssl.
I can’t get this running. I’m trying to set up RStudio to run at www.mywebsite/rstudio. I’ve got the following 000-default.conf::
However, I still get a 404 when trying to browse to the webpage. I’ve followed this guide to the “T.” I wonder if it has to do with the fact that I’m using DO’s one-click Wordpress installation on Ubuntu.
I hope you can help with this because I am a little bit confused.
I’m an apache 2.2 httpd and want to communicate to a secured server which is also HTTPS SSL by using ProxyPass and ProxyPassReverse.
Outside world ==> https ssl Apache 2.2 httpd (localhost) ==> Secured server Https ssl (domain.com) I am the middle man here.
What exactly do I need from them (domain.com) in order for me to configure Apache 2.2 httpd-ssl.conf properly?
Do I only need their public key? I don’t think I also need their certificate, otherwise I can generate their private key. I don’t think that’s handy…and insecured.
This is my current configuration when the outside world visit the middle man apache server. Can you take a look and check what I am missing to get it working theoretically?
LoadModule ssl_module modules/mod_ssl.so LoadModule proxy_module modules/mod_proxy.so LoadModule proxy_http_module modules/mod_proxy_http.so
<VirtualHost *:8443> ServerName localhost.localdomain SSLEngine on SSLCertificateFile /etc/httpd/conf.d/ssl/server.crt SSLCertificateKeyFile /etc/httpd/conf.d/ssl/server_priv.pem
Hello, I need some help: I have a Ruby application running on port:8550 and Apache on :80. How do I serve requests to :8550 on a clean url?
Hi everyone, in “Enabling SSL Reverse-Proxy Support”, I added: “ProxyPreserveHost On” line <VirtualHost *:443> … ProxyPreserveHost On ProxyPass / http://0.0.0.0:8080/ ProxyPassReverse / http://0.0.0.0:8080/ … </VirtualHost> I hope it can be useful.
Can’t activate gzip encoding. module deflate loaded, .htaccess edited with following:
wont work anyways
This comment has been deleted
Ive set up a reverse proxy as above to go to www.example.com/server1. That works fine but when i click on any link in /server1 it bypasses the proxy and loads up the original page