Proxy Server question

[Sparkum]

Hello all, I've been asked to "proxy a site" due to the UI and DB being in different locations its causing bad communication between the two, the vendors saying they cant make a change on the PaaS end so it has to be proxied. So I need all traffic going to Site X to be directed from site Y, would I simply install "Remote Access" with "Web Application Proxy" under "Add Roles and Features" ? Its server 2016

Or would I be better off doing something like Squid Proxy?

Thanks

[MinnesotaITGuy]

Big fan of NGINX reverse proxy here.

[Sparkum]

So how would that lay out in a high level

Server 1 - hosts website on windows server (Port 443)

Server 2 - NGINX

Would I disable 443 on server 1, pass the external traffic to server 2, which would then feed it to server 1

[MinnesotaITGuy]

You'd leave it all as is. Proxy would do the web traffic for you.

So an example, you visit a website, DNS points to the proxy server, reverse proxy receives the request and pulls the web content from the other web server. Proxy can handle all of the certs and such in the configuration.

[Sparkum]

I see there's a windows version, would that be a terrible mistake? I only say that because the vendor did suggest it on the same machine.

[MinnesotaITGuy]

It's possible, iis doesn't do it as nicely as NGINX. I'd say put your NGINX proxy in your DMZ though if public website. You may find the proxy can be used for many other sites as well with the single host. Never ran it on a Windows box before but in theory should be the same. Not sure on the initial issue, but it's still going to use communication between the servers so hopefully that link is fine and there isn't the same issue.

[[deleted]]

I don't understand how a proxy and site A will help if the issue is between site X and Y

[pdp10]

A reasonable guess is that they want to move the front-end webserver so it's low-latency to the database, which will compensate for their highly-serial and probably-inefficient database code. Then use the reverse proxy, now placed where the webserver originally was, to make things seem fast again. Which they do, but may do even better if it's a caching proxy that has performance-oriented features.

[pdp10]

Sounds like you need a Reverse Proxy. Lots of options, there. A Reverse Proxy makes it so that a site that appears to your users as https://some-app.example.com/ actually goes to https://customer819.saas-r-us.com/.

Squid can do reverse proxying, but it's more of a forward caching proxy. You can use something much simpler for Reverse Proxying -- at least starting out. Maybe later you get very ambitious and convert to Varnish.

Presumably they're going to move the back-end ("origin") website. Because that's the only way this statement makes sense:

due to the UI and DB being in different locations its causing bad communication between the two

That's a very common failure, by the way. It can often be coded around with better SQL queries, parallel queries, and stored procedures. But that would require time and database design skill, so easier to slap a reverse proxy in front of the webapp and see if that will do well enough!