From: Mike Rumph mod_proxy_balancer
and one or more
- balancer modules, if load balancing is required. (See
+ balancer modules if load balancing is required. (See
mod_proxy_balancer
for more information.) Basic Examples
Access via Handler
Workers
Controlling access to your proxy
Controlling Access to Your Proxy
Slow Startup
Intranet Proxy
Protocol Adjustments
A reverse proxy (or gateway), by contrast, appears to the client just like an ordinary web server. No special configuration on the client is necessary. - The client makes ordinary requests for content in the name-space + The client makes ordinary requests for content in the namespace of the reverse proxy. The reverse proxy then decides where to - send those requests, and returns the content as if it was itself + send those requests and returns the content as if it were itself the origin.
A typical usage of a reverse proxy is to provide Internet users access to a server that is behind a firewall. Reverse proxies can also be used to balance load among several back-end - servers, or to provide caching for a slower back-end server. + servers or to provide caching for a slower back-end server. In addition, reverse proxies can be used simply to bring several servers into the same URL space.
@@ -238,7 +238,7 @@ ProxyVia OnThe proxy manages the configuration of origin servers and their communication parameters in objects called workers. - There are two built-in workers, the default forward proxy worker and the + There are two built-in workers: the default forward proxy worker and the default reverse proxy worker. Additional workers can be configured explicitly.
@@ -258,7 +258,7 @@ ProxyVia OnThis will create a worker associated with the origin server URL
- http://backend.example.com
and using the given timeout
+ http://backend.example.com
that will use the given timeout
values. When used in a forward proxy, workers are usually defined
via the ProxySet
directive:
Using explicitly configured workers in the forward mode is
not very common, because forward proxies usually communicate with many
different origin servers. Creating explicit workers for some of the
- origin servers can still be useful, if they are used very often.
+ origin servers can still be useful if they are used very often.
Explicitly configured workers have no concept of forward or reverse
proxying by themselves. They encapsulate a common concept of
communication with origin servers. A worker created by
ProxyPass
for use in a
- reverse proxy will be also used for forward proxy requests whenever
- the URL to the origin server matches the worker URL and vice versa.
The URL identifying a direct worker is the URL of its origin server including any path components given:
@@ -307,13 +307,13 @@ ProxyPass "/examples" "http://backend.example.com/examples" timeout=10 worker is used. The benefit is, that there is only one connection pool, so connections are more often reused. Note that all configuration attributes given explicitly for the later worker will be ignored. This will be logged - as a warning. In the above example the resulting timeout value + as a warning. In the above example, the resulting timeout value for the URL/examples
will be 60
instead
of 10
!
If you want to avoid worker sharing, sort your worker definitions
by URL length, starting with the longest worker URLs. If you want to maximize
- worker sharing use the reverse sort order. See also the related warning about
+ worker sharing, use the reverse sort order. See also the related warning about
ordering ProxyPass
directives.
ProxySet
.
The set of options available for a direct worker
- depends on the protocol, which is specified in the origin server URL.
+ depends on the protocol which is specified in the origin server URL.
Available protocols include ajp
, fcgi
,
ftp
, http
and scgi
.
You can control who can access your proxy via the <Proxy>
control block as in
the following example:
This directive allows for growth potential in the number of Balancers available for a virtualhost in addition to the number pre-configured. It only takes effect if there is at - least 1 pre-configured Balancer.
+ least one pre-configured Balancer.This directive adds a member to a load balancing group. It could be used +
This directive adds a member to a load balancing group. It can be used
within a <Proxy balancer://...>
container
- directive, and can take any of the key value pair parameters available to
+ directive and can take any of the key value pair parameters available to
ProxyPass
directives.
One additional parameter is available only to BalancerMember
directives:
loadfactor. This is the member load factor - a number between 1
(default) and 100, which defines the weighted load to be applied to the
member in question.
The balancerurl is only needed when not in +
The balancerurl is only needed when not within a
<Proxy balancer://...>
container directive. It corresponds to the url of a balancer defined in
ProxyPass
directive.
Domain name comparisons are done without regard to the case, and
Domains are always assumed to be anchored in the root of the
- DNS tree, therefore two domains .ExAmple.com
and
+ DNS tree; therefore, the two domains .ExAmple.com
and
.example.com.
(note the trailing period) are considered
equal. Since a domain comparison does not involve a DNS lookup, it is much
more efficient than subnet comparison.
Hostname comparisons are done without regard to the case,
and Hostnames are always assumed to be anchored in the root
- of the DNS tree, therefore two hosts WWW.ExAmple.com
+ of the DNS tree; therefore, the two hosts WWW.ExAmple.com
and www.example.com.
(note the trailing period) are
considered equal.
The ProxyBadHeader
directive determines the
- behaviour of mod_proxy
if it receives syntactically invalid
+ behavior of mod_proxy
if it receives syntactically invalid
response header lines (i.e. containing no colon) from the origin
server. The following arguments are possible:
IsError
Ignore
This directive is useful for reverse-proxy setups, where you want to +
This directive is useful for reverse-proxy setups where you want to
have a common look and feel on the error pages seen by the end user.
This also allows for included files (via
mod_include
's SSI) to get
- the error code and act accordingly (default behavior would display
- the error page of the proxied server, turning this on shows the SSI
- Error message).
This directive does not affect the processing of informational (1xx), normal success (2xx), or redirect (3xx) responses.
@@ -876,12 +876,12 @@ proxiedThe ProxyIOBufferSize
directive adjusts the size
- of the internal buffer, which is used as a scratchpad for the data between
+ of the internal buffer which is used as a scratchpad for the data between
input and output. The size must be at least 512
.
In almost every case there's no reason to change that value.
+In almost every case, there's no reason to change that value.
-If used with AJP this directive sets the maximum AJP packet size in +
If used with AJP, this directive sets the maximum AJP packet size in
bytes. Values larger than 65536 are set to 65536. If you change it from
the default, you must also change the packetSize
attribute of
your AJP connector on the Tomcat side! The attribute
@@ -905,7 +905,7 @@ proxied resources
The <ProxyMatch>
directive is
- identical to the <Proxy>
directive, except it matches URLs
+ identical to the <Proxy>
directive, except that it matches URLs
using regular expressions.
From 2.4.8 onwards, named groups and backreferences are captured and @@ -938,9 +938,9 @@ through
The ProxyMaxForwards
directive specifies the
- maximum number of proxies through which a request may pass, if there's no
+ maximum number of proxies through which a request may pass if there's no
Max-Forwards
header supplied with the request. This may
- be set to prevent infinite proxy loops, or a DoS attack.
ProxyMaxForwards 15
Max-Forwards
if the Client didn't set it.
Earlier Apache httpd versions would always set it. A negative
ProxyMaxForwards
value, including the
- default -1, gives you protocol-compliant behaviour, but may
+ default -1, gives you protocol-compliant behavior but may
leave you open to loops.
@@ -966,8 +966,8 @@ through
This directive allows remote servers to be mapped into the - space of the local server; the local server does not act as a - proxy in the conventional sense, but appears to be a mirror of the + space of the local server. The local server does not act as a + proxy in the conventional sense but appears to be a mirror of the remote server. The local server is often called a reverse proxy or gateway. The path is the name of a local virtual path; url is a partial URL for the @@ -982,7 +982,7 @@ through
In 2.4.7 and later, support for using a Unix Domain Socket is available by using a target
which prepends unix:/path/lis.sock|
. For example, to proxy
- HTTP and target the UDS at /home/www/socket you would use
+ HTTP and target the UDS at /home/www/socket, you would use
unix:/home/www.socket|http://localhost/whatever/
.
unix:
@@ -1000,7 +1000,7 @@ through
http://example.com/mirror/foo/bar
to be internally converted
into a proxy request to http://backend.example.com/bar
.
- The following alternative syntax is possible, however it can carry a +
The following alternative syntax is possible; however, it can carry a performance penalty when present in very large numbers. The advantage of the below syntax is that it allows for dynamic control via the Balancer Manager interface:
@@ -1010,8 +1010,8 @@ throughIf the first argument ends with a trailing /, the second - argument should also end with a trailing / and vice - versa. Otherwise the resulting requests to the backend may miss some + argument should also end with a trailing /, and vice + versa. Otherwise, the resulting requests to the backend may miss some needed slashes and do not deliver the expected results.
ProxyPass
rules starting with the
- longest URLs first. Otherwise later rules for longer URLS will be hidden
+ longest URLs first. Otherwise, later rules for longer URLS will be hidden
by any earlier rule which uses a leading substring of the URL. Note that
there is some relation with worker sharing. In contrast, only one
ProxyPass
directive can be placed
in a Location
block, and the most
specific location will take precedence.
- For the same reasons exclusions must come before the +
For the same reasons, exclusions must come before the
general ProxyPass
directives.
ProxyPass
directive
- using key=value
parameters, described in the table
+ using key=value
parameters, described in the tables
below.
By default, mod_proxy will allow and retain the maximum number of @@ -1094,7 +1094,7 @@ ProxyPass "/mirror/foo" "http://backend.example.com"
ThreadsPerChild
directive.SERVER_BUSY
+ connections in the pool, the Apache httpd will return SERVER_BUSY
status to the client.
This parameter should be used when you have a firewall between your
- Apache httpd and the backend server, who tend to drop inactive connections.
+ Apache httpd and the backend server, which tend to drop inactive connections.
This flag will tell the Operating System to send KEEP_ALIVE
- messages on inactive connections and thus prevent the firewall to drop the connection.
- To enable keepalive set this property value to On
.
On
.
The frequency of initial and subsequent TCP keepalive probes depends on global OS settings, and may be as high as 2 hours. To be useful, the frequency configured in the OS must be smaller than the threshold used @@ -1180,19 +1181,19 @@ ProxyPass "/mirror/foo" "http://backend.example.com"
mod_proxy_ajp
to send a CPING
+ mod_proxy_ajp
to send a CPING
request on the ajp13 connection (implemented on Tomcat 3.3.2+, 4.1.28+
and 5.0.13+). For HTTP, it causes mod_proxy_http
to send a 100-Continue
to the backend (only valid for
HTTP/1.1 - for non HTTP/1.1 backends, this property has no
- effect). In both cases the parameter is the delay in seconds to wait
+ effect). In both cases, the parameter is the delay in seconds to wait
for the reply.
This feature has been added to avoid problems with hung and
busy backends.
This will increase the network traffic during the normal operation
which could be an issue, but it will lower the
traffic in case some of the cluster nodes are down or busy.
- By adding a postfix of ms the delay can be also set in
+ By adding a postfix of ms, the delay can be also set in
milliseconds.
D: Worker is disabled and will not accept any requests. |
S: Worker is administratively stopped. |
I: Worker is in ignore-errors mode, and will always be considered available. |
I: Worker is in ignore-errors mode and will always be considered available. |
H: Worker is in hot-standby mode and will only be used if no other viable workers are available. |
E: Worker is in an error state. |
N: Worker is in drain mode, and will only accept existing sticky sessions + |
N: Worker is in drain mode and will only accept existing sticky sessions destined for itself and ignore all other requests. |
If the Proxy directive scheme starts with the
balancer://
(eg: balancer://cluster
,
- any path information is ignored) then a virtual worker that does not really
- communicate with the backend server will be created. Instead it is responsible
- for the management of several "real" workers. In that case the special set of
- parameters can be add to this virtual worker. See mod_proxy_balancer
- for more information about how the balancer works.
+ any path information is ignored), then a virtual worker that does not really
+ communicate with the backend server will be created. Instead, it is responsible
+ for the management of several "real" workers. In that case, the special set of
+ parameters can be added to this virtual worker.
+ See mod_proxy_balancer
for more information about how
+ the balancer works.
Balancer parameters |
---|
byrequests | Balancer load-balance method. Select the load-balancing scheduler
method to use. Either byrequests , to perform weighted
- request counting, bytraffic , to perform weighted
- traffic byte count balancing, or bybusyness , to perform
- pending request balancing. Default is byrequests .
+ request counting; bytraffic , to perform weighted
+ traffic byte count balancing; or bybusyness , to perform
+ pending request balancing. The default is byrequests .
|
||
maxattempts | One less than the number of workers, or 1 with a single worker. | @@ -1285,7 +1287,7 @@ ProxyPass "/mirror/foo" "http://backend.example.com"||
nofailover | Off | -If set to On the session will break if the worker is in
+ | If set to On , the session will break if the worker is in
error state or disabled. Set this value to On if backend
servers do not support session replication.
| Balancer sticky session name. The value is usually set to something
like JSESSIONID or PHPSESSIONID ,
and it depends on the backend application server that support sessions.
- If the backend application server uses different name for cookies
- and url encoded id (like servlet containers) use | to separate them.
- The first part is for the cookie the second for the path.+ If the backend application server uses different names for cookies + and url encoded id (like servlet containers), use | to separate them. + The first part is for the cookie; the second for the path. Available in Apache HTTP Server 2.4.4 and later. |
stickysessionsep | "." | Sets the separation symbol in the session cookie. Some backend application servers - do not use the '.' as the symbol. For example the Oracle Weblogic server uses + do not use the '.' as the symbol. For example, the Oracle Weblogic server uses '!'. The correct symbol can be set using this option. The setting of 'Off' signifies that no symbol is used. | |
scolonpathdelim | Off | -If set to On the semi-colon character ';' will be
+ | If set to On , the semi-colon character ';' will be
used as an additional sticky session path delimiter/separator. This
is mainly used to emulate mod_jk's behavior when dealing with paths such
as JSESSIONID=6736bcf34;foo=aabfa
|
timeout | 0 | -Balancer timeout in seconds. If set this will be the maximum time - to wait for a free worker. Default is not to wait. + | Balancer timeout in seconds. If set, this will be the maximum time + to wait for a free worker. The default is to not wait. |
failonstatus | - | -A single or comma-separated list of HTTP status codes. If set this will + | A single or comma-separated list of HTTP status codes. If set, this will force the worker into error state when the backend returns any status code in the list. Worker recovery behaves the same as other worker errors. |
A sample balancer setup
+A sample balancer setup:
ProxyPass "/special-area" "http://special.example.com" smax=5 max=10 ProxyPass "/" "balancer://mycluster/" stickysession=JSESSIONID|jsessionid nofailover=On <Proxy "balancer://mycluster"> @@ -1371,8 +1373,8 @@ ProxyPass "/" "balancer://mycluster/" stickysession=JSESSIONID|jsessionid nofail </Proxy>-
Setting up a hot-standby, that will only be used if no other - members are available
+Setting up a hot-standby that will only be used if no other + members are available:
ProxyPass "/" "balancer://hotcluster/" <Proxy "balancer://hotcluster"> BalancerMember "ajp://1.2.3.4:8009" loadfactor=1 @@ -1386,9 +1388,9 @@ ProxyPass "/" "balancer://mycluster/" stickysession=JSESSIONID|jsessionid nofailNormally, mod_proxy will canonicalise ProxyPassed URLs. But this may be incompatible with some backends, particularly those that make use of PATH_INFO. The optional nocanon - keyword suppresses this, and passes the URL path "raw" to the - backend. Note that may affect the security of your backend, as it - removes the normal limited protection against URL-based attacks + keyword suppresses this and passes the URL path "raw" to the + backend. Note that this keyword may affect the security of your backend, + as it removes the normal limited protection against URL-based attacks provided by the proxy.
Normally, mod_proxy will include the query string when @@ -1398,8 +1400,8 @@ ProxyPass "/" "balancer://mycluster/" stickysession=JSESSIONID|jsessionid nofail
When used inside a
<Location>
section, the first argument is omitted and the local directory is obtained from the<Location>
. The same will occur inside a -<LocationMatch>
section, - however ProxyPass does not interpret the regexp as such, so it is necessary +<LocationMatch>
section; + however, ProxyPass does not interpret the regexp as such, so it is necessary to useProxyPassMatch
in this situation instead.This directive is not supported in
@@ -1409,7 +1411,7 @@ ProxyPass "/" "balancer://mycluster/" stickysession=JSESSIONID|jsessionid nofail<Directory>
or<Files>
sections.[P]
flag.The optional interpolate keyword, in combination with -
ProxyPassInterpolateEnv
causes the ProxyPass +ProxyPassInterpolateEnv
, causes the ProxyPass to interpolate environment variables, using the syntax ${VARNAME}. Note that many of the standard CGI-derived environment variables will not exist when this interpolation happens, @@ -1442,7 +1444,7 @@ ProxyPassReverse "/mirror/foo/" "https://backend.example.com/"
This directive will cause the current server/vhost to "inherit"
ProxyPass
@@ -1466,18 +1468,18 @@ ProxyPassReverse "/mirror/foo/" "https://backend.example.com/"
This directive, together with the interpolate argument to
ProxyPass
, ProxyPassReverse
,
- ProxyPassReverseCookieDomain
and
- ProxyPassReverseCookiePath
+ ProxyPassReverseCookieDomain
, and
+ ProxyPassReverseCookiePath
,
enables reverse proxies to be dynamically
- configured using environment variables, which may be set by
+ configured using environment variables which may be set by
another module such as mod_rewrite
.
It affects the ProxyPass
,
ProxyPassReverse
,
ProxyPassReverseCookieDomain
, and
- ProxyPassReverseCookiePath
directives,
+ ProxyPassReverseCookiePath
directives
and causes them to substitute the value of an environment
variable varname
for the string ${varname}
- in configuration directives (if the interpolate option is set).
Keep this turned off (for server performance) unless you need it!
@@ -1491,8 +1493,8 @@ ProxyPassReverse "/mirror/foo/" "https://backend.example.com/"This directive is equivalent to ProxyPass
,
- but makes use of regular expressions, instead of simple prefix matching. The
+
This directive is equivalent to ProxyPass
+ but makes use of regular expressions instead of simple prefix matching. The
supplied regular expression is matched against the url, and if it
matches, the server will substitute any parenthesized matches into the given
string and use it as a new url.
Take care when constructing the target URL of the rule, considering the security impact from allowing the client influence over the set of URLs to which your server will act as a proxy. Ensure that the scheme - and hostname part of the URL is either fixed, or does not allow the + and hostname part of the URL is either fixed or does not allow the client undue influence.
@@ -1562,7 +1564,7 @@ proxied serverThis directive lets Apache httpd adjust the URL in the Location
,
Content-Location
and URI
headers on HTTP
redirect responses. This is essential when Apache httpd is used as a
- reverse proxy (or gateway) to avoid by-passing the reverse proxy
+ reverse proxy (or gateway) to avoid bypassing the reverse proxy
because of HTTP redirects on the backend servers which stay behind
the reverse proxy.
mod_proxy_html
.
- path is the name of a local virtual path. url is a - partial URL for the remote server - the same way they are used for the +
path is the name of a local virtual path; url is a
+ partial URL for the remote server.
+ These parameters are used the same way as for the
ProxyPass
directive.
For example, suppose the local server has address @@ -1590,16 +1593,16 @@ ProxyPassReverseCookiePath "/" "/mirror/foo/"
will not only cause a local request for the
http://example.com/mirror/foo/bar
to be internally converted
into a proxy request to http://backend.example.com/bar
- (the functionality ProxyPass
provides here). It also takes care
- of redirects the server backend.example.com
sends: when
- http://backend.example.com/bar
is redirected by him to
- http://backend.example.com/quux
Apache httpd adjusts this to
+ (the functionality which ProxyPass
provides here).
+ It also takes care of redirects which the server backend.example.com
+ sends when redirecting http://backend.example.com/bar
to
+ http://backend.example.com/quux
. Apache httpd adjusts this to
http://example.com/mirror/foo/quux
before forwarding the HTTP
redirect response to the client. Note that the hostname used for
constructing the URL is chosen in respect to the setting of the UseCanonicalName
directive.
Note that this ProxyPassReverse
directive can
- also be used in conjunction with the proxy pass-through feature
+ also be used in conjunction with the proxy feature
(RewriteRule ... [P]
) from mod_rewrite
because it doesn't depend on a corresponding ProxyPass
directive.
<Location>
. The same occurs inside a <LocationMatch>
section, but will probably not work as
intended, as ProxyPassReverse will interpret the regexp literally as a
path; if needed in this situation, specify the ProxyPassReverse outside
- the section, or in a separate <Location>
section.
+ the section or in a separate <Location>
section.
This directive is not supported in <Directory>
or <Files>
sections.
When enabled, this option will pass the Host: line from the incoming
- request to the proxied host, instead of the hostname specified in the
- ProxyPass
line.
ProxyPass
line.
This option should normally be turned Off
. It is mostly
useful in special configurations like proxied mass name-based virtual
@@ -1744,7 +1747,7 @@ ProxyRemote "ftp" "http://ftpproxy.mydomain:8080"
as yet another HTTP proxy request, to another proxy which can handle
them.
This option also supports reverse proxy configuration - a backend +
This option also supports reverse proxy configuration; a backend webserver can be embedded within a virtualhost URL space even if that server is hidden by another forward proxy.
@@ -1760,7 +1763,7 @@ expressionsThe ProxyRemoteMatch
is identical to the
- ProxyRemote
directive, except the
+ ProxyRemote
directive, except that the
first argument is a regular expression
match against the requested URL.
Keep in mind that the same parameter key can have a different meaning - depending whether it is applied to a balancer or a worker as shown by the two + depending whether it is applied to a balancer or a worker, as shown by the two examples above regarding timeout.