Overview:

With the reverse proxy, you can provision more than one web server placed behind Kerio Control. A single public IP address is used on a default port (80 for HTTP and 443 for HTTPS).

Kerio Control forwards traffic to different servers based on the hostname. Kerio Control does not support directories.

Configuring the reverse proxy

To configure the reverse proxy, enable it in Kerio Control and add rules for particular web servers:

1. In the administration interface, go to Proxy Server > Reverse Proxy.
2. Select Enable Reverse Proxy.

3. Click Add and create new rules for your servers, as described below.
4. Arrange your rules using the arrows on the right side of the main window.Kerio Control examines rules from the top down. The last asterisk rule directs other traffic to the 4081 port (Kerio Control Web Administration).
5. In Settings, select a valid SSL certificate. You need the certificate for proper authentication of Kerio Control when using HTTPS protocol in rules. To avoid problems with browsers, use one SSL certificate with alternative DNS names as a default certificate, as described below.

Adding new rules

Each rule represents one web server behind Kerio Control.

1. In the administration interface, go to Proxy Server > Reverse Proxy.
2. Click Add.
3. In the Reverse Proxy Rule dialog box, type the DNS name of the web server in the Host field.

4. Select the protocol of the server. You can select HTTP, HTTPS, or both. If you are using the HTTPS protocol, select a valid SSL certificate. You need the certificate for proper authentication of Kerio Control when using HTTPS protocol.

5. In the Server field, type the server's private IP address. To secure the connection from Kerio Control to the web server (in the local network), select Use secured connection.
6. (Optional) To use antivirus scanning on files uploaded to the web server, select Perform antivirus scanning.
7. Click OK.
8. In the main window, click Apply.

Kerio Control can now use the new rule for your web server.

Configuring a traffic rule

To allow HTTP or HTTPS to the firewall, you must configure traffic rules:

1. In the administration interface, go to Traffic Rules.
2. Select the Web Services rule. If the rule is not available, create the rule to allow HTTP or HTTPS to the firewall, as shown in the figure below.

3. Click Apply.

HTTP/HTTPS traffic is allowed.

NOTE

You can't create more than one traffic rule for different web servers behind Kerio Control as they share a single public IP address.

To create another traffic rule for different web servers behind Kerio Control, you need to configure an additional public IP address on the internet interface of Kerio Control as explained in the Adding IP Addresses to an Interface article, then you can configure your public DNS to serve these different web servers using two different IP addresses and you can configure two different traffic rules instead of the default "Web Services" traffic rule to apply different restrictions to the traffics as shown below.

Creating SSL certificates with alternative DNS names

If you configure the reverse proxy for your web servers, you can use just one certificate for all the web servers placed behind the reverse proxy.

To create an SSL certificate with alternative DNS names:

1. In the administration interface, go to Definitions > SSL Certificates.
2. Click Add > New Certificate or Add > New Certificate Request.
3. In the New Certificate or New Certificate Request dialog box, type the name for the certificate.
4. In the Hostname field, type the hostname of any of your web servers placed behind the reverse proxy.
5. In the Alternative hostnames field, type the other web server hostnames.Use semicolon (;) to separate the hostnames.
6. You may type the City, State or Province, and select Country and Validity of the certificate.
7. Click OK.
8. In the main window, click Apply.

Once you've created the SSL certificate with alternative DNS names, you can use it as a default certificate:

1. In the administration interface, go to Proxy Server > Reverse Proxy.
2. Change Default certificate to the certificate with alternative DNS names.

Your result should be similar to what is shown below.

Configuring HTTP cache for the reverse proxy

1. In the administration interface, go to Proxy Server > HTTP Cache.
2. Check Enable cache for Kerio Control reverse proxy.
3. Click Apply.