Redirect Web traffic to a specific port

This guide concerns the redirection of web traffic to a specific port, including when using a dedicated IP and a specific web application (such as Node or Varnish e.g.).

Prerequisites

• Install HAProxy on the Cloud Server.

Redirect Web traffic to a specific port

By default, on Cloud Server, web traffic is sent to Apache. To send requests to a Node script or another service (as long as it "listens" to a port between 4000 and 4009), you must go through PAHroxy.

This applies in particular to Express, Socket servers. IO, Meteor.js, Nuxt.js, Django, Flask, Ruby on Rails, even possibly Java (J2E), etc.

To do this, you have to make sure that the service listens well on a port between 4000 and 4009 (in particular with server.listen(4000) for Express or a basic HTTP Node server, but depending on the type of project by other means, a configuration file, in code or other) and on all interfaces (0.0.0.0).

It will also be necessary to configure HAProxy as in the following example:

1. Click here in order to access the management of your product on the Manager Infomaniak (Need help?).
2. Click directly on the nameallocated to the product concerned.
3. Click on Fast install in the left side menu.
4. Click on the action menu ⋮ located to the right of HAProxy.
5. Click on Configure:
   
6. Choose the desired information and save:
   
    

Retrieving the source IP of a query

When you redirect web traffic to your web application, the processing of requests changes and the request is first received by a reverse proxy (local to the server) which then transfers the request to the selected port. Thus, due to the transfer of the request, the methods usually allowing to recover the visitor's IP will give the IP of the reverse proxyinstead of the visitor's.

Thus, to recover the actual source IP of the visitor in these cases, you need to consult an HTTP header named X-Forwarded-For, which will contain source IPs accumulated during each redirection. This header will lastly contain the client's original IP address, allowing to identify the actual visitor.

Attention: It is important to note that HTTP headers can be manipulated, which presents security risks. To minimize these risks, it is recommended to check that the request is from a reliable server before trusting the content of the header. X-Forwarded-For This verification may involve ensuring that the request has been transmitted by a trusted intermediate server, identified by a pre-established list of IP addresses. In case the site uses a dedicated IP, the trusted servers are:

• 83.166.133.15
• 83.166.133.17
• 83.166.133.16
• 84.16.92.5
• 84.16.92.43
• 10.2.32.255
• 10.2.34.164