Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 8 replies
  • Subscribers 4 subscribers
  • Views 22777 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Webserver IP visible in website links when published through WAF

mahaddon

Just curious to see if anyone else has had this issue.  I'll apologise in advance for any errors because I'm not a Web Dev  :)

I'm starting to test using WAF to reverse proxy internal websites.  I have a software UTM running v9.411-3.

I've published a couple of websites and they work fine but one site wouldn't load up the css style config when testing from my android phone.  I asked the Web Devs to check it out and they spotted something that's pretty worrying.

He found out that his phone was trying to load internal resources using the ip address, ie: @import url("https://"WEBSERVERIP"/modules/comment/comment.css?on3ztz but if he tested from in internal pc it would be @import url("www.DOMAIN/.../comment.css certificate is for the domain, so it doesn’t load the css.

For info, internal access isn't reverse proxied so that's just a windows pc accessing an internal website directly from the wenserver.

What worries me is that UTM is apparently allowing public visibility of the webserver internal IP address.  I'm assuming that this is a configuration on the webserver but it probably means that the Web Devs will have to check every single site that we have for IP addresses in links before I can migrate them from TMG rev proxy to UTM WAF.

I'm not using Rewrite HTML (the site also used javascript) and I'm testing with a custom WAF firewall policy that's just Basic profile + Block clients with bad reputation - Cookie signing.  My Virtual Webservers are using Encrypted (HTTPS) & redirect over port 443.  Curiously an SSL Labs site check gives the site an A rating



This thread was automatically locked due to age.
Parents
  • 0

    After reading other posts I'm wondering if this could be DNS related?  Not that the IP is being passed through but that it's the internal IP and not the public IP.

    If I do a DNS lookup on the UTM for the FQDN of the site it does resolve to the internal webserver IP.  UTM is primarily used as an AD integrated forward proxy so integrates with internal DNS.  This is an internal site that is accessible from internal clients so will resolve that FQDN from internal DNS.

    Do I need to create a host definition for this FQDN resolving to the public IP of the website?  Does mean that we'll have to revisit our browser proxy exceptions if we'll have to do this for every single published site because we have a lot of different website domains.  We are a Local Authority and it seems that services like to brand every single project that they run that needs a website e.g. go smarter, go green, go by bike....  I'm sure you get the idea  :(

Reply
  • 0

    After reading other posts I'm wondering if this could be DNS related?  Not that the IP is being passed through but that it's the internal IP and not the public IP.

    If I do a DNS lookup on the UTM for the FQDN of the site it does resolve to the internal webserver IP.  UTM is primarily used as an AD integrated forward proxy so integrates with internal DNS.  This is an internal site that is accessible from internal clients so will resolve that FQDN from internal DNS.

    Do I need to create a host definition for this FQDN resolving to the public IP of the website?  Does mean that we'll have to revisit our browser proxy exceptions if we'll have to do this for every single published site because we have a lot of different website domains.  We are a Local Authority and it seems that services like to brand every single project that they run that needs a website e.g. go smarter, go green, go by bike....  I'm sure you get the idea  :(

Children
No Data
Unfiltered HTML