Irule to setup reverse proxy

Forums Technical Forums
,
1

Requirements:

1. The reverse proxy should prevent trusted domains required by CompanyA from being blocked by strict browsers, Global Privacy Controls, and malware guards.

2. For CompanyA’s privacy requirement we will need a reverse proxy for both XYZ and ABC domains listed below.

3. The reverse proxy should be able modify the request as appropriate to match the path *

XYZ:

https://XYZ.com/* (multiple)(required for privacy compliance and security)

  • There will be multiple paths across the enterprise for the multiple platforms in production
  • There will be multiple paths across the enterprise for the multiple platforms in dev and qa

https://ABC.com/* (required for privacy compliance and security)

  • Path for main profile

XYZ:

://ABC* (required for privacy compliance)

  • Path for lower script

  • Path for production

  • 4.The solution needs to be vendor agnostic so that we can customize for other domains needed.

  • 5.The solution should leave cookies in their original format and NOT parse incoming cookies.

2

Hello @sureshjoshi Thanks for the post.

Are you trying to achieve all of this through iRule? Sorry, but I am still having some difficulty in understanding your question/requirement completely. Please brief in simple wording so would be able to help you.

3

Welcome sureshjoshi!

Technically it’s doable, but there are some real hurdles. The big one is FQDN resolution and DNS, especially if the F5 is supposed to do the resolving. And an iRule isn’t really built for this kind of job.

Cookies are the other headache. With a reverse proxy, the browser sends cookies tied to the proxy’s domain, not the original third-party one, so you can run into trouble with Domain, Path, SameSite, and Secure. You can pass the Cookie header through untouched, but getting cookies to behave the same way across different domains is going to be tricky.

Then there’s the path rewriting. Every path needs its own rule pointing to the right destination, and once you multiply that by prod, dev, and QA, it gets messy fast and becomes a pain to maintain.

Honestly, I think this needs a proper reverse proxy, not just an iRule. An iRule can handle parts of it, but building the whole thing on top of one is more complexity and upkeep than it’s worth.