Editing Reverse proxy Impelemtation for BJP.ORG on rackspace data center

{{Outdated|reason=Old Article / Architecture / Technology  might not be relevant now May Use for Understand concepts|date=2026-07}}
[[category:BJP]]

Squid as Reverse proxy in front of actual BJP.org Site running of Apache 

==Situation ==

 BJP.org had IP based DDOS attack 

==Temp Solution==

#Build a reverse proxy in rackspace data center use the local eth1 both server .
#Point the DNS to the global IP of Squid server acting at reverse proxy 


==Referance==

http://wiki.squid-cache.org/ConfigExamples/Reverse/BasicAccelerator

==Servers ==

Squid Server - 166.78.63.21 (Global) , 10.182.26.87 (local)

Apache Server - 198.61.199.121 ( global / made down), 10.178.107.106 (local)

= Implementation =

==On Squid Reverse Proxy ==

yum install squid

mv /etc/squid/squid.conf /etc/squid/squid.conf.org 

create a new /etc/squid/squid.conf 

 ##Squid as Reverse Proxy
 http_port 80 accel defaultsite=www.bjp.org
 cache_peer 10.178.107.106  parent 80 0 no-query originserver name=myAccel forceddomain=www.bjp.org
 acl our_sites dstdomain www.bjp.org
 http_access allow our_sites
 http_access deny all
 cache_peer_access myAccel allow our_sites
 cache_peer_access myAccel deny all
 never_direct allow all

10.178.107.106 - Local IP of old server (198.61.199.121)

Add 10.178.107.106 in /etc/hosts as 

 10.178.107.106     bjp.org      www.bjp.org


== Changes on Apache Server ( BJP.org )==

Apache server's file 

 NameVirtualHosts 10.178.107.106:80
 <VirtualHost 10.178.107.106:80>
    ServerAdmin webmaster@dummy-host.bjp.org
    DocumentRoot /var/www/html/cms12
 #    DocumentRoot /var/www/html/maintenance
    ServerName bjp.org
 <Directory /var/www/html/cms12>
    Options Indexes FollowSymLinks MultiViews +ExecCGI
    AllowOverride AuthConfig FileInfo
    Order deny,allow
    Deny from all
    allow from 127.0.0.1
    allow from 10.182.26.87
 </Directory>
 Alias /tetra-cp /var/www/html/cms12/tetra-cp
    ErrorLog logs/bjp-org-err.log
    CustomLog logs/bjp-org-access.log common
 
The old file of httpd.conf has been save with date 

Once Activated  on Squid server with

 service squid start
 chkconfig squid on

The logs are analyzed for few hours so that there is no futher attack

= Few issues Faced and there resolutions =

The site was failing and showing 403 Errors on both logs of Squid and Apache . 

We realized that as mod_evasive was implemented earlier on the apache as DOS attack prevention mechanism . This mechanism was causing this error as only IP of squid was accessing the Apache server . 

So mod_evasive was by passed by moving or renaming the file out of /etc/httpd/conf.d of Apache Server . 

This has fixed the issue of 403 errors . 

=Conclustion=

# We can build more servers on the fly to protect . 
# As the Apache is directly not projected there are less security threats .

= Protecting BJP's Joomla Control Panel URL restricted to IPs of Tetra and BJP =

Modify the Squid.conf as shown highlighted below 

 http_port 80 accel defaultsite=www.bjp.org
 cache_peer 10.178.107.106  parent 80 0 no-query originserver name=myAccel forceddomain=www.bjp.org
 acl our_sites dstdomain www.bjp.org
 '''acl allowed_ip src "/etc/squid/allowed_ip"'''
 '''acl blockregexurl url_regex -i administrator'''
 '''http_access allow allowed_ip blockregexurl'''
 '''http_access deny blockregexurl'''
 http_access allow our_sites
 http_access deny all
 cache_peer_access myAccel allow our_sites
 cache_peer_access myAccel deny all
 never_direct allow all

And the IPs are in /etc/squid/allowed_ip

 59.144.174.135
 122.160.21.105
 203.122.13.226
 122.184.144.66
 122.184.144.82
 124.247.243.4

==Client End Configuration for Admin access of BJP.ORG ==

This change is required as actual BJP.ORG is accessible via Proxy Server and BJP.ORG is pointing Cloudflare's ( CDN Network ) IP . This is required due to complected architecture of site 

On '''Linux''' Open /etc/hosts and add 

 192.237.210.79  www.bjp.org     bjp.org

On '''Windows''' Open c:/windows/system32/drivers/etc/host or c:/windows/system32/etc/hosts and ADD

 192.237.210.79  www.bjp.org     bjp.org