This feature allows you to specify the source IP address that the reverse proxy will use when connecting to upstream servers, enabling you to choose which IP to use for outbound connections.
This feature is available with Artica v4.50 Service pack 1 or Artica v4.50 Hotfix 20240222-18
¶ Main benefits:
- Specific IP binding:
This feature lets you specify the source IP address that the reverse-proxy will use when connecting to backends.
This is particularly useful in environments with multiple IP addresses on the proxy server, allowing you to select which IP to use for outgoing connections. - Avoid IP address conflicts:
In scenarios where selection of the outgoing IP is critical (e.g. IP whitelisting on the backend), it ensures that the correct whitelisted IP is used for connections. - IP whitelisting:
By controlling the source IP address, you can enhance security with IP-based whitelisting on the backend server.
Only traffic from specified trusted IP addresses (the proxy server IPs defined via this function) will be accepted by the backend server, reducing the risk of unauthorized access. - Improved traceability:
Backend server logs will show connections originating from specific IP addresses assigned by the reverse-proxy, improving traceability and auditing of incoming connections. - Preserve client IP:
When used with thetransparentsetting, this feature enables transparent proxy, where the backend sees the client's original IP address instead of the proxy's IP address.
This configuration is crucial for applications that require visibility of the client's real IP for logging, analysis or security purposes. - Control traffic routing:
By binding to specific source IPs, you can control how traffic is routed from your proxy to backends servers.
This can be used to optimize network paths or manage traffic on different network interfaces, which can improve latency and throughput. - Load balancing and failover:
In combination with the reverse-proxy's load balancing features, this can be used to implement failover mechanisms.
By dynamically selecting source IPs according to network conditions or backend server availability, the reverse-proxy can ensure greater service availability and reliability. - Compliance with backend restrictions:
Some services may require incoming connections to come from specific IP addresses for compliance reasons.
This function enables you to meet these requirements. - Geotargeting use cases:
For services that present different content depending on the geographic location of the request, this feature can help by ensuring that requests to backend services appear to originate from an IP address associated with a specific location.
¶ Define outgoing address
- Choose the website rule and select the “
Ports” tab. - Click on the
Outgoing Interfacebutton.
- If you select "
All interfaces" and check theTransparentoption, you allow outgoing connections to a backend from a non-local IP address, e.g. a client's real IP address. - If you select an
Outgoing interface, the reverse-proxy will ensure that outgoing connections to a backend come from the local IP address of the network interface card.