The goal of this tutorial is to access an internal web server via the reverse proxy
Ostatnia zmiana dla wersji: 14.2.0 (07.2026)
Nowość:
- Beta Wyłącznie dla użytkowników korzystających z wersji beta::
- ACL arguments are now being checked for admissibility
- Added a note regarding the current certificate requirements
- The reverse proxy can now also pass through SNI
- Server groups and sites are displayed in a common table (v14.1.0)
- Regex expressions of the ACL sets can consider/ignore upper and lower case (v14.1.0)
- Note that sites must include at least one ACL set with dstdomain (v14.1.0)
Ostatnia aktualizacja:
- 10.2026
- The wording and examples for ACL sets have been updated
notempty
Ten artykuł odnosi się do wersji beta
notempty
- With v12.7.0, nginx can be selected as the reverse proxy engine
- Changing the engine will most likely result in an adjustment of the configuration, as each engine supports different features.
- Unsupported settings are marked after the changeover
Intended use
With a reverse proxy, one can control access to the "internal" web servers from the Internet. In contrast to a port forwarding, dedicated filter rules can be created via the reverse proxy. In addition, with only one public IP address, several internal web servers can be addressed based on the domain.
Another highlight is offered by the load balancing. Servers can be combined into groups, to which the requests are then distributed using the selected algorithm (e.g. Round-Robin).
Requirements
The following values are assumed for the example configuration:
- Web server with the private IP: 10.1.0.150
- Domain: www.ttt-point.de
Preparations
- Attention:
If the web server is also to be accessed via https, the port of the Userinterface must be changed first.
Change user Webinterface port
ukryj
Klicken für dauerhafte Anzeige
UTMuser@firewall.name.fqdn Network 
The settings for this are in the menu Obszar Appliance Settings in the section
Webserver
.
notemptyWsparcie dla certyfikatów z kluczem o długości poniżej 1024 bitów zostanie wycofane od wersji UTM 14.2.0
Połączenia HTTP-Proxy oraz SSL-VPN, które dotychczas używały powyższych, przestarzałych certyfikatów, przestaną funkcjonować od wersji v14.2.0!
Od wersji 14.2.1 zostanie również wycofane wsparcie dla certyfikatów z algorytmem podpisu SHA1.
Wbrew wcześniejszym zapowiedziom, zarówno połączenia HTTP-Proxy, jak i SSL-VPN wykorzystujące certyfikaty o długości klucza 1024 bitów będą nadal funkcjonować, pod warunkiem, że są one podpisane algorytmem SHA256.
Niebezpieczne certyfikaty należy pilnie wymienić!
BSI zaleca — stan na 01.2025 — długości kluczy od 3000 bitów i SHA256
BSI – Wytyczne techniczne — Metody kryptograficzne: Zalecenia i długości kluczy BSI TR-02102-1 | Rozdział 2.3: Szyfrowanie RSA
OpenVPN
Certyfikat serwera w roli serwera (Roadwarrior lub S2S) Certyfikat klienta dla S2S Jeśli dotyczy, certyfikat określony jako certyfikat klienta za pomocą atrybutu użytkownika (Uwierzytelnianie → Użytkownicy → Edytuj użytkownika)
Mailrelay
Przekazywanie "Certyfikatu" (pod szyfrowaniem TLS jako serwer)
Reverse-Proxy
Ustawienia → Certyfikat SSL
Webserver
Sieć → Ustawienia serwera → Serwer WWW → Certyfikat
HTTP-Proxy
Przechwytywanie SSL → Certyfikat CA
BSI zaleca — stan na 01.2025 — długości kluczy od 3000 bitów i SHA256
BSI – Wytyczne techniczne — Metody kryptograficzne: Zalecenia i długości kluczy BSI TR-02102-1 | Rozdział 2.3: Szyfrowanie RSA
Domyślne ustawienie UTM dla nowych certyfikatów to klucz RSA o długości 3072 bit oraz SHA256 jako algorytm hashujący
Pokaż dotknięte aplikacje
Ukryj dotknięte aplikacje
Klicken für dauerhafte Anzeige
- For https, the reverse proxy needs a certificate to accept the encrypted connection.
- For this, a certificate is used from
In this example, a wildcard certificate *.ttt-point.de is used.
Packet filter rule
For the reverse proxy to be reachable, the following packet filter rule must be in place. This can be checked under . If this is not present, will add this rule.
| # | Source | Destination | Service | NAT | Logging | Acion | Active | ||
 |
 internet |
 external-interface |
 https |
3/Min  |
Accept | Wł. |
notempty
If necessary, this packet filter rule must also be created using the 
http service.
http service.Use multiple IP addresses differently
notempty
If several public IP addresses are available, the ports of the different IP addresses can be used differently (e.g. for reverse proxy and VPN) .
For this, the rule of the reverse proxy must explicitly specify that the “external interface” of the specific IP should be used as the destination. For the other use, the traffic is redirected using DestNAT, i.e. the traffic arrives on port 443, but is then redirected to another port (e.g. 1194 for VPN) using a packet filter rule.
This can be helpful, as calls to certain ports from abroad are sometimes blocked. However, calls to port 443 are usually allowed
For this, the rule of the reverse proxy must explicitly specify that the “external interface” of the specific IP should be used as the destination. For the other use, the traffic is redirected using DestNAT, i.e. the traffic arrives on port 443, but is then redirected to another port (e.g. 1194 for VPN) using a packet filter rule.
Show specific rules for multiple IP addresses
ukryj
Klicken für dauerhafte Anzeige
| # | Source | Destination | Service | NAT | Logging | Acion | Active | ||
|
internet |
external-interface-ip3 |
openvpn-tcp |
DN Netzwerkobjekt: external-interface-ip1Dienst: https |
3/Min |
Accept | Wł. | ||
|
internet |
external-interface-ip2 |
https |
3/Min |
Accept | Wł. |
Setup wizard | |||
| Under with the button the wizzard can be opened in the Header. | |||
Step 1 - Internal | |||
| Opis | Wartość | Opis | UTMuser@firewall.name.fqdn Application Reverse-Proxy  Target server already exists as a network object
|
|---|---|---|---|
| Target Server: |
www.ttt-point.de | If the host has already been created as a network object, it can be notempty searched and selected directly in the drop-down menu.
Nowość od v14.2.0 | |
| Add network object | If no network object has been created yet, a network object can be created using this button. | ||
| Port: | 443 | The web server should be accessed via an encrypted connection. | |
| Use SSL: | Wł. | Specifies whether internal forwarding takes place in encrypted or unencrypted form. Servers configured for encryption therefore require encrypted internal forwarding as well | |
[ - ] Advanced settings notempty
These TLS settings apply to the connection between this appliance and the (local) server. For TLS settings between the clients and this appliance, the settings in the Obszar Reverse-Proxy dialog apply. | |||
| Use default TLS settings: | Yes | Allows connections with TLS 1.2 or 1.3 only | |
| Minimal TLS version: | The outdated TLS versions 1.1 and 1.0 can be selected. | ||
| Cipher-Suite: | Standardwert verwenden | Note that to directly use a OpenSSL security level, the notation @SECLEVEL=N can be used in the cipher string, where N represents the selected level from 0 to 5.
| |
Step 2 - External | |||
| External domain name: | www.ttt-point.de | Here you enter how the server behind the UTM is addressed. |
 Configuring external access so that the reverse proxy responds to requests
|
| Enable SNI: notempty Nowość od: 14.1.2 |
Wł. | Enables the passing on of Server Name Indication (SNI) to make multiple servers accessible under a single IP address With SNI, clients transmit the domain name of the requested server during the handshake itself. This allows the reverse proxy to use the correct certificate | |
Step 3 - External (Global) | |||
| Mode | Mode to be used |  | |
| Proxy-Port: | 80 | Port for the proxy of the corresponding server | |
| SSL-Proxy Port: | 443 | Port for the SSL proxy of the corresponding server | |
| SSL certificate: | The certificate that was selected in the step Preparations is selected here. notempty
| ||
Step 4 - Authentication | |||
| Forward authentication: | The proxy should not perform authentication The string can include URL escapes (i.e. %20 for spaces). This also means % must be written as %%. |
 No authentication!
| |
| Forwards the client's authentication headers to the remote station. Login data received from the UTM is sent to the reverse proxy. Authentication is not required for this option. | |||
| Proxy and authentication headers are forwarded unchanged. Sends the login data received from the client to the reverse proxy. Both proxy and WWW authorisation headers are forwarded to the remote peer without modification. | |||
| Login name | |||
| Password | |||
Server groups and Sites
| |||
notempty Server groups and Sites
Nowość od: 14.1.1 |
UTMuser@firewall.name.fqdn Application  Automatically created server group
| ||
Add server group | |||
The arrangement in server groups makes it possible to display different relationships in the reverse Proxy:
| |||
| Adds a new server group. The wizard automatically creates a server group. | |||
| General | |||
| Opis | Wartość | Opis | UTMuser@firewall.name.fqdn Application Reverse-Proxy 
|
|---|---|---|---|
| Name | Name of the server group (not editable) | ||
| Use SSL | No | Specifies whether internal forwarding takes place in encrypted or unencrypted form. Servers configured for encryption therefore require encrypted internal forwarding as well | |
| Authentication When using the ‘’squid‘’ engine, this is done individually for each server. | |||
| Forward authentication: | The proxy should not perform authentication The string can include URL escapes (i.e. %20 for spaces). This also means % must be written as %%. | ||
| Forwards the client's authentication headers to the remote station. Login data received from the UTM is sent to the reverse proxy. Authentication is not required for this option. | |||
| Proxy and authentication headers are forwarded unchanged. Sends the login data received from the client to the reverse proxy. Both proxy and WWW authorisation headers are forwarded to the remote peer without modification. | |||
| Login name: Only for Provide login data |
|||
| Password: Only for Provide login data |
|||
| Forward connection-oriented Microsoft authentication: notempty Nowość od v12.7.1 |
Enables support for NTLM, Negotiate and Kerberos | ||
| Server | |||
| A new server can be added using this button | UTMuser@firewall.name.fqdn Application Reverse-Proxy  Example with different TLS versions and cipher suites using the nginx engine
| ||
| Search field for the servers | |||
| Network | www.ttt-point.de | Name | |
| IP address | 10.1.0.150 | IP address of the webserver | |
| Port | 443 | Port via which the server is to be addressed | |
| TLS | Default @Sec Level=4 | TLS settings for this server | |
| Delete | Deletes the server from the reverse proxy server group | ||
| Edit | The server from the server group can be edited via this | ||
Add server | |||
| General | |||
| Network |
www.ttt-point.de | If the host has already been created as a network object, it can be notempty searched and selected directly in the drop-down menu.
Nowość od v14.2.0 |
UTMuser@firewall.name.fqdn Application Reverse-Proxy Add server group 
|
| Add network object | If no network object has been created yet, a network object can be created using this button. | ||
| Port | 80 | Port via which the server is to be addressed | |
Advanced settings notempty
These TLS settings apply to the connection between this appliance and the (local) server. For TLS settings between the clients and this appliance, the settings in the Obszar Reverse-Proxy dialog apply. | |||
| Use default TLS settings: | Yes | Allows connections with TLS 1.2 or 1.3 only | |
| Minimal TLS version: | The outdated TLS versions 1.1 and 1.0 can be selected. | ||
| Cipher-Suite: | Standardwert verwenden | Note that to directly use a OpenSSL security level, the notation @SECLEVEL=N can be used in the cipher string, where N represents the selected level from 0 to 5.
| |
Sites
| |||
| If a server group already exists, a site can be added using the button. notempty
New as of v14.1.1 If there are invalid configurations, these are provided with a warning (). When hovering over this warning, a short description of the problem is also shown.
UTMuser@firewall.name.fqdnApplicationUstawienia → Certyfikat SSL  ACL set without dst_dom* UTMuser@firewall.name.fqdnApplicationUstawienia → Certyfikat SSL  ACL set ‘’'with'‘’ '‘dst_dom*’' |
UTMuser@firewall.name.fqdn Application Reverse-Proxy Sites overview when using the nginx engine
| ||
Add site | |||
| Domain name: | www.ttt-point.de | This is where you enter how the server behind the UTM is addressed. | UTMuser@firewall.name.fqdn Application Reverse-Proxy  Edit sites when using the nginx engine
|
| Server group: | The associated server group is selected here | ||
| Client bandwidth: | 80 kbits/s | Maximum bandwidth that should be available to a client. The value 0 stands for an unlimited bandwith | |
| Load distribution: | The connections are processed one after the other. | ||
| A user's connections (hash on the user name) are always routed to the same server. | |||
| Connections from the same source (IP address) are always routed to the same server. | |||
| Redirect HTTP: Only with mode: |
Nie | When activated, HTTP requests are redirected to the HTTPS port | |
| Websockets: | off | Activates Websockets connections for the site WebSockets enable a server to send data to a client without a prior request from the client, because the connection remains open once the client has initiated it. | |
| Enable SNI: | Wł. | Enables the passing on of Server Name Indication (SNI) to make multiple servers accessible under a single IP address With SNI, clients transmit the domain name of the requested server during the handshake itself. This allows the reverse proxy to use the correct certificate | |
| Site-specific proxy port: | Wł. 80 Default: off |
Enables a specific port for HTTP connections in this site The value entered here overrides the default settings under Obszar Einstellungen | |
| Site-specific SSL proxy port: | Wł. 8443 Default: off |
Enables a specific port for HTTP connections in this site The value entered here overrides the default settings under Obszar Einstellungen | |
| Site-specific SSL certificate: | off | A site-specific server certificate can be selected The value entered here overrides the default settings under Obszar Einstellungen | |
| ACL Sets | Selection of an ACL set to be added | ||
| Add | Add selected ACL set | ||
Sites benötigen wenigstens ein ACL Set, in dem ein dstdomain oder dstdom_regex ACL vorhanden ist.
Dieses ACL Set muss der Site mit der Aktion zulassen zugeordnet sein und den Status Ein aktiviert haben. | |||
| Pos. | |
The order of the ACL sets can be customised using drag and drop. | |
| ACL Set | aclset-www.ttt-point.de | Name | |
| Acion | Configuration of whether the ACL set should be permitted or prohibited | ||
| Status | Wł. | Activation or deactivation of the configuration for the ACL set | |
| Delete | Deletes the entry for the ACL set | ||
Combination example | |||
| By combining different ACL sets with corresponding authorisations, it is possible, for example, to ensure that the login page of a server can only be accessed from a specific (e.g. your own) public IP address. | |||
UTMuser@firewall.name.fqdnApplicationReverse-Proxy  Combination example step 1 Firstly, an ACL is required for this, which contains the dstdomain and the public IP address as src. UTMuser@firewall.name.fqdnApplicationReverse-Proxy  Combination example step 2 An ACL is then required, which contains the path as urlpath_regex. UTMuser@firewall.name.fqdnApplicationReverse-Proxy  Combination example step 3 Finally, a site is set up where the first rule is allowed and the second rule is forbidden. | |||
ACL Sets
| Access rights can be assigned via ACLs. | |||
| ACLs | dstdomain: anyideas.deurlpath_regex: \/owa | Assigned ACL sets are displayed as labels. | UTMuser@firewall.name.fqdn Application  Overview ACL Sets
|
| dstdomain: anyideas.dedstdomain: ttt-point.deproto: HTTPS |
In the example on the left, both anyideas and ttt-point are accepted. However, in both cases, this applies only if the request is received via https | ||
| dstdom_regex: -i ttt-point\.de\/HOME | Case-insensitive regexes are represented with the parameter -i. notempty
Nowość od v14.1.0 | ||
| Edit | Opens the dialog for editing the ACL sets | ||
| Delete | Removes ACL-Sets | ||
| Opens the dialog to add ACL sets | |||
| Type | Opis | Example | UTMuser@firewall.name.fqdn Application Reverse-Proxy Add ACL Set  ACL-Set time  ACL Set urlpath_regex
|
|---|---|---|---|
| Regex for the target domain, e.g., if all subdomains are to be allowed | .*\ttt-point\.(de|com) | ||
| Specifies the domain/IP of the destination server. No regex expression can be specified here | www.ttt-point.de or IP address | ||
| Protocol | http, https | ||
| Filter on the header of the client The name of the header and the regex that matches the value of the header must be passed. |
Accept-Language en-US | ||
| Specifies the source IP of the client | 203.0.103.203 or 203.0.103.203/32 | ||
Only for squid engine |
Regex to the source domain The source domain is determined via a reverse IP lookup (using the client's IP address). |
anyideas | |
Only for squid engine |
Specifies the domain of the sender | anyideas.de or *.anyideas.de | |
| Defines a period of time during which the website can be accessed | M T W H F 9:00-17:00 Days of the Week ukryj Klicken für dauerhafte Anzeige S - Sunday
M - Monday | ||
| A regex expression that matches the path in the URL following the target domain. The path is a virtual route, and the folders are specified separated by / If there is no entry, any path in the URL is allowed |
\/owa matches ttt-point.de/owa The notation ^/owa is equivalent | ||
| Note upper and lower case: Tak notempty Nowość od v14.1.0 |
Configures whether regex arguments are handled case-sensitively | ||
| A check is being carried out to determine whether the entered argument is valid or not | |||
| Save and close dialog | |||
Options
| Opis | Wartość | Opis | UTMuser@firewall.name.fqdn Application  Setting when using the nginx engine
|
|---|---|---|---|
| Engine: notempty Nowość od v12.7.0 |
Selection of the engine to be used between nginx (recommended) or squid (deprecated) | ||
| Mode: | Mode to be used | ||
| Proxy-Port: | 80 | Port for the proxy of the corresponding server | |
| SSL-Proxy Port: | 8443 | Port for the SSL proxy of the corresponding server | |
| SSL certificate: Only certificates with a private key part can be selected |
Certificate for the corresponding server notempty
| ||
| Websocket Timeout: notempty Nowość od v12.7.0 |
60 | Defines the time for a websocket timeout | |
Activate certificate-based authenticationActivate certificate-based authentication
notempty
zaktualizowano | |||
| SSL-CA: | Certificate for certificate-based authentication notempty
| ||
Import of personal certificates
notempty
New in the wiki
In order for the Enable certificate-based authentication function to be used correctly, the personal certificate must be available in the browser used.
Import into the Windows certificate store (here, for Edge)
ukryj
Klicken für dauerhafte Anzeige
Fig.1
Open the folder with the certificate file and click on the file.
Fig.2
In the certificate import wizard, select the "Current User" option and confirm with "Next".
Fig.3
The certificate file to be imported is displayed in the File name input field. Click "Next" to start the next dialogue window.
Fig.4
The "Password" input field expects the same password that was assigned when the certificate file was downloaded. It is advisable to select the "Mark this key as exportable" and "Include all extended properties" radio buttons in case the personal certificate is to be exported from the browser later. Finally, the "Next" button is selected.
Fig.5
In the next step of the certificate import wizard, the option "Automatically select the certificate store ..." is set and confirmed with "Next".
Fig.6
The "Certificate Import Wizard" displays a summary of the settings made. The import of the personal certificate is carried out via "Finish".
Fig.7
The import process was successful.
Firefox - Import personal certificate (Ubuntu)
ukryj
Klicken für dauerhafte Anzeige
Fig.1
The top Settings is selected from the application menu.
Fig.2
Select the "Data protection & security" category from the left-hand side of the window. In the right-hand window area, go to "Certificates". The "Show certificates ..." button can be selected there.
Fig.3
In the certificate management, switch to the "Your certificates" tab. The list is currently empty as no personal certificates have been imported yet. Now select the "Import" button.
Fig.4
Select the certificate file and click the "Open" button to start the import dialogue.
Fig.5
The "Password" input field expects the same password that was assigned when the certificate file was downloaded.
Fig.6
The imported personal certificate is now displayed on the index card in the certificate management. Click "OK" to close the certificate management.
Chrome - Import personal certificate (Ubuntu)
ukryj
Klicken für dauerhafte Anzeige
Fig.1
The top "Settings" is selected from the application menu.
Fig.2
The "Data protection & security" category is selected from the left-hand window area.
Fig.3
Scroll down to the "Advanced" section and select "Manage certificates".
Fig.4
Select the "Import" button.
Fig.5
Select the certificate file and click the "Open" button to start the import dialogue.
Fig.6
The "Password" input field expects the same password that was assigned when the certificate file was downloaded. Confirm with "Ok".
Fig.7
The certificate is now displayed and the process is complete.