Key considerations of network settings in Reverse Proxy mode
1. Network Interfaces
FortiWeb requires at least two interfaces:
-
WAN (External) Interface:
-
Role: Receives client traffic from the internet.
-
IP Address: Assign a public IP (e.g., 20.0.2.1) or use a NAT rule if behind a firewall.
-
-
LAN (Internal) Interface:
-
Role: Connects to backend web servers.
-
IP Address: Assign a private IP (e.g., 192.0.2.1).
-
Related configuration guides:
2. SSL/TLS Configuration (If Using HTTPS)
In the Reserve Proxy mode FortiWeb acts as an SSL proxy. It terminates the HTTPS connection from the client and presents a server certificate to prove its authority for your application domain.
After decrypting and inspecting the traffic, FortiWeb establishes a new connection to the back-end server, which can be either encrypted (HTTPS) or unencrypted (HTTP), depending on the configuration between FortiWeb and the server. This back-end connection is entirely independent of the front-end connection.
Because FortiWeb handles the SSL handshake with the client, you must upload your CA-signed server certificate to FortiWeb so it can present it on behalf of your application and validate the domain’s authenticity.
Related configuration guides:
3. Client IPs in Reverse Proxy mode
In Reverse Proxy Mode, FortiWeb terminates the client session and then establishes a new session with the back-end web server. As a result:
-
The web server does not see the real IP address of the client.
-
Instead, it sees FortiWeb’s IP address as the source of incoming requests.
Since some web applications need the real client IP (e.g., for rate limiting, logging, or geographical analysis), FortiWeb allows you to insert or append the client’s original IP into an HTTP header X-Forwarded-For (XFF).
This resolves the issue, as most modern web servers (e.g., Apache, Nginx, IIS) can be configured to trust the X-Forwarded-For header and use it instead of the direct source IP. For details on configuring these headers, see Indicating the original client’s IP to back-end web servers.
However, if the web server cannot process HTTP headers to extract the real client IP, consider enabling Client Real IP in FortiWeb's server policy. This allows FortiWeb to use the client's IP as the source IP for its connection with the backend server. Proper network configuration is required to ensure the responses are routed back through FortiWeb and further to the correct next-hop gateway. Failure to do so may result in application inaccessibility. For more details, see the description of the Client Real IP option in Configuring an HTTP server policy.
4. DNS Configuration
Update your domain’s DNS record (A/AAAA) to point to FortiWeb’s WAN IP (e.g., 20.0.2.1).
5. Back-end Server Configuration
-
Firewall Rules: Allow traffic only from FortiWeb’s LAN IP (e.g., 192.0.2.1).
-
Web Server Settings: Disable direct public access (ensure traffic flows only through FortiWeb).