Linux install and configure pound reverse proxy for Apache http / https web server

Posted on in Categories , , , , , last updated December 13, 2007

Q. How do I install and configure pound reverse proxy for Apache web sever under Debian Linux?

A. Pound is a reverse-proxy load balancing server. It accepts requests from HTTP / HTTPS clients and distributes them to one or more Web servers. The HTTPS requests are decrypted and passed to the back-ends as plain HTTP. It will act as:
a) Server load balancer
b) Reverse proxy server
c) Apache reverse proxy etc
d) It can detects when a backend server fails or recovers, and bases its load balancing decisions on this information: if a backend server fails, it will not receive requests until it recovers
e) It can decrypts https requests to http ones
f) Rejects incorrect requests
h) It can be used in a chroot environment (security feature)

If more than one back-end server is defined, Pound chooses one of them randomly, based on defined priorities. By default, Pound keeps track of associations between clients and back-end servers (sessions).

Install Pound Software

Type the following command to install pound:
$ sudo apt-get install pound
If you are using RHEL / CentOS, grab pound rpm here and type the command:
# rpm -ivh pound*
If you are using FreeBSD, enter:
# cd /usr/ports/www/pound/ && make install clean

How it works?

  • Let us assume your public IP address 202.54.1.5.
  • Pound will run on 202.54.1.5 port 80
  • It will forward all incoming http requests to internal host 192.168.1.5 and 192.168.1.10 port 80 or 443
  • Pound keeps track of associations between clients and back-end servers

Pound configuration file

  • Under Debian / Ubuntu default file located at /etc/pound/pound.cfg
  • Under FreeBSD it is located at /usr/local/etc/pound.cfg (you need to create this file)
  • Under RHEL / CentOS you need to create file at /etc/pound.cfg

Sample configuration: HTTP Proxy

Forward all incoming request at 202.54.1.5 port 80 request to 192.168.1.5 Apache server running at 8080 port:
Open /etc/pound/pound.cfg file:
# vi /etc/pound/pound.cfg
To translate HTTP requests to a local internal HTTP server, enter (make sure 192.168.1.5 Apache running listing on port 8080):

ListenHTTP
         Address 202.54.1.5
         Port    80
         Service
                  BackEnd
                       Address 192.168.1.5
                       Port    8080
                  End
          End
End

Save and close the file. Restart pound:
# /etc/init.d/pound restart

Following example will distribute the all HTTP/HTTPS requests to two Web servers:

ListenHTTP
          Address 202.54.1.5
          Port    80
End

ListenHTTPS
         Address 202.54.1.5
         Port    443
         Cert    "/etc/ssl/local.server.pem"
End
Service
                  BackEnd
                      Address 192.168.1.5
                      Port    80
                  End
                  BackEnd
                      Address 192.168.1.6
                      Port    80
                  End
End

For testing purpose you may generate self signed ssl certificate (/etc/ssl/local.server.pem), by entering the following command:
# cd /etc/ssl && openssl req -x509 -newkey rsa:1024 -keyout local.server.pem -out local.server.pem -days 365 -nodes

Pound log file

By default pound log message using syslog:
# tail -f /var/log/messages
# grep pound /var/log/messages

Sample complete configuration file

## Minimal sample pound.cfg
######################################################################
## global options:
User		"www-data"
Group		"www-data"
#RootJail	"/chroot/pound"
## Logging: (goes to syslog by default)
##	0	no logging
##	1	normal
##	2	extended
##	3	Apache-style (common log format)
LogLevel	1
## check backend every X secs:
Alive		30
## use hardware-accelleration card supported by openssl(1):
#SSLEngine	""

######################################################################
## listen, redirect and ... to:
# Here is a more complex example: assume your static images (GIF/JPEG) are to be served from  a  single  back-end  192.168.0.10.  In
#       addition,  192.168.0.11  is  to  do  the  hosting for www.myserver.com with URL-based sessions, and 192.168.0.20 (a 1GHz PIII) and
#       192.168.0.21 (800Mhz Duron) are for all other requests (cookie-based sessions).  The logging will be done by the back-end servers.
#       The configuration file may look like this:
              # Main listening ports
              ListenHTTP
                  Address 202.54.1.10
                  Port    80
                  Client  10
              End
              ListenHTTPS
                  Address 202.54.1.10
                  Port    443
                  Cert    "/etc/pound/pound.pem"
                  Client  20
              End

              # Image server
              Service
                  URL ".*.(jpg|gif)"
                  BackEnd
                      Address 192.168.1.10
                      Port    80
                  End
              End
             # Virtual host www.myserver.com
              Service
                  URL         ".*sessid=.*"
                  HeadRequire "Host:.*www.nixcraft.com.*"
                  BackEnd
                      Address 192.168.1.11
                      Port    80
                  End
                  Session
                      Type    PARM
                      ID      "sessid"
                      TTL     120
                  End
              End

              # Everybody else
              Service
                  BackEnd
                      Address 192.168.1.20
                      Port    80
                      Priority 5
                  End
                  BackEnd
                      Address 192.168.1.21
                      Port    80
                      Priority 4
                  End
                  Session
                      Type    COOKIE
                      ID      "userid"
                      TTL     180
                  End
              End

Suggested readings:

=> Pound project
=> Man pages : pound and poundctl

Posted by: Vivek Gite

The author is the creator of nixCraft and a seasoned sysadmin, DevOps engineer, and a trainer for the Linux operating system/Unix shell scripting. Get the latest tutorials on SysAdmin, Linux/Unix and open source topics via RSS/XML feed or weekly email newsletter.

Share this on (or read 23 comments/add one below):

23 comment

  3. I would highly suggest pound or lighttpd as a reverse proxy. As of version 2.4e, Pound is extremely fast and stable. Lighttpd did have some problems in the past and most of those have been fixed. Memeory managment has been greatly improved. I have to agree about the documentation, but there are examples like the following to help everyone out:

    Pound Reverse Proxy “how “to”
    http://calomel.org/pound.html

    Light webserver “how to”
    http://calomel.org/lighttpd.html

  7. i have a linux system white box loaded. tell me how to configure its lan card for internet connection while server proxy address= 192.168.10.1
    port : 6080

  8. I am extremely happy to have a tutorial like this. Until Recently, I had no idea what a Reverse Proxy was and this really helped me to understand it.

    Thanks! and keep up all the great work!

  9. HI Folks,

    I have a deadline and the time is ticking. i am setting up pound as a reverser proxy for a site that runs on port 8080. I m trying to run pound on 80 and direct all the traffic to port 8080. i have pound up and running and the redirect happens fine just that when it redirects it gives me this error
    “The service is not available. Please try again later”
    i believe i need to add some directive under the pound.cfg fine but not sure what. this is what i have for pound.cfg

    User        "pound"
Group       "pound"
LogFacility daemon
LogLevel    4
Alive       30
Client      10
TimeOut     10
Grace       10

ListenHTTP
   Address    0.0.0.0
   CheckURL   "(^\/|\.html|\.css|\.jpg|favicon\.ico|robots\.txt|\.png)$"
   HeadRemove "X-Forwarded-For"
   MaxRequest 1024
   Port       80
   xHTTP      0

  # Err414 "/var/www/htdocs/error/generic_error_page"
  # Err500 "/var/www/htdocs/error/generic_error_page"
  # Err501 "/var/www/htdocs/error/generic_error_page"
  # Err503 "/var/www/htdocs/error/generic_error_page"

Service
                  URL         ".*sessid=.*"
                  HeadRequire "Host:.*web249.solutionset.com.*"
      BackEnd
         Address  127.0.0.1
         Port     8080
      End
      Emergency
       Address    127.0.0.1
       Port       8888
      End
   End
End

    i am very new to pound so any help would be really appreciated. Thank you

  10. Guys,

    First I must say thank you for making reverse proxy so easy to configure and making techs life easy. I am running Pound 2.4.3 on RHEL5 server. I have three websites each running on separate webserver in internal network. I would like to reverse proxy them via one Pound server in DMZ. All three websites require secure connections for client and I like to install the certificates on the pound server for them. I have assigned three IPs on the pound server, one for each website. But these sites are not working. Below is my configuration.

       ListenHTTP
         Address 202.168.1.1
         Port    80
         Service
         Redirect "https://www.abc.com"
          End
End

ListenHTTPS
         Address 202.168.1.1
         Port    443
         Cert    "/usr/local/openssl/local.server.pem"
End
                  Service
                  BackEnd
                      Address 172.17.1.1
                      Port    80
                  End

End


ListenHTTP
         Address 202.168.2.2
         Port    80
         Service
         Redirect "https://www.def.com"
           End
End

ListenHTTPS
         Address 202.168.2.2
         Port    443
         Cert    "/usr/local/openssl/local1.server.pem"
End
                  Service
                  BackEnd
                      Address 172.17.2.2
                      Port    80
                  End


End


ListenHTTP
         Address 202.168.3.3
         Port    80
         Service
         Redirect "https://www.ghi.com"
           End
End

ListenHTTPS
         Address 202.168.3.3
         Port    443
         Cert    "/usr/local/openssl/local2.server.pem"
End
                  Service
                  BackEnd
                      Address 172.17.3.3
                      Port    80
                  End

End

    I am redirecting HTTP requests to HTTPS as I would only like to serve clients on secure channel. This works fine if I run each website on a separate pound server but I like to have them on one reverse proxy server. I will really appreciate if you can provide me any help in this regard. If it is not possible with this configuration is there any way to achieve this on a single pound server.

    Thanks,
    Farhan

  12. How to run pound in HA mode, and running it parallel so that both the servers can share session (In case if one is down) and how to maintain the sticky session in pound.

    Thanks in Advance
    —
    Kunal

  13. I am beating around the bush for more than 4 days. I am a newbie for Linux. My management given me the deadline for setting Pound. If anybody please please help me out. I installed as listed. I installed CentOS 5 and installed Pound. Well it’s not forwarding the requests to the internal webservers. Kindly give the instructions.

  14. we cannot seem to edit our pound.cfg file

    its none wrieable and we cannot chmode it either

    does anyone have any ideas how we can make this file writable ?

  17. Hi,
    How about the gateway of the back-end servers, do I point it to the Pound as gateway and configure Pound as transparent

  18. So can data on any port be sent to the BackEnd? And how would it be setup? Would it be done like this for other ports?

    Service
    HeadRequire “Host:.*domain.com.*”
    BackEnd
    Address 192.168.1.201
    Port 80
    Port 1812
    Port 1813

    End

  19. or would it be in the Listen group also?:
    ListenHTTP
    Address 192.168.1.150
    Port 80
    Port 1812
    Port 1813
    End

  20. hi

    right config, Be sure your apache or any other service on particular machine does not use port 80.

  21. Hi,
    This is an Excellent Website..
    I searched a lot about this topic, and found today!!!
    Can any one please clarify my doubt?
    Does pound supports dynamic configuration reload like
    NGINX ?(Restarting master process alone will reload the configuration file)
    I am required to do this.
    —
    Thanks in advance,
    Sri

  22. I am new to reverse proxy using Pound, I would like to know how the Client Http request & response data flow in a scenarios as below:

    # Let assume our Server public ip is 202.54.1.5.
    # Pound will run on 202.54.1.5 port 80 . Let us call this Pound Server.
    # A Http-Request-A from a Client (Internet Browser) came into the Pound Server
    # Pound Server will forward the Http-Request-A to list of internal Hosts eg. 192.168.1.11, 192.168.1.12, …. all on port 80. Let say, it pick the Host-192.168.1.11
    # After the Host-192.168.1.11 process it, how does the Http-Response -A flow back to that Client (Internet Browser) ?
    – Does it flow back DIRECTLY to that Client without going through the Pound Server ?
    OR
    – Does it flow back first to the Pound Server and then to that Client ?

    I just want to investigate if there is some network bandwidth toll (incoming & outgoing) at the Pound Server which is used as a load balancer in a Cloud environment since Cloud eg.Amazon or Azure charge for incoming as well as outgoing data transfer. All I want is just the load balancing features using Pound Server inside a high availability nature of the Cloud.

    Anyone, pls help. Thank a lot in advance .

  23. HI,

    We are currently using apache as proxy server and redirecting all request innto our webserver. The problem we have is that our webserver only sees the internal IP address of the apache proxy server. We would like to see the original IP address of the incoming request. Is this possible with POUND?

    Have a question? Post it on our forum!

Tagged as: Tags , , , , , , , , ,