Application Proxies SOCKS Proxies

There are two basic types of proxy servers: Application proxies — perform work for users 1. SOCKS proxies — cross−wire ports between clients and targeted servers 2.

25.2.3.1 Application Proxies

This is the proxy type we have already discussed. It automates the process of connecting an intranet client to the outside world, i.e., an Internet server. Everything happens via an application proxy server, which also performs needed logging and optional filtering. Application proxy servers can also authenticate users. Before the connection is made, the proxy server can ask the user to log in first. To a Web user this would make each site look like it required a login.

25.2.3.2 SOCKS Proxies

SOCKS proxies cross−wire users internal connection to another outside connection. They simply act as a switchboard for the incoming and outgoing connections. SOCKS is a generic proxy protocol for TCPIP−based networking applications. It includes two more components in the connection picture: the SOCKS server and the SOCKS client. This is presened in Figure 25.8. Figure 25.8: SOCKS proxy protocol. When an application client needs to connect to an application server, the client connects to a SOCKS proxy server. The SOCKS proxy server connects to the application server on behalf of the client and relays data between the application client and the application server. For the application server, the SOCKS proxy server is the client. The SOCKS protocol performs multiple functions: Makes connection requests • Sets up proxy circuit • 638 Optionally authenticates the users • SOCKS was originally intended as a network firewall. Because of its simplicity and flexibility, SOCKS has been used as a generic application proxy, in virtual private networks VPNs, and for extranet applications. SOCKS offers unique features and benefits: Application−independent protection — as soon as new applications appears, SOCKS can protect them without need for any additional development. • Flexible protection through a variety of access control policies based on user, application, and time criteria, in addition to source and destination addresses. • Bidirectional proxy support — SOCKS identifies communication target through domain names, overriding the restriction of using the private IP addresses. SOCKS can use domain names to establish bidirectional communication between separate LANS with overlapping IP addresses. • Other IP−layer based proxy mechanisms, like the network address translation NAT, support only unidirectional connections, from the private network the intranet toward the external network the Internet. For some applications, like multimedia applications, it simply cannot work; these applications request the return data channel.

25.2.4 Web Services