Eddie Eddie - 1 year ago 75
Apache Configuration Question

Is http redirecting to https getting blocked by a firewall?

So on our application servers are behind a network firewall, and we have all ports closed and we only open them if used. We have a php application that is working when you go to https://myapp.mydomain.com and the port 443 is on the white list.

We enter http://myapp.mydomain.com and it does not allow us through. On a different server we have the same configs with an open firewall, and the redirect works. My question is, how does the traffic actually work?

I'm thinking it works like this. . .
Traffic comes from client server to port 80 on the application server. The apache configuration changes to call and routes that traffic from 80 to 443 (not going through the network firewall again because it is already on the machine).

But if we are blocking traffic on port 80 coming to the application server, would that then block the redirect? (really before it has the ability to make the redirect).

Answer Source

When you load a webpage over http://, the browser will send a request to the server on port 80. Always.

If the webpage wants to be HTTPS-only, the server would send an HTTP redirect response telling the browser to redirect to https://... (which will make the browser send a new request).

If you want to accept any kind of request over http://, you must open port 80.