PTC web-based products support users logging in to sites from within and outside the firewall. With users logging in to PTC products from outside the firewall, PTC can help you minimize the risk to your infrastructure from intruders. One way to allow outside enterprise resources access to the enterprise web-based applications supplied by PTC is by using a reverse proxy configuration.

The following sections explain the basics of how to architect and configure various solutions but also how to configure them. Not all of the possible configurations are documented. Use the sections to educate yourself, and then apply what you have learned to your situation.

A reverse proxy is a special deployment case of a proxy server. In a reverse proxy, the reverse proxy server can be located in the following locations:

A reverse proxy deployment allows you to expose specific content provided by a web server without actually exposing the web server to the client.

In a reverse proxy, the proxy server functions like a web server with respect to the clients it services. Unlike internal clients, external clients are not reconfigured to access the proxy server. Instead, the site URL routes the client to the proxy as if it were a web server. Replicated content is delivered from the proxy cache to the external client without exposing the original server or the private network residing safely behind the firewall.

The following diagram displays some of the basic components of a reverse proxy configuration. In this diagram, the proxy server is between two firewalls:

This type of configuration is a basic configuration. The area between the two firewalls is known as a demilitarized zone (DMZ). If someone takes control of the proxy server, the person does not have control of the application server nor does the person know the location of the application server. Notice the firewall between the client systems and the proxy server, and between the proxy server and the web server. This second firewall makes this is a very secure environment.

Setting up your environment to use a reverse proxy server involves the use of two host machines:

There are unique tasks to complete on each host:

Additionally, you can set up the reverse proxy server for secure access using HTTPS as described in the section Using HTTPS with a Reverse Proxy Server.

The Windchill host name should resolve to the reverse proxy server for clients that are required to access through the reverse proxy. To generate outgoing Windchill URLs referencing the reverse proxy server, you must set the following properties in the wt.properties file. These properties map the Windchill server codebase to the reverse proxy codebase:

Assume the following statements are true:

Then, the wt.properties properties to set using the xconfmanager utility are as follows:

The ports set in the servlet declaration for the JavaRMIServlet in the web.xml file (located in the WEB_INF subdirectory of the codebase directory) are automatically handled by using a port range. The usage of the range starts with the lowest of the values and continues to the highest of the values. The values are stored in the following properties that are in the wt properties file:

To change the range, set the properties using the xconfmanager utility.

The defaults for minPort and maxPort are 5002 and 5011:

This section is intended to provide a reverse proxy example that has minimal details on configuring an Apache httpd server. PTC does not endorse or support any particular reverse proxy product. Each reverse proxy implementation has its own requirements that need to be evaluated by system and network administrators.

Remove the comment characters from the following lines in the httpd.conf file:

Add following lines at the end of the httpd.conf file (some lines have been split to fit the width of the page):

Where the values for <web_app_name> and <Windchill_host_name> are the same values you entered in the section Updating wt.properties on the Windchill Host.

Typical use of a reverse proxy server requires all incoming traffic to be HTTPS. An HTTPS reverse proxy server may be used to proxy to an HTTP web server for Windchill using the same configuration steps as documented previously. However, any reference to the reverse proxy server URL needs to reference the HTTPS protocol and proper port instead of the HTTP protocol. If external users are required to use HTTPS while internal users are allowed to use HTTP, then dual Windchill servers should be used, one configured with HTTPS URLs and the other with HTTP URLs. For more information about HTTPS URLs and HTTP URLs, see Dual HTTP and HTTPS Protocol Systems.