Cyberspace Proxies

When you connect your company to the Internet, you may well be extending your corporate LAN--and all its confidential information--to an electronic world full of hackers, spies, and saboteurs. Before plugging in, make sure you're protected (see "Barricading the Net," April BYTE).

One effective approach lies in not letting the Internet see your network. One method of achieving this--and still maintaining Internet access for your users--is a proxy server, a system or process that hides the location of the real client applications by handling Internet communications in place of the clients. Acting as an intermediary, it is both a server to the real client and a client to the real application server. An example will help illustrate a p roxy's role.

A popular Internet-based client/server application is WWW (World Wide Web) browsing. The client is the WWW browser residing on your workstation. The server is some unknown process somewhere out in cyberspace. All that is known about the WWW server is that it has a valid URL (uniform resource locator), such as http://happy.hacker.org , for example, and that it can carry on the protocol responsibilities of HTTP.

If you connect directly to the Internet through a router, the server immediately knows your IP address, and it may be able to gain greater control over it. But if an intermediate process (the proxy) on a secure system is acting as the client, the server will see only the proxy server. Typically, the proxy server is the only address the Internet can see. The protected LAN hides behind that one address, usually in a separate network domain.

Unfortunately, ordinary client software won't work in such a scheme. You need versions that can talk through a proxy rather t han directly to the server. The Netscape WWW browser is a good example. It can talk directly to a server, but it also has options for talking to various proxy agents.

Sun's Netra can run proxy services, although this is one of the elements the VAR must add. Because Instant Internet acts as an TCP/IP-to-IPX gateway, it is by nature a proxy server for the TCP/IP sessions of its clients. The outside world sees only the Instant Internet unit; all transactions with the outside world are connected to its single IP address. The NetWare PC clients don't need IP addresses because they can carry on a sockets connection to the outside world through the guise of Instant Internet.

Proxy servers are only one wall of protection. Firewalls (e.g., CheckPoint Software Technologies' FireWall-1, optional for Netra) are another. If you are really concerned about security, your Internet access plan might include both an Instant Internet, for the convenient Internet access it allows IPX clients, and a Netra running a firewall and proxy agent processes for maximum security.