Access InTouch Web Client from outside the OT network

A reverse proxy is a server that is positioned in front of one or more web servers, intercepting requests from clients. With a reverse proxy, when clients send requests to the origin server of a website, those requests are intercepted at the network edge by the reverse proxy server. The reverse proxy server will then send requests to and receive responses from the origin server. If any of these web servers are down or in case of the fail-over of one of these web servers, then the reverse proxy will send the requests from clients to the redundant web server.

A forward proxy is positioned in front of a client and ensures that no origin server ever communicates directly with that specific client. On the other hand, a reverse proxy sits in front of an origin server and ensures that no client ever communicates directly with that origin server.

Before devices outside the OT network can access the InTouch Web Client, a reverse proxy must be configured on the DMZ server. For more information, see AVEVA DMZ Secure Link. AVEVA Identity Manager must be enabled for the reverse proxy to function. There are many providers of reverse proxy solutions. Refer to the relevant reverse proxy solution documentation, the information on redundancy support and instructions on setting up the reverse proxy solution in your infrastructure.

Reverse proxy configuration requirements

The reverse proxy must include the X-Forwarded-For HTTP header in all forwarded requests.

The Web Client services use this header to identify the original client IP address, which is required for license session calculation and management.

If the required header is missing, the request will not be processed and an error will be logged in the Logger. When using a reverse proxy such as NGINX, ensure that the X-Forwarded-For header is configured and forwarded with every request to the InTouch Web Client services.

The following NGINX configuration example shows how to add the X-Forwarded-For header.

proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;