Protection of pia-back

[scottbisker]

It would be nice from an OPSEC standpoint to have the pia front-end service communicate directly with the back-end without utilizing the web browser client. Currently, when configuring the remote server, the web browser communicates directly with the pia-back instance.

From an OPSEC standpoint, it makes it difficult to secure the pia-back instance. If the communication was done between pia and pia-back within a single machine or between 2 machines within the same network, protections could be put in place to prevent communication directly with the back-end server. Additionally, a reverse proxy could be configured to communicate only with the Front-End components of PIA.

As it is now, Firewall rules need to permit access to both PIA and PIA-BACK ports.

This is very similar to setting up an NGINX or HAPROXY instances that servers HTTPS traffic and then forwarding that traffic to an origin host.