Skip to main content

Introduction to RBI Proxy

SOFTCAMP SHIELDGate Isolation Browser Integration for HTTP/HTTPS Proxy Service

📋 Table of Contents​

  1. Overview
  2. What is RBIProxy?
  3. Overall Architecture
  4. Main Components
  5. Operating Principle
  6. PAC file configuration
  7. Security Mechanism
  8. REST API
  9. Technology Stack
  10. Use Cases

Overview​

RBIProxyis the user's general browser trafficSOFTCAMP SHIELDGate Isolated BrowserThis is an intermediate proxy server that automatically connects.

Users browse the web as usual, but all web access is executed in a remote browser isolation (RBI) environment, safely protecting them from security threats.

Core Values​

  • Transparent Security: Enhancing security without compromising user experience (automatic redirect)
  • Centralized Control: Centralized control of all web traffic with a single proxy
  • Simple Relay Structure: Perform URL conversion and SHIELDGate integration only (complex policies are handled by SHIELDGate)

What is RBIProxy?​

RBI (Remote Browser Isolation)​

Remote Browser IsolationTechnology is a security solution that executes the user's web browsing in a physically isolated remote environment.

Traditional web access:
[User PC] ──→ [Internet Website]
         ↑
    Malware download risk
    Exposure to zero-day attacks
    Direct access to phishing sites

After applying RBI:
[User PC] ──→ [Isolated Browser] ──→ [Internet Website]
                      ↑
                Malware runs only in the isolated environment
                User PC is safe

Role of RBIProxy​

RBIProxy isA relay that converts traffic that has passed through PAC filtering to SHIELDGateis:

🎯 Filtering Structure​

┌──────────────────────────────────────────────────────────────┐
│              PAC file (executed on user PC)                 │
│              "Which sites go through a proxy, and which ones are direct?" │
└────────────┬─────────────────────────────┬───────────────────┘
             ↓                             ↓
      [Allowed Sites]                   [Blocked Sites]
      naver.com                       example.com
      microsoft.com                   unknown-site.com
      Internal IP (192.168.x.x)           All other sites
             ↓                             ↓
      DIRECT (no proxy)         PROXY 10.14.10.176:9999
             ↓                             ↓
      [Direct Access]              ┌─────────────────────────────┐
                               │  RBIProxy Server               │
                               │  "URL Converter"               │
                               └──────┬──────────────────────┘
                                      ↓
                               Perform URL conversion
                                      ↓
                   https://shieldgate.SOFTCAMP.co.kr/
                   gate-proxy?currentTab=true&url=OriginalURL
                                      ↓
                               HTML redirect response
                                      ↓
                          ┌───────────────────────┐
                          │  User's browser       │
                          │  automatically moves   │
                          └──────┬────────────────┘
                                 ↓
                          ┌─────────────────┐
                          │  SHIELDGate     │
                          │  gate-proxy     │
                          └──────┬──────────┘
                                 ↓
                          ┌─────────────────┐
                          │  rb-app         │
                          │  (Isolated Browser) │
                          └──────┬──────────┘
                                 ↓
                          [Accessing the Actual Website]

Specific Example​

Example 1: Access naver.com (Allowed Site)

[User] naver.com input  
    ↓  
[PAC file] "naver.com? Oh? You are allowed!"  
    ↓  
[Decision] "Then you are DIRECT"  
    ↓  
[Result] Direct access to naver.com ✅ (No interruption by RBIProxy)

Example 2: Accessing example.com (Blocked Site)

[User] example.com input
    ↓
[PAC file] "example.com? not in the allow list"
    ↓
[Decision] "You are sent to RBIProxy"
    ↓
[RBIProxy] URL transformation
  Original: http://example.com
  →
  Transformed: https://shieldgate.SOFTCAMP.co.kr/gate-proxy?currentTab=true&url=http://example.com
    ↓
[HTML redirect response]
  <meta http-equiv="refresh" content="0;url=transformedURL"/>
    ↓
[User browser] automatically redirects to SHIELDGate URL
    ↓
[SHIELDGate] gate-proxy runs rb-app (isolated browser)
    ↓
[rb-app] accesses example.com in an isolated environment
    ↓
[Result] User accesses example.com with the isolated browser ✅

Overall Architecture​

Simplified Flowchart​

┌─────────────────────┐
│   User PC           │
│  (General Browser)  │
│  Chrome / Edge etc. │
└──────────┬──────────┘
           │
           │ ① Windows Proxy Settings (PAC)
           │    - Allowed Sites → DIRECT
           │    - Blocked Sites → PROXY 10.14.10.176:9999
           ↓
┌─────────────────────┐
│   RBIProxy Server    │
│   (This Project)     │
│   - URL Transformation│
└──────────┬──────────┘
           │
           │ ② HTML Redirect
           │    shieldgate.SOFTCAMP.co.kr/
           │    gate-proxy?currentTab=true&url=OriginalURL
           ↓
┌─────────────────────┐
│  SHIELDGate         │
│  (Isolated Browser)  │
│  - gate-proxy       │
└──────────┬──────────┘
           │
           │ ③ rb-app Execution
           ↓
┌─────────────────────┐
│  rb-app             │
│  (Isolated Browser)  │
└──────────┬──────────┘
           │
           │ ④ Access Actual Website
           ↓
┌─────────────────────┐
│   Internet Website   │
│   example.com etc.   │
└─────────────────────┘
       ↓

┌─────────────────────┐
│ Internet Website │
│ example.com etc │
└─────────────────────┘

### Detailed Data Flow

**Important**: The PAC file performs the primary filtering!

┌─────────────────────────────────────────────────────────────────┐
│ User PC │
│ │
│ [Chrome/Edge] User enters URL │
│ ↓ │
│ ┌─────────────────────────────────────────────┐ │
│ │ PAC file (filtering) │ │
│ │ "Where should I send this site?" │ │
│ └──────────┬──────────────────────────────────┘ │
│ │ │
│ ┌──────┴───────┐ │
│ ↓ ↓ │
│ [Allowed Sites] [Blocked Targets] │
│ naver.com example.com │
│ ↓ ↓ │
│ DIRECT PROXY 10.14.10.176:9999 │
│ │
└──────┼──────────────┼──────────────────────────────────────────┘
│ │
↓ │ Delivered to RBIProxy
[naver.com] ↓
Direct Access ┌─────────────────────────────────────────────────────────────────┐
│ RBIProxy Server │
│ (URL Converter) │
│ │
│ ┌──────────────────────────────────────────────────────────┐ │
│ │ 1. Request Reception (Port 9999) │ │
│ └──────────────────┬───────────────────────────────────────┘ │
│ │ │
│ ┌──────────────────▼───────────────────────────────────────┐ │
│ │ 2. URL Conversion │ │
│ │ Original:http://example.com │ │
│ │ → │ │
│ │ Conversion:https://shieldgate.softcamp.co.kr/ │ │
│ │ gate-proxy?currentTab=true&url=http://example.com│ │
│ └──────────────────┬───────────────────────────────────────┘ │
│ │ │
│ ┌──────────────────▼───────────────────────────────────────┐ │
│ │ 3. HTML Redirect Response │ │
│ │ │ │
│ └──────────────────┬───────────────────────────────────────┘ │
│ │ │
└─────────────────────┼────────────────────────────────────────────┘
│
↓
┌─────────────────────────────┐
│ User Browser │
│ Automatically move to SHIELDGate │
└─────────────┬───────────────┘
↓
┌─────────────────────┐
│ SHIELDGate │
│ gate-proxy │
└──────────┬──────────┘
│
│ Run rb-app
↓
┌─────────────────────┐
│ rb-app │
│ (Isolated Browser) │
└──────────┬──────────┘
│
│ Direct Internet Access
↓
┌─────────────────────┐
│ Internet Website │
│ example.com │
└─────────────────────┘

***

## Key Components

### 1. Windows PAC (Proxy Auto-Config)

**Location**: User PC's Windows proxy settings

**Role**: **Primary Filtering - Determines whether to use a proxy for each site**

**Important**: The PAC file makes the first judgment!
- ✅ **Allowed Sites** (naver.com, microsoft.com, etc.) → `DIRECT` (bypasses the proxy)
- ⚠️ **General Sites** (example.com, etc.) → `PROXY 10.14.10.176:9999` (to RBIProxy)

**Example PAC File** (`pac.js`):

```javascript
function FindProxyForURL(url, host) \{
    // 1. SHIELDGate itself is DIRECT (to prevent infinite loops)
    if (dnsDomainIs(host, "shieldgate.SOFTCAMP.co.kr") ||
        dnsDomainIs(host, "security365.co.kr")) \{
        return "DIRECT";
    \}
    
    // 2. Allowed Sites List (exception handling)
    if (dnsDomainIs(host, "naver.com") ||
        dnsDomainIs(host, "microsoft.com") ||
        dnsDomainIs(host, "office365.com")) \{
        return "DIRECT";  // ← naver.com? Oh? You're allowed! DIRECT!
    \}
    
    // 3. Internal networks are DIRECT
    if (isPlainHostName(host) ||
        shExpMatch(host, "*.local") ||
        isInNet(dnsResolve(host), "10.0.0.0", "255.0.0.0") ||
        isInNet(dnsResolve(host), "172.16.0.0", "255.240.0.0") ||
        isInNet(dnsResolve(host), "192.168.0.0", "255.255.0.0") ||
        isInNet(dnsResolve(host), "127.0.0.0", "255.255.255.0")) \{
        return "DIRECT";
    \}
    
    // 4. Default rule: send to RBIProxy
    return "PROXY 10.14.10.176:9999";  // ← example.com? You're going to RBIProxy!
\}

Actual Operation:

User inputs naver.com  
    ↓  
PAC: "naver.com? Oh? You're allowed!"  
    ↓  
PAC: "Then you are DIRECT"  
    ↓  
Direct access to naver.com ✅ (Not going through RBIProxy)  


User inputs example.com  
    ↓  
PAC: "example.com? Not in the allow list"  
    ↓  
PAC: "You are sent to RBIProxy" (PROXY 10.14.10.176:9999)  
    ↓  
Forwarded to RBIProxy → Proceed to the next step

How to Apply PAC File:

  1. manual application(Individual PC):

    • Windows Settings → Network & Internet → Proxy
    • Enable "Automatic Proxy Configuration"
    • Script address:http://10.14.10.176:9999/RestAPI/pac.js

  2. Applying GPO(Domain Bulk Application):

    Group Policy Editor  
    → User Configuration → Preferences → Windows Settings → Registry  
    → HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings  
    → AutoConfigURL = "http://10.14.10.176:9999/RestAPI/pac.js""

  3. Download PAC file:

    # RBIProxy가 제공하는 PAC 파일
    curl http://10.14.10.176:9999/RestAPI/pac.js -o pac.js

2. RBIProxy Server​

Language: Go (Golang)
port:

  • 9999: Proxy Server (Main Function)
  • 80: REST API Server (Management/Monitoring)

Deployment: Kubernetes (Docker container)

Main Role: "URL Converter"

Receive all traffic sent from PACConvert to SHIELDGate URL formatdoes.

┌─────────────────────────────────────────────────────┐
│              RBIProxy Server (URL Converter)       │
│                                                     │
│  ① Receive Proxy Request (Port 9999)               │
│         ↓                                           │
│  ② URL Conversion                                   │
│     Original: http://example.com                              │
│     →                                               │
│     Converted: https://shieldgate.SOFTCAMP.co.kr/                             │
│          gate-proxy?currentTab=true&url=OriginalURL │
│         ↓                                           │
│  ③ HTML Redirect Response                           │
│     <meta http-equiv="refresh"                     │
│           content="0;url=ConvertedURL"/>           │
│                                                     │
└─────────────────────────────────────────────────────┘

Core Code (src/main.goLines 317~320:

func redirectUrl(url string) string \{
    // SHIELDGate 방식: URL을 쿼리 파라미터로 전달
    return cfg.RBIProxy.RBI.BaseURL + 
           "gate-proxy?currentTab=true&url=" + url
\}

Actual conversion example:

Input: http://example.com  
→  
Output: https://shieldgate.SOFTCAMP.co.kr/gate-proxy?currentTab=true&url=http://example.com

3. SHIELDGate (Isolation Browser)​

URL: https://shieldgate.softcamp.co.kr

Composition:

  • gate-proxy: Web Interface (Receive URL and run rb-app)
  • rb-app: Isolated Browser Engine (Actual Website Access and Rendering)

role:

  • gate-proxy receives URL parameters and executes rb-app (isolated browser)
  • Rendering a real website in an isolated environment with rb-app
  • Streaming only the screen to the user
  • Application of Security Policies (Download/Upload/Copy Control, etc.)

URL Convention:

https://shieldgate.SOFTCAMP.co.kr/gate-proxy?currentTab=true&url=<원본URL>

Operation Method:

gate-proxy comes in through the URL  
    ↓  
gate-proxy extracts the URL parameters  
    ↓  
rb-app (isolated browser) runs  
    ↓  
rb-app directly accesses the actual website  
    ↓  
streams the screen to the user

example:

Converted URL: https://shieldgate.SOFTCAMP.co.kr/gate-proxy?currentTab=true&url=http://example.com  
→ gate-proxy runs rb-app  
→ rb-app accesses http://example.com

Operating Principle​

🌟 Overall Scenario: 2 Paths​

When the user accesses the websitePAC file is judged firstdoes:

User inputs URL  
    ↓  
┌───────────────────────────────┐  
│  PAC file (1st filter)         │  
│  "Where should this site go?"  │  
└───────┬───────────────────────┘  
        │  
   ┌────┴─────┐  
   ↓          ↓  
[Allow]     [Block]  
   ↓          ↓  
DIRECT    PROXY  
   ↓          ↓  
 [End]    [RBIProxy]  
            ↓  
      [SHIELDGate]

Scenario A: Allowed Site (naver.com)​

Case ending with PAC- No RBIProxy

Step-by-Step Flow​

[Step 1] The user enters "naver.com" in Chrome
         │
         ↓
[Step 2] PAC file execution (on user PC)
         function FindProxyForURL(url, "naver.com") \{
             if (dnsDomainIs(host, "naver.com")) \{
                 return "DIRECT";  // ← This is where the decision is made!
             \}
         \}
         │
         ↓
[Step 3] PAC judgment: "naver.com? Oh? You are allowed!"
         │
         ↓
[Step 4] Decision: "Then you are DIRECT" (no proxy used)
         │
         ↓
[Step 5] Direct access to naver.com ✅
         
Result: Neither RBIProxy nor SHIELDGate is used

Scenario B: Blocked Site (example.com)​

Case passing through RBIProxy + SHIELDGate

Step-by-Step Flow​

[Step 1] The user enters "example.com" in Chrome
         │
         ↓
[Step 2] PAC file execution (on user PC)
         function FindProxyForURL(url, "example.com") \{
             // Not in the allow list
             return "PROXY 10.14.10.176:9999";  // ← Decision made here!
         \}
         │
         ↓
[Step 3] PAC determination: "example.com? Not in the allow list"
         │
         ↓
[Step 4] Decision: "Send you to RBIProxy"
         │
         ↓
[Step 5] RBIProxy reception
         → Proxy request received (port 9999)
         │
         ↓
[Step 6] URL transformation performed
         → Original: http://example.com
         → Transformed: https://shieldgate.SOFTCAMP.co.kr/gate-proxy?currentTab=true&url=http://example.com
         │
         ↓
[Step 7] HTML redirect response generated
         → <meta http-equiv="refresh" content="0;url=transformedURL"/>
         → HTTP 202 Accepted response
         │
         ↓
[Step 8] User's browser automatically navigates to SHIELDGate URL
         │
         ↓
[Step 9] SHIELDGate gate-proxy checks URL parameters
         → Extract url=http://example.com
         │
         ↓
[Step 10] Gate-proxy runs rb-app (isolated browser)
         │
         ↓
[Step 11] rb-app directly accesses example.com in an isolated environment
         │
         ↓
[Step 12] After rendering the website, streams the screen to the user
         │
         ↓
[Complete] The user safely uses example.com with the isolated browser ✅

Scenario Comparison​

stepnaver.com (allowed)example.com (blocked)
PAC FilterDIRECT → Direct AccessPROXY → RBIProxy로
RBIProxyNo installationURL conversion → to SHIELDGate
Last Accessdirectly naver.comrb-app(Isolated Browser) via
Security LevelGeneralIsolation Environment
step countStep 512 steps

PAC file configuration​

What is a PAC file?​

**PAC (Proxy Auto-Config)** is a file written in JavaScript that dynamically determines which proxy the browser should use.

Creating PAC file for RBIProxy​

RBIProxy is/RestAPI/pac.jsProvides the PAC file through the endpoint.

Basic PAC File Structure​

function FindProxyForURL(url, host) \{
    // 1. SHIELDGate 자체는 프록시 우회 (무한 루프 방지)
    if (dnsDomainIs(host, "shieldgate.softcamp.co.kr") ||
        dnsDomainIs(host, "security365.co.kr") ||
        dnsDomainIs(host, "softcamp.co.kr")) \{
        return "DIRECT";
    \}
    
    // 2. 내부 네트워크 (사설 IP) 우회
    if (isPlainHostName(host) ||
        shExpMatch(host, "*.local") ||
        isInNet(dnsResolve(host), "10.0.0.0", "255.0.0.0") ||
        isInNet(dnsResolve(host), "172.16.0.0", "255.240.0.0") ||
        isInNet(dnsResolve(host), "192.168.0.0", "255.255.0.0") ||
        isInNet(dnsResolve(host), "127.0.0.0", "255.255.255.0")) \{
        return "DIRECT";
    \}
    
    // 3. 특정 도메인 예외 처리
    if (dnsDomainIs(host, "microsoft.com") ||
        dnsDomainIs(host, "azure.com") ||
        dnsDomainIs(host, "office365.com")) \{
        return "DIRECT";  // Microsoft 서비스는 프록시 우회
    \}
    
    // 4. 기본 규칙: RBIProxy를 통해 프록시
    return "PROXY 10.14.10.176:9999";
\}

Main Functions of PAC File​

functionDescriptionexample
dnsDomainIs(host, domain)Domain Match VerificationdnsDomainIs(host, "example.com")
shExpMatch(host, pattern)Wildcard Pattern MatchingshExpMatch(host, "*.google.com")
isInNet(host, network, mask)Check IP Network RangeisInNet(dnsResolve(host), "192.168.0.0", "255.255.0.0")
isPlainHostName(host)Check if there is only a hostname (no domain)isPlainHostName("localhost")

How to Distribute PAC Files​

Method 1: Direct Deployment from RBIProxy​

RBIProxy is/RestAPI/pac.jsProvides the PAC file through the endpoint.

# PAC 파일 접근
http://10.14.10.176:9999/RestAPI/pac.js

Windows Proxy Settings:

  1. Settings → Network & Internet → Proxy
  2. "Automatic Search Settings" OFF
  3. "Use Configuration Script" ON
  4. Script address:http://10.14.10.176:9999/RestAPI/pac.js

Method 2: Deployment from a Web Server​

You can also deploy the PAC file to a separate web server (Apache, Nginx, etc.).

# Nginx 설정 예시
location /proxy.pac \{
    alias /var/www/html/pac.js;
    types \{
        application/x-ns-proxy-autoconfig pac;
    \}
\}

Method 3: GPO (Group Policy Object) Deployment​

Applying in an Active Directory environment:

  1. Open Group Policy Management Console

  2. Create a new GPO: "RBIProxy PAC Configuration"

  3. Edit → User Configuration → Preferences → Windows Settings → Registry

  4. New registry entry:

    Hive: HKEY_CURRENT_USER  
    Key Path: Software\Microsoft\Windows\CurrentVersion\Internet Settings  
    Value Name: AutoConfigURL  
    Value Type: REG_SZ  
    Value Data: http://10.14.10.176:9999/RestAPI/pac.js

PAC file exception handling strategy​

1. Performance Optimization: Internal Resources DIRECT​

// CDN, 정적 리소스는 직접 접속
if (dnsDomainIs(host, "cdn.jsdelivr.net") ||
    dnsDomainIs(host, "cdnjs.cloudflare.com")) \{
    return "DIRECT";
\}

2. Compatibility: Bypassing Specific Services​

// Microsoft 365 서비스는 프록시 우회 (인증 문제 방지)
if (dnsDomainIs(host, "office365.com") ||
    dnsDomainIs(host, "sharepoint.com") ||
    dnsDomainIs(host, "teams.microsoft.com")) \{
    return "DIRECT";
\}

3. Security: Only bypass RBI in trusted domains​

// 회사 내부 시스템은 DIRECT
if (dnsDomainIs(host, "intranet.company.com") ||
    dnsDomainIs(host, "erp.company.com")) \{
    return "DIRECT";
\}

How to Test PAC Files​

// 테스트용 PAC 파일에 디버그 로그 추가
function FindProxyForURL(url, host) \{
    var result;
    
    if (dnsDomainIs(host, "shieldgate.softcamp.co.kr")) \{
        result = "DIRECT";
    \} else if (isInNet(dnsResolve(host), "192.168.0.0", "255.255.0.0")) \{
        result = "DIRECT";
    \} else \{
        result = "PROXY 10.14.10.176:9999";
    \}
    
    // 브라우저 콘솔에 로그 출력 (디버깅 시에만 사용)
    alert("URL: " + url + "\nHost: " + host + "\nResult: " + result);
    
    return result;
\}

Using the Online PAC Tester:

Security Mechanism​

1. TLS MITM (Man-In-The-Middle)​

RBIProxy uses MITM techniques to inspect HTTPS traffic.

Operation Process​

[User Browser]
    │
    │ CONNECT example.com:443
    ↓
[RBIProxy]
    │
    │ ① HTTP/1.0 200 OK response
    │ ② Dynamic issuance of TLS certificate for example.com
    │ ③ TLS handshake with user
    │ ④ Decrypting the encrypted request
    │ ⑤ URL verification: https://example.com/page
    │ ⑥ Generating redirect response
    ↓
[User Browser]
    │
    │ Automatically redirecting to SHIELDGate
    ↓
[SHIELDGate]

Installation of private certificate is required​

For HTTPS MITM to function properly, the user's PC must trust the CA certificate of RBIProxy.

Certificate Download:

curl http://10.14.10.176:9999/RestAPI/cert.cer -o rbiproxy_cert.cer

Installation Method:

  1. Windows:

    • rbiproxy_cert.cerDouble Click
    • Click "Install Certificate"
    • Select "Local Computer"
    • "Store all certificates in the following repository"Trusted Root Certification Authorities
    • Installation Complete

  2. GPO Bulk Deployment:

    Group Policy Management → Computer Configuration → Windows Settings → Security Settings  
    → Public Key Policies → Trusted Root Certification Authorities  
    → Add rbiproxy_cert.cer

2. RBI Integration Method​

RBIProxy supports two types of RBI integration methods:

A. SHIELDGate Method (Currently in Operation) ⭐​

Settings:

RBI_LINK_TYPE: SHIELDGate

Code Location: src/main.goline 320

URL format:

https://shieldgate.softcamp.co.kr/gate-proxy?currentTab=true&url=http://example.com

Processing Method:

  • RBIProxy isSimple URL conversion only
  • Pass the original URL as a query parameter
  • The security policy is handled by SHIELDGate.

Features:

  • Simple and intuitive structure
  • URL is exposed in plain text
  • RBIProxy only serves as a relay.
  • Delegating policy management to SHIELDGate

B. DIRECT (JWT) Method (Currently Unused)​

Settings:

RBI_LINK_TYPE: DIRECT

Code Location: src/main.goLines 323~342

URL format:

https://rbi.custom.co.kr/view?url=<JWT_TOKEN>

JWT Token Content(src/main.go lines 329~339 hardcoding):

\{
  "ver": "1.0",
  "id": "softcamp.co.kr",
  "url": "http://example.com",
  "policy": \{
    "screenmark": "OFF",     // 화면 워터마크
    "key": "ON",             // 키보드 입력 허용
    "site": "ON",            // 사이트 접근 허용
    "dn": "ON",              // 다운로드 허용
    "up": "ON",              // 업로드 허용
    "media": "ON",           // 미디어 재생 허용
    "menu": "ON",            // 메뉴 사용 허용
    "clip": "ON"             // 클립보드 사용 허용
  \},
  "exp": 1234567890          // 만료 시간 (12시간 후)
\}

Features:

  • URL encrypted with JWT token
  • Token expiration time setting (12 hours)

Constraints:

  • ⚠️ Policy Hardcoded in Codeis set
  • ⚠️ Apply the same policy to all requests
  • ⚠️ Cannot apply different policies by user/URL
  • ⚠️ Cannot be changed with ConfigMap or configuration files
  • In the current operating environment,Not used

Summary of Comparison Methods​

itemSHIELDGate method (in operation)DIRECT (JWT) Method (Not Used)
SettingsRBI_LINK_TYPE: SHIELDGateRBI_LINK_TYPE: DIRECT
URL ConversionPassing Plaintext via Query ParametersEncryption with JWT Token
Policy ProcessingProcessed at SHIELDGateIncluded in the JWT token (hardcoded)
Policy FlexibilityFlexibly manage in SHIELDGateimpossible (code modification needed)
Role of RBIProxySimple RepeaterURL + Policy Packaging
Current usage status✅ In Use❌ Unused

Why use the SHIELDGate method?​

Current Operating Environment Analysis(Based on ConfigMap):

# build/kube-deploy.yaml
RBI_LINK_TYPE: SHIELDGate  # ← 실제 운영 설정
RBI_BASEURL: https://devshieldgate.softcamp.co.kr

Reason for Choosing SHIELDGate Method:

  1. Simplicity:
    • RBIProxy only performs URL transformation (src/main.goline 320)
    • Delegating security policy management entirely to SHIELDGate
    • Policy changes can be made in SHIELDGate without modifying the code.
  2. Maintainability:
    • The JWT method policy issrc/main.goLines 329~339hardcoding
    • Policy change requires code modification → build → deployment
    • The SHIELDGate method isChange only SHIELDGate settingsYou can do it.
  3. Operational Flexibility:
    • Applying different policies by user/group isManaged by SHIELDGate
    • RBIProxy operates the same for all users.
    • No need to redeploy RBIProxy for policy changes

Conclusion:

  • RBIProxy is**"Smart URL Converter"**Focus on the role
  • Complex policy managementThe share of SHIELDGate
  • Simple and Stable Architecture

3. Preventing Infinite Loops​

Mechanism to Prevent Infinite Redirects Between RBIProxy and SHIELDGate:

Prevent in PAC file:

// SHIELDGate 도메인은 DIRECT로 접속 (프록시 우회)
if (dnsDomainIs(host, "shieldgate.softcamp.co.kr")) \{
    return "DIRECT";  // 무한 루프 방지
\}

Operating Principle:

User enters example.com  
    ↓  
PAC: PROXY → RBIProxy  
    ↓  
RBIProxy: redirect to shieldgate.SOFTCAMP.co.kr/gate-proxy?url=example.com  
    ↓  
User's browser attempts to access shieldgate.SOFTCAMP.co.kr  
    ↓  
PAC: "shieldgate.SOFTCAMP.co.kr? DIRECT!" ← Blocked here!  
    ↓  
Direct access to shieldgate.SOFTCAMP.co.kr (bypassing RBIProxy)  
    ↓  
Prevent infinite loop ✅

If exceptions are not handled in PAC:

❌ Infinite loop occurs:  
example.com → RBIProxy → shieldgate... → RBIProxy → shieldgate... (repeats)

REST API​

RBIProxy provides a REST API for management and monitoring.

1. Version and Health Check​

Endpoint: GET /orGET /ver

curl http://10.14.10.176:9999/ver

Response:

\{
  "code": 0,
  "msg": "안녕, Hi, こんにちは, 你好, Chào...",
  "ver": "1.0.0.5"
\}

Usage:

  • Service Operation Verification
  • Version Information Inquiry
  • Kubernetes Liveness/Readiness Probe

2. Active Session Monitoring​

Endpoint: GET /sessions

Authentication:

  • No authentication required when accessing from localhost
  • Basic Auth required for external access
# Basic Auth 사용
curl -u admin:password http://10.14.10.176:9999/sessions

Response:

\{
  "code": 0,
  "msg": "",
  "total": 2,
  "sessions": [
    \{
      "client": "192.168.1.100:48068",
      "req": "GET https://example.com",
      "time": "295.508µs"
    \},
    \{
      "client": "192.168.1.101:37988",
      "req": "CONNECT secure.example.com:443",
      "time": "1.381s"
    \}
  ]
\}

Usage:

  • Real-time Traffic Monitoring
  • Performance Analysis (Request Processing Time)
  • User Access Tracking

3. PAC File Distribution​

Endpoint: GET /RestAPI/pac.js

curl http://10.14.10.176:9999/RestAPI/pac.js

Response: JavaScript PAC file

Usage:

  • Automatic Proxy Configuration for User PC
  • Managing PAC Files from the Center

4. Private Certificate Distribution​

Endpoint: GET /RestAPI/cert.cer

curl http://10.14.10.176:9999/RestAPI/cert.cer -o rbiproxy_cert.cer

Response: CA certificate in PEM format

Usage:

  • Distribution of Private Certificates for HTTPS MITM
  • Remove certificate warning by installing on user PC

Technology Stack​

Language and Framework​

TechnologyversionUsage
Go (Golang)1.23.11Main Language
Alpine Linux3.21.3Docker Base Image
elazarl/goproxy-HTTP/HTTPS Proxy Library

Main Go Packages​

rbiproxy/
├── cert/          # Dynamic issuance of TLS certificates (MITM)
├── config/        # Load configuration files (config.yaml, environment variables)
├── restapi/       # REST API server
│   └── core/      # API handler (version, sessions)
└── main.go        # Main logic of the proxy server

External Dependencies​

  • github.com/elazarl/goproxy: HTTP/HTTPS Proxy Engine
  • github.com/spf13/viper: Configuration File Management
  • dev.azure.com/Security365/go-common:
    • JWT Token Generation/Validation
    • logger
    • Utility

Build and Deployment​

Docker Image Build:

docker build -t rbiproxy:latest -f build/Dockerfile .

Version Control:

  • build/version.txt: Major.Minor.Patch version
  • build/version-patch.txt: Patch Number
  • Automatically Insert Version Information During Build

Use Cases​

Case 1: Strengthening Enterprise Web Security​

Problem:

  • Accessing malicious websites during work by employees
  • Ransomware, malware download risk
  • Account theft due to access to phishing sites

solution:

[All Employee PCs]
    ↓ (Automatic PAC Deployment via GPO)
[RBIProxy] 
    ↓ (Automatic Redirect)
[SHIELDGate Isolated Browser]
    ↓ (Secure Access)
[External Websites]

Result: Malware runs only in the isolated environment, employee PCs are safe.

Case 2: Apply RBI only to specific departments​

Requirements:

  • The development team needs free internet access (DIRECT)
  • General departments secure access through RBI

implementation:

// 개발팀 IP 대역
function FindProxyForURL(url, host) \{
    var clientIP = myIpAddress();
    
    // 개발팀 IP 대역은 DIRECT
    if (isInNet(clientIP, "10.14.20.0", "255.255.255.0")) \{
        return "DIRECT";
    \}
    
    // 그 외 일반 부서는 RBIProxy 사용
    if (/* 예외 조건들 */) \{
        return "DIRECT";
    \}
    
    return "PROXY 10.14.10.176:9999";
\}

Case 3: Apply RBI only to high-risk categories​

Requirements:

  • Reliable sites (Microsoft, Google) are DIRECT
  • Apply RBI only to unknown sites

implementation:

function FindProxyForURL(url, host) \{
    // 신뢰 도메인 리스트
    var trustedDomains = [
        "microsoft.com", "google.com", "github.com",
        "stackoverflow.com", "azure.com"
    ];
    
    for (var i = 0; i < trustedDomains.length; i++) \{
        if (dnsDomainIs(host, trustedDomains[i])) \{
            return "DIRECT";
        \}
    \}
    
    // 기타 사이트는 RBIProxy 경유
    return "PROXY 10.14.10.176:9999";
\}

Case 4: Monitoring and Logging​

Requirements:

  • Real-time Traffic Monitoring
  • Tracking which users access which sites

implementation:

# 실시간 활성 세션 모니터링
watch -n 2 'curl -s http://10.14.10.176:9999/sessions | jq .'

# 로그 파일 실시간 확인 (Kubernetes)
kubectl logs -f deployment/rbiproxy -n shieldinfo-dev

# 특정 사용자 IP 필터링
kubectl logs deployment/rbiproxy -n shieldinfo-dev | grep "192.168.1.100"

Deployment Architecture​

Kubernetes Environment​

┌────────────────────────────────────────────────────────────┐
│                    Kubernetes Cluster                       │
│                                                             │
│  ┌─────────────────────────────────────────────────────┐   │
│  │          Namespace: shieldinfo-dev                   │   │
│  │                                                      │   │
│  │  ┌──────────────────┐    ┌──────────────────┐      │   │
│  │  │   ConfigMap      │───→│   Deployment     │      │   │
│  │  │ rbiproxy-config  │    │                  │      │   │
│  │  │                  │    │  ┌────────────┐  │      │   │
│  │  │ RBI_BASEURL      │    │  │ rbiproxy   │  │      │   │
│  │  │ RBI_LINK_TYPE    │    │  │ Container  │  │      │   │
│  │  │ RBIPROXY_PORT    │    │  │            │  │      │   │
│  │  └──────────────────┘    │  │ Port:9999  │  │      │   │
│  │                           │  └────────────┘  │      │   │
│  │                           └────────┬─────────┘      │   │
│  │                                    │                │   │
│  │                           ┌────────▼─────────┐      │   │
│  │                           │   Service        │      │   │
│  │                           │   rbiproxy       │      │   │
│  │                           │                  │      │   │
│  │                           │   Port 80, 9999  │      │   │
│  │                           └────────┬─────────┘      │   │
│  └────────────────────────────────────┼────────────────┘   │
│                                        │                    │
│  ┌─────────────────────────────────────▼────────────────┐   │
│  │          Namespace: kube-system                       │   │
│  │                                                       │   │
│  │  ┌──────────────────────────────────────────────┐    │   │
│  │  │  rke2-ingress-nginx-controller               │    │   │
│  │  │                                               │    │   │
│  │  │  - containerPort.rbiproxy: 9999              │    │   │
│  │  │  - tcp-services ConfigMap reference            │    │   │
│  │  └───────────────────┬──────────────────────────┘    │   │
│  │                      │                                │   │
│  │  ┌───────────────────▼──────────────────────────┐    │   │
│  │  │  Service (NodePort/LoadBalancer)             │    │   │
│  │  │  Port 9999 external exposure                   │    │   │
│  │  └───────────────────┬──────────────────────────┘    │   │
│  └──────────────────────┼───────────────────────────────┘   │
│                         │                                     │
└─────────────────────────┼─────────────────────────────────────┘
                          │
                          │ NodePort or LoadBalancer
                          ↓
                  ┌───────────────┐
                  │  External Access│
                  │  (User PC)     │
                  └───────────────┘

High Availability Configuration​

Multi-Replica Deployment:

spec:
  replicas: 3  # 3개 인스턴스 실행
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1  # 최대 1개까지만 동시 다운
      maxSurge: 1        # 최대 1개까지 추가 생성

HPA (Horizontal Pod Autoscaler):

# CPU 사용률 기반 자동 스케일링
kubectl autoscale deployment rbiproxy \
  --cpu-percent=70 \
  --min=2 \
  --max=10 \
  -n shieldinfo-dev

Environment Variables​

Inject configuration through Kubernetes ConfigMap.

Required Environment Variables​

Environment Variablesexample valueDescription
RBIPROXY_PORT9999Proxy Service Port
RBI_BASEURLhttps://shieldgate.softcamp.co.krSHIELDGate server address (at the end of/Automatically added)
RBI_LINK_TYPESHIELDGateIntegration Method (SHIELDGateorDIRECT)
TZAsia/SeoulTime Zone (for Log Time Display)

Selection Environment Variable​

Environment Variablesdefault valueDescription
LOG_LEVELinfoLog Level (error, warn, info, debug)
RESTAPI_JWT_SECRET_B64Auto-generatedJWT signature secret (Base64)

Environment Variable Priority​

1st priority: Environment Variables (ConfigMap/Environment Variables)  
2nd priority: config.yaml file  
3rd priority: Command Line Flags

When deploying Kubernetes, the environment variables of the ConfigMap are applied first.

Performance and Resources​

Resource Requirements​

EnvironmentCPU RequestCPU LimitMemory RequestMemory LimitReplicas
Development/Test100m500m200Mi512Mi1
Small-scale operation200m700m300Mi1Gi2
Medium-scale operation500m1000m500Mi2Gi3
Large-scale operation1000m2000m1Gi3Gi5+

Expected Throughput​

Single Instance Criteria(Resource: 700m CPU, 1Gi Memory):

  • Simultaneous Connection: About 500~1,000 items
  • requests per second: About 100~200 req/s
  • Response Time: Average 10~50ms (redirect only)

Actual Performancedepends on the following factors:

  • Network Bandwidth
  • SHIELDGate response speed
  • TLS Handshake Overhead

Bottleneck​

  1. TLS MITM: Each HTTPS request requires a handshake → Increased CPU usage
  2. Dynamic Certificate Issuance: Generate certificate by domain → Increase in memory usage
  3. Logging: Increased I/O load by logging all requests

Optimization Tips:

  • Log Levelwarnorerrorto lower
  • Load balancing through increased number of replicas
  • Deploy on a network like the SHIELDGate server (latency reduction)

Logging and Monitoring​

Log Format​

2026-04-01 15:23:45 [INFO] Local HTTP Request - IP: 192.168.1.100:52341, URL: http://example.com, Method: GET
2026-04-01 15:23:45 [INFO] Local [GET http://example.com] code=200 OK elap=12ms

2026-04-01 15:24:10 [INFO] Local HTTPS CONNECT Request - IP: 192.168.1.100:52342, Host: secure.example.com:443
2026-04-01 15:24:10 [INFO] Local HTTPS Detail - IP: 192.168.1.100:52342, Method: GET, URL: https://secure.example.com/
2026-04-01 15:24:10 [INFO] Local [CONNECT secure.example.com:443] GET https://secure.example.com/ code=200 OK elap=45ms

Log Classification​

Log TypeDescriptionmeaning
Local HTTP RequestReceiving HTTP Requests from a Regular BrowserUser attempts to access HTTP site
Local HTTPS CONNECTHTTPS CONNECT request of a regular browserUser attempts to access HTTPS site
Local HTTPS DetailActual content of HTTPS requestURL confirmed after TLS decryption

Prometheus metrics (may be added in the future)​

# Active Sessions Count
rbiproxy_active_sessions_total

# Request Processing Time (Histogram)
rbiproxy_request_duration_seconds

# Request Count
rbiproxy_requests_total

# Error Occurrence Count
rbiproxy_errors_total\{type="tls|redirect|connection"\}

Security Considerations​

1. Private Certificate Management​

danger:

  • If the CA certificate of RBIProxy is leaked, MITM attacks are possible.
  • Service interruption upon certificate expiration

Response:

  • CA certificate file(proxy_cert.pem, proxy_pkey.pem) safely store
  • Managed by Kubernetes Secret (instead of ConfigMap)
  • Periodic certificate renewal (e.g., every year)

Certificate Regeneration:

openssl req -x509 -newkey rsa:4096 \
  -keyout proxy_pkey.pem \
  -out proxy_cert.pem \
  -sha256 -days 3650 -nodes \
  -subj "/C=KR/ST=Seoul/O=Security365/CN=RBIProxy" \
  -addext "subjectAltName=DNS:RBIProxy"

2. REST API Access Control​

danger:

  • /sessionsPossible user traffic exposure via API

Response:

  • Basic Auth configuration required
  • Force authentication for external access to localhost
  • Restricting API Access with Kubernetes NetworkPolicy

Basic Auth Configuration (config.yaml):

restapi:
  basicAuth:
    username: admin
    password: strong_password_here

3. Preventing Infinite Loops​

danger:

  • If SHIELDGate is not processed as DIRECT in the PAC file, an infinite loop occurs.

Response:

// PAC 파일에 반드시 포함
if (dnsDomainIs(host, "shieldgate.softcamp.co.kr")) \{
    return "DIRECT";  // 프록시 우회
\}

4. Internal Network Isolation​

Recommended Configuration:

DMZ:        [RBIProxy] ← User PC Access  
Internal:   [SHIELDGate] ← Accessible only by RBIProxy

NetworkPolicy Example:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: rbiproxy-policy
spec:
  podSelector:
    matchLabels:
      app: rbiproxy
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              name: dmz
      ports:
        - protocol: TCP
          port: 9999

Advanced Settings​

1. Multi-RBI Server Support​

scenario: Using different RBI servers by department

Implementation Method:

  • Deploying multiple RBIProxies (each differentRBI_BASEURL(setting)
  • Specify different proxies by IP range in PAC file
function FindProxyForURL(url, host) \{
    var clientIP = myIpAddress();
    
    // 개발팀 (10.14.20.0/24) → RBIProxy-Dev
    if (isInNet(clientIP, "10.14.20.0", "255.255.255.0")) \{
        return "PROXY 10.14.10.100:9999";
    \}
    
    // 일반 부서 → RBIProxy-Prod
    return "PROXY 10.14.10.176:9999";
\}

2. Whitelist Central Management​

current: Hardcoding exception domains in PAC files

Improvement Plan:

  • Managing the Exception Domain List in Central Management Systems (DB, Redis, etc.)
  • RBIProxy is loaded dynamically
  • Generate PAC file as a template

3. Regional RBI Server Distribution​

scenario: Use the nearest RBI server by branch

function FindProxyForURL(url, host) \{
    var clientIP = myIpAddress();
    
    // 서울 본사 (10.14.0.0/16)
    if (isInNet(clientIP, "10.14.0.0", "255.255.0.0")) \{
        return "PROXY 10.14.10.176:9999";  // 서울 RBIProxy
    \}
    
    // 부산 지사 (10.20.0.0/16)
    if (isInNet(clientIP, "10.20.0.0", "255.255.0.0")) \{
        return "PROXY 10.20.10.50:9999";   // 부산 RBIProxy
    \}
    
    return "DIRECT";
\}

FAQ (Frequently Asked Questions)​

Q1: If RBIProxy goes down, will the internet be unavailable?​

A: Yes. If the proxy goes down, all web access will be impossible.

Countermeasures:

  • High Availability Configuration: Multi Replica Deployment (at least 2)

  • Failover: Specify backup proxy in PAC file

    // 메인 프록시 실패 시 백업 프록시 사용
    return "PROXY 10.14.10.176:9999; PROXY 10.14.10.177:9999; DIRECT";

  • Monitoring: Real-time status check with Prometheus + Grafana

  • Alarm: Immediate notification when down with Alertmanager

Q2: Can RBI be applied to specific users only?​

A: Yes. In the PAC file, it is possible to branch by IP range or by user.

function FindProxyForURL(url, host) \{
    var clientIP = myIpAddress();
    
    // VIP/임원진은 DIRECT 접속 허용
    if (isInNet(clientIP, "10.14.1.0", "255.255.255.0")) \{
        return "DIRECT";
    \}
    
    // 일반 직원은 RBIProxy 경유
    return "PROXY 10.14.10.176:9999";
\}

Q6: What information can be found in the logs?​

A: Logging the following information:

  • Client IP address
  • Request URL and Method
  • Response Time
  • HTTP Status Codes

Personal Information Protection:

  • POST body is not logged
  • Cookies, Authorization headers are not logged.
  • The query parameters of the URL are logged (may include sensitive information)

Limitations and Known Issues​

1. WebSocket support limitations​

phenomenon: WebSocket connection may not work properly

Cause: HTTP Upgrade request handling not supported

solution: PAC exception handling for sites using WebSocket

// WebSocket 사용 사이트 예외
if (dnsDomainIs(host, "slack.com") ||
    dnsDomainIs(host, "teams.microsoft.com")) \{
    return "DIRECT";
\}

2. Some Authentication Method Compatibility Issues​

phenomenon: Unable to access site based on client certificate

Cause: MITM process does not transmit client certificate

solution: PAC exception handling for the site

3. HTTP/2 and HTTP/3​

Current Status: Fully supports only HTTP/1.1

HTTP/2: goproxy library limitations result in restricted support

HTTP/3: Not Supported (QUIC Protocol)

Installation and Operation​

  • [Deployment Guide](../../Internal Documents/Deployment-Installation-Operation Guide/RBI Proxy/RBIProxy Deployment Guide.md): Kubernetes Deployment Complete Procedure
  • [Environment Variables](../../Internal Documents/Setup-Installation-Operation Guide/RBI Proxy/RBIProxy config.js Guide.md): ConfigMap Configuration Details
  • Analysis of main.go code: Internal Operating Principle

REST API​

Project Information​

  • README.md: Project Overview and Change History

License and Open Source​

Open Source in Use​

libraryLicenseUsage
elazarl/goproxyBSD-3-ClauseHTTP/HTTPS Proxy Engine
spf13/viperMITConfiguration File Management

Change History​

RBIProxy was originallylqqyt2423/go-mitmproxybased on, however,elazarl/goproxyhas been changed to (v1.0.0.1, 2024-06-11).

Reason for Change:

  • Better HTTPS Handling
  • Stable MITM functionality
  • Active Community Support

Summary​

RBIProxy is:

  • between the user PC and the internetTransparent Security Layer
  • Through Windows PACAutomatically appliedworking proxy
  • SOFTCAMP SHIELDGateSwitching web access to an isolated environment in conjunction with __PH_0__
  • Through PAC fileSelective Filteringto prevent infinite loop
  • in KubernetesEasy Deployment and Scalabilitypossible

One-line summary:
"URL transformation proxy that converts traffic that has passed through PAC filtering to SHIELDGate"

Next step​

  1. Refer to the [Deployment Guide](../../Internal Documents/Deployment-Installation-Operation Guide/RBI Proxy/RBIProxy Deployment Guide.md) for deployment.
  2. Customizing PAC files to fit the environment
  3. Installing CA Certificate on User PC
  4. Bulk Deployment of PAC Settings via Windows GPO
  5. Building a Monitoring Dashboard (/sessionsAPI utilization)

Inquiry:

  • Technical Support:SOFTCAMP
  • Project Management: nicejh

Final modification: 2026-04-01