When Apache Proxypass is configured, is traffic being forwarded from the host in the DMZ to the internal host, or is a new connection initiated between the DMZ to the internal host? Trying to determine if the proxy is forwarding traffic, or if a protocol break is occurring via a new connection with a different payload.
Thx
Update - after some additional digging, a new connection is initiated, but a new connection is created from the DMZ host to the internal host, but the original request from the client is copied. Some items may be re-packaged, but only out of necessity, but request/responses bodies are generally unchanged.
Use modsecurity as a control if need be.