Rick, My website is accessible to the public. To be clear my website is written in react/javascript (no foxpro). The website basically uses my WC REST API as it's backend.

My website is only hosted on one server but my API runs on multiple servers. The website knows which server to call the API on, so customers 1 thru 10 are on server1 and customers 11 thru 20 are on server2, etc. Today, there is a port exposed to the public on server1 and server2 for the API.

If the API calls made by my website are to public url's, there is no problem. That works.

I would like to reduce what is exposed to the public. If the ports on servers1 and 2 were NOT exposed to the public, that would be better.

Because the website is actually running on a user's browser, when the website attempts to call my API which is NOT accessible publically, this does not work.

I am sure there are ways to make this work. I have read about reverse proxy server's etc. Can you point me in a direction that you would go?

Thanks, John

Not sure I understand what you're asking. The IP Address or domain that you're trying to access has to be accessible to the client computer that's connecting to it. That means you either have a publicly accessible port setup, or you use a VPN, or you require users to provide IP Addresses that can be opened in the firewall specifically.

If the site has to be accessible by anyone you can't hide ports obviously.

As to multiple servers - you can use a load balancer to route requests to multiple servers. If you're running on Windows there's ARR (Application Request Routing) which is an IIS plug-in.

It's been a long time since I've looked at how this works, but basically you have a Load Balancing server (a server that's either standalone or one of the nodes) and then individual standalone servers. You configure AAR and tell it what IP Addresses the nodes live on, and the load balancer then routes across these instances. It'll respect cookies and request identifiers to try and pin to specific servers if that matters so that sessions and cookies are respected.

There are other commercial solutions that are a little easier to set up and manage, but ARR works very well once it's been set up and configured.

+++ Rick ---