Figure  6-1 illustrates a typical setup with a firewall that filters traffic destined for a WebLogic Server cluster. The firewall permits clients to connect only to a web server, which usually runs at the standard HTTP port 80 or SSL port 443. The web server could be a WebLogic Server or a third-party web server set up to proxy requests to WebLogic Server. For example, you could set up Netscape Enterprise Server, Microsoft Internet Server, or an Apache Server to serve static web pages and proxy servlet and JSP requests to WebLogic Server. Figure  6-2 illustrates the architecture.
Clients interact exclusively with the web server.
WebLogic Server connections come only from proxied web server requests, enhancing the security of your WebLogic Server applications and back-end resources. If you use WebLogic Server as the gateway, no bridge is needed to redirect to another WebLogic Server or cluster. To protect individual files or directories served via HTTP, you must create a URLAcl policy file. Acls you create for HTTP resources in the weblogic.properties file determine if a user has permission to execute the servlets that serve pages, including HTML and JSP pages. These Acls do not apply to specific files or directories.