Newbie... please be nice :)

trying to set up reverse proxy to apache generated sites (one local, two others on nearby private hosts, and probably more to follow)

Running 2012R2 / IIS / ARR3.
walked thru tutorial at: http://www.iis.net/learn/extensions/url-rewrite-module/reverse-proxy-with-url-rewrite-v2-and-application-request-routing.. Great tutorial. 
I understand that the tutorial is dated.

My logic is/was since the tutorial is able to reverse proxy to sites on the same host running on different ports (8081 and 8082, in the example); then it should be a simple task to do the same for any other site, even if it's apache run.

The other site is: http://localhost:9675  Lets call it "OtherSite". 
  The OtherSite renders fine when browsing to http://localhost:9675.
  If I duplicate the rule for "payroll" or "webmail" as shown in th tutorial, replacing pertinent values (webmail ->OtherSite; 8081 ->9675), the site does not render thru the proxy.  Why not? 
I've also updated the outbound rules to re-insert the '/othersite' into hrefs

  What am I missing?

I am a very new Linux/Apache user and have only scratched the surface with IIS. I am trying to get them to play together.

I have a single external IP address which is resolved using Dynamic DNS. Port forwarding is enabled so that all requests on port 80 go to my main Win Server 2008 R2 w/ IIS 7.5 on 192.168.0.100; there is no internal firewalling between servers - so far so good

I now want to forward "some" port 80 requests to 192.168.0.200 - I will eventually associate a www address to this site but at the moment it is just available via IP on 192.168.0.200. I do not want to be forced into using a different port.

I have set up ARR with a URL re-write to forward any URL with ^somedir/(*.) on inbound to 192.168.0.200 so that my "normal" url [http:// is implicit in all of these sites bu never entered - ussing Internet Explorer 10]mysite.dyndns-home.com (NB NOT a www. address) accesses my Win server andmysite.dyndns-home.com/somedir/ should go to the Apache default site on my Ubuntu server at 192.168.0.200

I have set up an outbound rule to rewrite anything from 192.168.0.200 as mysite.dyndns-home.com/somedir/

I had a sub directory /mysub on the Win server which was accessible from mysite.dyndns-home.com/mysub or .../mysub/ because I put an index.htm file there, so I copied that to my linux server so that if (internally) I accessed192.168.0.200/mysub I got that index.htm returned.

I modified the index.htm so that I could see which server was returning a response.

So - I access mysite.dyndns-home.com externally and that is fine. I trymysite.dyndns-home.com/somedir and I get a 404. No surprise but if I trymysite.dyndns-home.com/somedir/ (which should match my pattern) I get a 500 error. I have not set up any bespoke error handling - this is IIS out of the boc - so there is no further information.

If I try mysite.dyndns-home.com/somedir/mysub/ I get a 500 error but if I trymysite.dyndns-home.com/somedir/mysub - it redirects tomysite.dyndns-home.com/mysub/ so some redirect is working - just not the right one.

ARRRRGGGGHHHH.

Anyone got any idea of how I should be writing these rules? There is a LOT out there on this but a lot assumes that you are running websites on the same server or all running IIS or are self-contradictory.

Any helpful hints would be greatly appreciated.

We are using a URL Rewrite to setup a reverse proxy to a WAMP server running a PHP application called Moodle. Our main website is running on an IIS 8.0 server. When someone visits a particular directory on that server, the reverse proxy reroutes the request to a WAMP server. So, for example, when a student visits http://myschool.edu/classroom, the reverse proxy sends them to http://wamp-server/classroom. The Moodle application running needs to have the environmental variables set to http://myschool.edu, so we set the "preserveHostHeader" to "true" in the ARR config. This allowed the application to run inside the myschool.edu domain though it was running on a different server. Everything seems to be working correctly. The reverse proxy reroutes the inbound requests.

However, this caused another issue to arise when it comes to outbound responses. When a PHP redirect is sent from the WAMP server outward to the client, the ARR rewrites the "Location" in the header so that it will not forward. For example, if I setup a PHP script on the WAMP server that tells the browser to redirect to "http://youtube.com/watch?v=0000000", ARR (or something else), changes the "Location" in the header to "http://myschool.edu/watch?v=0000000". This causes the redirect to fail and is causing some problems within Moodle when it comes to setting up external urls.

Does anyone know how to fix this so that it output the correct location header?

Thanks,
Blake

Hi Folks,

I'll start out by saying I'm not very familiar with IIS, let alone ARR. I do have a virtual lab currently setup with the intentions of accessing a web page externally.

My Setup:  1 ARR server and 2 backened servers serving the page that I need access to. All 3 servers are running Server 2008 Enterprise with SP2 w/IIS 7.

My problem: 

I'm trying to access my site externally via https however, I receive:

502 - Web server received an invalid response while acting as a gateway or proxy server.
There is a problem with the page you are looking for, and it cannot be displayed. When the Web server (while acting as a gateway or proxy) contacted the upstream content server, it received an invalid response from the content server.

If I change the NAT setting in my router to point directly to one of the backened servers, I get to the page just fine. The issue is when trying to access from the ARR server. 

I do have a rewrite rule configured that points directly to my farm. I've also checked inside the monitoring and management console and I am seeing that I'm hitting the page from outside but they're only failed requests. I'm thinking this might be security related as I did see this in the failed request logs:

Trigger Status: 502.3

Module Set Response Error Status - ApplicationRequestRouting *Bad Gateway*

Set Response Error Description - A security Error has Occurred 

Not sure where else to check or what to look for. Please let me know if there's anything else I need to provide you to narrow this issue down. I'll also say I can't even access this page internally via ARR. However, just like the external access, I can access internally directly to backened servers as well. 

Hi,

I would like to be able to put in a selection of IP addresses in ARR Conditions while the logical Grouping is still MatchAll. A specific site just needs to reachable from certain IP adresses. I have tried different patterns, however none seem to work. I couldn't find any example for this case.

Can you help me with the pattern?
( i'm not asking for a ready made solution ( don't mind if some has it ), but just pointers in the correct direction )

Hello,

I have an IIS7.5 ARR 3  instnace that sits behind a coporate proxy server. This server serves as a front end for a Glassfish hosted java application.

when a make a certain request to the Glassfish app from https://my.domain.com/.... vs http://localhost/... is double escapted differently.

https version

https://my.domian.com/apex/f?p=2000:101:3847177058292&notification_msg=Invalid%2520Login%2520Credentials

http version

http://localhost/apex/f?p=2000:101:8454933726676&notification_msg=Invalid%20Login%20Credentials

How can I configure IIS/ARR to treat the https request the same as http and get rid of the extra escape?

Thanks.

 Hello,

I followed all the installation steps to install ARR 2.0 Beta and have also corressponding log entries... rewrite_2.0_x64_beta.msi, webfarm.msi, requestrouter.msi, externaldiskcache.msi all show Success.

 Unfortunaltely I don't have the ARR icon in the IIS section on my Server. What went wrong here?

Thank you for your support!

Regards

Markus

I am migrating an ancient linux reverse proxy server running Apache and mod_rewrite to a Server 2012 running IIS8, ARR 3.0 and URL Rewrite 2.0.  After a lot of internet searches, reading and experimentation (for there are no guides for this process and the process was not exactly obvious), I managed to get it mostly working, but I had one problem with the site I had a great deal of trouble solving:  for some proxied pages, you would get an error (that displayed in Firefox, but not IE) that indicated "The connection to the server was reset while the page was loading."  (In IE11, it just said "This page can't be displayed.")

I managed to solve the problem, but I am writing this post primarily to help others having this issue because it took me over 2 days of constant research to figure out how to solve it, and hopefully this solution will show up in internet searches for anyone having the same problem.

After much experimentation, I found that if the size of the response page was > 256K (262144 bytes), this error would ensue.  Initially I found some articles that suggested this had something to do with Output caching, but changing settings for that had no effect, and I figred it was just a bug in IIS 8.  However, after several more hours searching for a solution, I finally found an obscure article (with a typo in the title):IIS + ARR: URL rewrite outbound rules with contens greater than 256K gives connection reset.  Bingo - same issue! In this, it indicated that what we needed to do was change the Application Request Routing Cache\Proxy Server Settings\Response Buffer Threshold to much larger value than the default 256K. 

However, what stumped me was the fact that I could not find "Application Request Routing Cache" anywhere in the IIS MMC management console, even though I had used Windows Platform Installer to install ARR 3.0.  In fact, I could find no controls for ARR at all.  Figuring I had somehow installed things improperly, I uninstalled, rebooted, tried again, tried earlier versions  - nothing worked. 

I finally found ANOTHER article, entitled: Problems in locating ARR.  It turns out I was not the only one with this issue either, and at the bottom of that article, it indicated that if you use the Computer Management (MMC) console to look at IIS, the ARR feature does not show up, but if you use the Internet Information Services (IIS) Manager instead, then it does!  (Why there are two interfaces still eludes me - I wasn't even aware of the latter program until I had discovered this post.)  In that post, the moderator claimed Microsoft had fixed this in ARR 2.0/IIS7, but as of this writing, it's still broken in the same way with Server 2012, IIS8 and ARR3.0.   

Long story short (and it really shouldn't have been so hard to diagnose and fix this):  If you bring up theIIS manager (not MMC!), go to Application Request Routing Cache for the server, edit Server Proxy Settings... and raise the Response Buffer Threshold, and change it to something big enough to handle your proxied pages, you can fix this problem. 

So the remaining question here is:  When will the ARR feature integration be fixed for the Computer Management Interface for IIS on Server 2012/IIS 8?

Hi to all,

It's my first post here at IIS.NET forum, i'm glad to work with you guys. 

Today i have a multi farm scenario, and want to converge all with ARR + IIS.

I have sites running with 3 independents IIS 6.0 (100 sites), sites running in a cluster with 2 IIS 7.5 + Shared Configuration + DFSR + NLB (50 sites) and Exchange 2010 Cluster with CAS running with 3 TMG, with maybe 2000 accounts.

My new farm would be with Win 2012 R2. I'm planning to make an ARR Layer, with 6 ARR v3 with NLB + Shared Configuration + DFSR.

On service side, a farm with 4 IIS 8.5 with Shared Configuration + DFSR to publish all web sites running actually on IIS 6 + 7.5.

A single FTP site with access to public site files, using DFSR.

About the Deploying of applications, i'm reading about how to publish applications with TFS, in a Shared Configuration schema, and apparently works fine, so wouldn't be a problem.

With Exchange, put the CAS publish with ARR too.

To work great, with checking each application, i will need to create at least 200 "farms" on ARR, to each one check it's status and reach the wanted layer 7 high availability.

So here comes the big question: It's this a best practice schema? 200 rules for an ARR server would be too much? I'm planning that these "unified sollution" would have at least 1200 current connections, so each one ARR would have 200 current connections.

Or it's best to split the "ARR Layer" on small clusters, each one with less rules? Any suggestions would be apreciated. 

Thanks so much for helping!

I'm using ARR as a caching reverse proxy that transfers requests to an Azure Web Site website by routing requests to mysite.azurewebsites.net. Now the WAWS site only accepts requests to its default domain, thus in ARR preserveHostHeader is set to False. The website has requests routed to it from a lot of different domains, but those domains are not set up for the website, just in the ARR node (the domains change dynamically). I.e. mydomain1.com and mydomain2.com both reach the ARR node that routes these requests to mysite.azurewebsites.net where an HTTP module restores the original HOST header so the application can decide which domain we're looking at.

Because of this ARR stores cached pages in CacheFolder/mysite.azurewebsites.net/some/path. So ARR has different cache entries for pages under the same route on different websites I set up URL rewriting to append a query string with the domain in it, resulting in cached pages like CacheFolder/mysite.azurewebsites.net/some/path?mydomain1.com and CacheFolder/mysite.azurewebsites.net/some/path?mydomain2.com.

So far so good but now I'd like to be able to delete the whole cache for just one domain.

Can I make ARR to store cache files in a folder named the same as the domain of the original request? (E.g. CacheFolder/mydomain1.com/... and CacheFolder/mydomain2.com/...) This would make it possible to remove everything for a specific domain.

Alternatively, can I make ARR store cache files in a custom, request-dependent path instead of under an auto-generated path created from the request URL?

    I have a scenario like   sending request and receive response through routing service and it  should call either one of the WCF Host deployed in the servers . Please let me  know the possibilites of acheving this kind of scenario and give the examples if anyone came to know.

Thanks in advance.

Hi 

I don't know how to configure IIS in order to get the setup as showed in this picture on Stackoverflow:

http://stackoverflow.com/questions/23337125/iis-url-rewrite-signalr-and-api-to-port-8080

I installed ARR and URL Rewrite. However, I only want to forward /api/ and /signalr/ requests to a selfhosted process.

Thanks.

 Hi all,

 Forgive a relative newbie if this has been asked before, but I've got an IIS7/AAR reverse proxy setup whereby the application that's being redirected needs to access an external site, so here's the process:

• Browser requests address (e.g. "http://myhost/application").
• AAR recognises the application fragment and forwards it to the required app server port (e.g. "http://localhost:8020/")
• The app then needs to redirect to an outside URL (e.g. "http://www.foo.com/verify?destinationURL=http://myhost/application")

 Now I've got the Rewrite rules configured correctly so that the destinationURL is rewritten in the response, but by default "Reverse rewrite host in response headers" is enabled, which automatically rewrites the redirect as "http://myhost/?destinationURL=http://myhost/application".  So I turn off the checkbox to allow the external redirect to work, but then my rewrite rule replacing the destinationURL in the response no longer fires, so I end up with "http://www.foo.com/verify?destinationURL=http://localhost:8020", which isn't going to get me where I want to be.

I'm guessing that disabling "reverse rewrite host" also disables other rewrite rules - is there any way round this?

Thanks all!

Hi all,

I've been using ARR as CDN cache for our VoD playout with great success so far. Now we are using it for Smooth Live streaming too. I've run into a problem which seems to be Request Consolidation related.

I've setup ARR 3.0 on two Windows Server 2012 servers. The setup is pretty default apart from a few tweaks learned from the VoD farm. These include:

- Adjust the response buffer threshold to a 512KB that is slightly higher than the typical response size in our setup

- Adjust the kernel cache response size to 1MB (instead of the 256KB default) to be able to cache video chunk responses

Although this all seems to work fine during the day when we have a few hondrereds of Mbit/s of traffic it seems to fall apart when we are in peak hours. We can have > 20Gbit/s in peak hours. Both servers are able to handle >10Gbit/s each but suddently one of the two seems to overload all resonsens to the backend (ARR Origin cache). This will cause buffers etc but after a minute or so it seems to stabelize ietself. And then reoccure on the other server some time later. No specific interval, or traffic or specific server. 

When I have a look at the requests that are going to the backend ARR Origin they are valid request and are actually served from the cache of the Origin ARR (Cache HIT=1). So the request/response is cacheable. Yet I see many request for the same video chunk when one of the two edge ARR servers fails.

Each edge ARR is facing internet with 40Gbit/s and connected to the backend with 1Gbit/s. When I have 10 Gbit/s of external traffic and all is working fine the backend is about 5Mbit/s and <10 miss requests/s. When ARR fails the 1Gbit/s is maxed out to it's wire speed.

I read the whitepapers and tutorials over and over and it should almost work out of the box yet I have this issue.

Any help much appreciated.

Regards,
FvN

Hello @,

after using ARR 3.0 on Windows 2012 R2 (coming from Win2k8R2 with ARR 2.0) we see regular crashes of our AppPools and we do also see, that the server in the farm are always marked unhealthy as soon as we use the healthcheck with a pretty simple html page.

If we use the live check only, it works w/o problems.

Using the "Verify URL Test" function always shows "Pass" for all servers.

What we recognized as well - usually we see the health check requests in the request tracing and IIS log, but there is no entry about it at all - the health check does not seem to reach this point. What we see is that from time to time the apppool behind the server crashes.

Any ideas how to fix this, are apreciated.

Here the details:

Configuration:

<webFarms>
<webFarm name="DiamantFarm.diamant-test.de">
<server address="app1.tsu2012r2test.diamant-test.de" enabled="true" />
<server address="app2.tsu2012r2test.diamant-test.de" enabled="true" />
<applicationRequestRouting>
<protocol keepAlive="false" timeout="00:05:00" preserveHostHeader="false" reverseRewriteHostInResponseHeaders="true" minResponseBuffer="0">
<cache enabled="false" queryStringHandling="NoCaching" validationInterval="00:00:00" />
</protocol>
<affinity useCookie="true" ignoreSubDomainClientAffinity="true" />
<loadBalancing algorithm="WeightedRoundRobin" />
<healthCheck url="http://DiamantFarm.diamant-test.de/healthcheck.html" retries="5" interval="00:00:03" timeout="00:00:20" statusCodeMatch="200-399" responseMatch="healthy" liveTrafficFailureCodes="500-" maxLiveTrafficFailures="10" liveTrafficFailurePeriod="00:00:30" minServers="1" />
</applicationRequestRouting>
</webFarm>
<applicationRequestRouting>
<hostAffinityProviderList>
<add name="Microsoft.Web.Arr.HostNameRoundRobin" />
<add name="Microsoft.Web.Arr.HostNameMemory" />
</hostAffinityProviderList>
</applicationRequestRouting>
</webFarms>

Crash - Eventlog:

Name der fehlerhaften Anwendung: w3wp.exe, Version: 8.5.9600.16384, Zeitstempel: 0x5215df96
Name des fehlerhaften Moduls: requestRouter.dll, Version: 7.1.1750.0, Zeitstempel: 0x51df2af5
Ausnahmecode: 0xc0000005
Fehleroffset: 0x0000000000030902
ID des fehlerhaften Prozesses: 0x106c
Startzeit der fehlerhaften Anwendung: 0x01cf6ddf1a61081e
Pfad der fehlerhaften Anwendung: c:\windows\system32\inetsrv\w3wp.exe
Pfad des fehlerhaften Moduls: C:\Program Files\IIS\Application Request Routing\requestRouter.dll
Berichtskennung: 7cb69c44-d9db-11e3-80bb-000c29143f55
Vollständiger Name des fehlerhaften Pakets:
Anwendungs-ID, die relativ zum fehlerhaften Paket ist:

I can also provide a full dump of the crashing process - just need to configure it.

Maybe some note on this - the application we are running is a 32 bit app and the application pool behind is as well 32 bit.

The routing itself works without problems, but I would actually like to make an active health check on a page we use to check the whole system. Currently any attempt to perform a check fails.

Regards,

  René 

We only use ARR for routing to two internal systems based on URL. The inbound request routing is handled by the rules and seems to work all ok.

However, when sending a redirect response to the client, in order to redirect to Paypal from an MVC application, the ARR module will, after a period of uptime, rewrite the domain as whatever was inbound domain. E.g. http://www.ourdomain.com/cgi-bin/webscr?cmd=_express-checkout&token=<...token...>

When debugging I can see this link exiting the MVC as a client redirect but with the correct https://www.paypal.com/cgi-bin/webscr?cmd=_express-checkout&token=<...token...>.

Worryingly when the problem occurs it can be resolved by doing an IIS reset. After this the site will perform as expected for a "period" of time, which can be anything from a couple of hours to a day. Also,when not routing through the ARR module it all works as expected.

There are no outbound rules in place for neither reverse proxy (routing) website nor for the MVC website.

This is happening on a load balanced web farm with ARR installed on each front end box (behind the NLB) and SSL offloaded. But as mentioned, without ARR enabled it all works fine.

Any ideas anyone?

Hello and many thanks in advance!

I have followed a guide to setup ARR as a reverse proxy, which worked fairly well. My setup is a little bit different from the guide, so I'll detail that first, but so far everything is working nicely. Here is my setup, so far:

Reverse Proxy Server

• testsite/auth
  • Web Application hosted on Reverse Proxy Server
• testsite/client
  • Provides only static content (HTML/CSS/JS) hosted on Reverse Proxy Server
• testsite/api
  • ARR 3 Reverse Proxy to Application Server, no response rewrite needed

Application Server

• testsite/api
  • RESTful API

One major deviation from the guid I've noted is that no response rewrite is needed; this is because external access to the application sees the IP of testsite to be theReverse Proxy Server, whereas that server sees the IP of testsite to be theApplication Server. This will be done using external vs. internal DNS servers in production, but for now I'm using a combination of HOSTS and Fiddler in my dev environment (HOSTS points testsite toApplication Server, Fiddler is setup to redirect only traffic from web browsers requesting testsite to localhost).

Next Steps

OK, so the prototype is working well enough to demonstrate partial URL proxying without response rewriting, but I don't have any authentication or real code involved yet because I have a few questions before I dump a bunch of time in this approach.

One of my goals with the Reverse Proxy Server is to make proxied requests coming from it impersonate different users (not using Windows Authentication mode or ASP.NET impersonation, but rather either the WindowsCredential or NetworkCredential object's impersonation functionality, based on some Forms Authentication based data). I currently suspect this will be done with an IHttpModule, but I'm having difficulty finding any information regarding ASP.NET request/response lifecycle data for ARR. TheApplication Server will use Windows Authentication and ASP.NET Impersonation such that all requests to the API run as specific windows accounts to leverage built-in functionality for ACLs and the like. In order to do this, I will need to begin impersonation on the Reverse Proxy Server before ARR initiates a connection to the Application Server, and then I will need to undo the impersonation after a response is received from theApplication Server which is why I suspect I will need to use an IHttpModule.

Given the above scenario, the next thing I want to ensure is that requests to theReverse Proxy Server under the testsite/api path do not redirect if the user is not authenticated. Part of the point here is to protect theApplication Server from anonymous trafic.

While digging around for these answers, the only hint for my particular scenario I've seen so far (and one that troubles me) is from this comparison between URL Rewrite and ASP.NET routing, which seems to suggest that URL Rewrite takes place prior to authentication. This implies to me that all requests (including anonymous ones) to testsite/api will be routed to theApplication Server. This also suggests that I won't have the default ASP.NET identity/context provided by the Authentication step yet, which I will also need in order to establish impersonation prior to the request.

• Has anybody seen/done anything along these lines before that might have lessons to share?
• Is it reasonable/feasible to use ARR this way?
• Is there an easy way I can use existing/built-in technologies to validate Forms Authentication established by the testclient/auth APIs both to prevent anonymous access to theApplication Server and also to get use the auth token to retrieve the necessary information to impersonate a windows user before proxying the request?

There are several posts about using ARR as a reverse proxy for complex authenticated services like Lync, Exchange, SharePoint, and other farm-based services, so it seems like it would be possible, but many of these don't require the same impersonation steps and have their own authentication schemes so I didn't get much out of those. I am investigating using ARR specifically because it plays nice with IIS farms which will likely be in play at some deployed sites.

Any help would be greatly appreciated!

For more information regarding my current setup and objectives, please check my original questions here.

I have setup ARR as a Reverse Proxy on a web application that orchestrates API calls for non-Windows platforms against web services designed to use Windows Authentication. So far I have managed to setup a mechanism for API-based authentication directly against the Reverse Proxy Server and have setup the Authorization config such that only authenticated users should be proxied.

First off, based on the part of the application life cycle that ARR takes place in, it seems to me it should honor the rules from the location/system.web authorization, but it seems to be ignoring them?

Similarly, based on the stage of the application life cycle that ARR takes place in, I had hoped that impersonating a user before it performed the backend request would allow it to authenticate against Windows Authentication, but it would appear (and seems somewhat obvious now) that the proxy is just passing the HTTP 401 Auth handshakes bake and forth between the two. If it's feasible, what would be the best way to get ARR to automatically respond to the Auth requests using the current user, rather than passing the message along?

Otherwise, I suppose I'll just write a reverse proxy HttpModule myself, but I was really hoping to leverage the familiarity of IIS' farm tools since this will be deployed in clients' environments and it would be nice to let the admins use tools they're more likely to be familiar with and/or are already using. I also suspect ARR does a better job than I will, though implementing a proxy with the tools available looks like it should actually be relatively simple (famous last words). Anybody know of any caveats or hurdles I'm likely to run into or have any resources that would be helpful to this end?

Thanks kindly for your time.

I'm using IIS in Windows Server 2012 with Application Request Routing verson 3.

I go and create a server farm for my Lync installation (meet.kressmark.com) which should pass traffic to my front-end server on ports 4443 and 8080.

So I enter the server address (fe01.kressmark.com) expand advanced setting and expand applicationRequestRouting and set the httpPort to 8080 and the httpsPort to 4443, and click finish. All is well and the server farm works!

If I now would like to go back to check these port numbers (or change them) where can I do that?

I can not find it anywhere in the GUI, nor do I know any PS command to do it. Please help!

We are currently using F5 Hardware Load Balancer for load balancing our domain controller on port 389. F5 device is end of life and organization is planning to procure new one.

Can we use ARR 3.0 as load balancer on port 389 to load balance our domain controller to save additional investment of procuring third part HLB?

Please advice.