We are in the process of replacing a CentOS web farm that is using an Apache load balancer with an IIS web farm using ARR. As part of this infrastructure, our Web servers need to do single sign-on to our partners via LDAP. In the CentOS world, we are routing the LDAP requests from the web servers through the load balancer so that the clients only need to open one IP address up in their firewall (the load balancer). To do this, we add a static route to the web servers that looks like this:
/sbin/route add -host 123.123.12.1 gw 192.168.1.226 dev eth0
where 123.123.12.1 would be the IP address of our partner's LDAP server and 192.168.1.226 is the apache load balancer. On the load balancer then, we run the following script that looks something like this on startup:
iptables -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATE= D -j ACCEPT iptables -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT
I now need to replicate this functionality in our Windows 2008 r2 environment. Adding the static route to the web servers to use the ARR box as its router is pretty straight forward (if that is what I need to do). But how do I get the ARR box to then forward those packets the way our Apache load balancer is doing (essentially replicating the iptables -A -FORWARD commands). Is that a Windows Firewall configuration? RRAS? Or is there another way to accomplish what I am attempting to do. (Note that these packets are originating on the IIS Server, and the connection to the LDAP servers are stateful.)
Any help would be appreciated Bob