1

We are in the process of replacing a CentOS web farm that is using an Apache load balancer with an IIS web farm using ARR. As part of this infrastructure, our Web servers need to do single sign-on to our partners via LDAP. In the CentOS world, we are routing the LDAP requests from the web servers through the load balancer so that the clients only need to open one IP address up in their firewall (the load balancer). To do this, we add a static route to the web servers that looks like this:

/sbin/route add -host 123.123.12.1 gw 192.168.1.226 dev eth0

where 123.123.12.1 would be the IP address of our partner's LDAP server and 192.168.1.226 is the apache load balancer. On the load balancer then, we run the following script that looks something like this on startup:

iptables -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATE= D -j ACCEPT iptables -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT

I now need to replicate this functionality in our Windows 2008 r2 environment. Adding the static route to the web servers to use the ARR box as its router is pretty straight forward (if that is what I need to do). But how do I get the ARR box to then forward those packets the way our Apache load balancer is doing (essentially replicating the iptables -A -FORWARD commands). Is that a Windows Firewall configuration? RRAS? Or is there another way to accomplish what I am attempting to do. (Note that these packets are originating on the IIS Server, and the connection to the LDAP servers are stateful.)

Any help would be appreciated Bob

1 Answer 1

0

If I am understanding this correctly, then you would need to add the persistant route(s) on the Windows 2008 webservers in the command prompt:

route -p ADD 123.123.12.1 Mask 255.255.255.0 192.168.1.226

Are you replacing the Apache load balancer with a Windows box as well (NLB)?

1
  • Thanks Chase, yes, replacing the Apache load balancer is what is proving troublesome. We have the static route on the Web servers. The question is how to configure the ARR box (192.168.1.226) to accept those packets and pass them on so that all the requests look like they are coming from .226.
    – user58210
    Oct 26, 2010 at 0:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .