Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We are in the process of replacing a CentOS web farm that is using an Apache load balancer with an IIS web farm using ARR. As part of this infrastructure, our Web servers need to do single sign-on to our partners via LDAP. In the CentOS world, we are routing the LDAP requests from the web servers through the load balancer so that the clients only need to open one IP address up in their firewall (the load balancer). To do this, we add a static route to the web servers that looks like this:

/sbin/route add -host gw dev eth0

where would be the IP address of our partner's LDAP server and is the apache load balancer. On the load balancer then, we run the following script that looks something like this on startup:

iptables -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATE= D -j ACCEPT iptables -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT

I now need to replicate this functionality in our Windows 2008 r2 environment. Adding the static route to the web servers to use the ARR box as its router is pretty straight forward (if that is what I need to do). But how do I get the ARR box to then forward those packets the way our Apache load balancer is doing (essentially replicating the iptables -A -FORWARD commands). Is that a Windows Firewall configuration? RRAS? Or is there another way to accomplish what I am attempting to do. (Note that these packets are originating on the IIS Server, and the connection to the LDAP servers are stateful.)

Any help would be appreciated Bob

share|improve this question

If I am understanding this correctly, then you would need to add the persistant route(s) on the Windows 2008 webservers in the command prompt:

route -p ADD Mask

Are you replacing the Apache load balancer with a Windows box as well (NLB)?

share|improve this answer
Thanks Chase, yes, replacing the Apache load balancer is what is proving troublesome. We have the static route on the Web servers. The question is how to configure the ARR box ( to accept those packets and pass them on so that all the requests look like they are coming from .226. – user58210 Oct 26 '10 at 0:25

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.