Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a small server running several virtual machines, some web servers and also a windows 2008 R2 Remote Desktop Gateway server. The intention is to have an Apache2 server running on Ubuntu 11.10 which will act as a reverse proxy server to forward requests to the corresponding server based on the hostname that is used.

I have this working for several other Ubuntu Apache2 servers and for the IIS7 server running on my 2008 R2 RD Gateway server.

With working, I mean that I can access all these web servers both via HTTP and HTTPS based on the hostname I'm visiting with a web browser.

What does not work however, is using the remote desktop gateway functionality, to connect from an external client to an internal RDP server.

I know that the RD gateway server is configured correctly because if I redirect external HTTPS traffic directly to it's IP (bypassing the apache2 proxy server) everything works fine. When I put the apache2 proxy in between, and try to establish an RDP connection from an external source, I get the following error in the apache proxy error.log:

[error] (70007)The timeout specified has expired: proxy: prefetch request body failed     to 192.168.2.172:443 (rdpgw.internal.domain.com) from xx.xx.xx.xx ()

Where xx.xx.xx.xx is my external client's IP.

The remote desktop client on the remote client will give a generic timeout error, and on the RD Gateway server everything seems fine. When connecting directly to the RD gateway server I can see this in the IIS logfile:

2012-01-26 11:54:13 192.168.2.172 RPC_IN_DATA /rpc/rpcproxy.dll localhost:3388 443 - xx.xx.xx.xx MSRPC 401 1 2148074254 15
2012-01-26 11:54:13 192.168.2.172 RPC_OUT_DATA /rpc/rpcproxy.dll localhost:3388 443 - xx.xx.xx.xx MSRPC 401 1 2148074254 15

And when connecting through the apache2 proxy I can see:

2012-01-26 11:54:53 192.168.2.172 RPC_IN_DATA /rpc/rpcproxy.dll localhost:3388 443 - 192.168.2.170 MSRPC 401 1 2148074254 46
2012-01-26 11:54:53 192.168.2.172 RPC_OUT_DATA /rpc/rpcproxy.dll localhost:3388 443 - 192.168.2.170 MSRPC 401 1 2148074254 31

So the connection in the 2nd case is coming from the apache2 proxy. otherwise the connections seem to be the same.

About one thing I'm not quite sure how it should be setup, are the certificates on both servers. I understand that HTTPS can by design not be 'intercepted' and forwarded by the proxy server, so if I'm correct there are actually 2 seperate SSL connections involved here: 1 from the remote client to the apache proxy, and one from the apache proxy to the RD gateway server. I figured it would be best if the remote client did not see the difference, so I used the same self-signed certificate and private key on both the apache proxy and the RD gateway server.

There are the contents of the corresponding vhsot apache2 config file:

<VirtualHost *:443>
   ServerName rdgw.externaldomainname.com

   ProxyRequests off
   ProxyPreserveHost on
   ProxyPass / https://rdgw.internal.domain.com/
   ProxyPassReverse / https://rdgw.internal.domain.com/

   SSLEngine on
   SSLProxyEngine on
   RequestHeader set Front-End-Https "On"

   SSLCertificateFile /etc/apache2/certs/rdgw.externaldomainname.com.crt
   SSLCertificateKeyFile /etc/apache2/certs/rdgw.externaldomainname.com.key
</VirtualHost>

Hopefully someone knows how this can be done? It should be possible as I found this MS article which describes how to setup exactly this configuration, only with MS ISA as a proxy server instead of Ubuntu/Apache2

share|improve this question
    
Just wondering if the RD gateway actually uses HTTPS or if it's just using port 443 to tunnel its own protocol over SSL/TLS. –  Bruno Jan 26 '12 at 12:26
    
Intresting thought... Would there be a way to test this? I guess I would have to do my proxy redirect to something other then https://? –  Alex Jan 26 '12 at 13:28
    
If you can get hold of your server's private key, the easiest is probably to use Wireshark and look inside the packets (this won't work with all cipher suites, though, in particular not Ephemeral DH): wiki.wireshark.org/SSL . You could try using Fiddler too. –  Bruno Jan 26 '12 at 13:48

1 Answer 1

up vote 1 down vote accepted

Unfortunately, RPC-over-HTTP compatibility in Apache looks like a "will not fix". Its behavior doesn't jive with how mod_proxy handles communication, and they aren't inclined to bend over backwards for Microsoft's non-standard HTTP behavior.

See here. Highlight:

If it fails to comply with HTTP, it isn't HTTP, and the ASF HTTP Server project is unlikely to pay attention; particularly if it masquerades as HTTP and is not.

[snip]

In the interim, after lengthy consideration, this is not an httpd proxy flaw.

If there's no other reason that you were looking at Apache specifically, maybe look into an alternative - HAProxy may be a good fit?

share|improve this answer
    
Hmm I was afraid of this. Since I don't need the proxy to be specifically Apache, I don't mind moving to another proxy server. But why are you suggesting HAProxy? I suppose that I will get best compatibility when using another W2K8R2 IIS server as a proxy for RD Gateway, no? –  Alex Jan 30 '12 at 10:38
    
IIS isn't a reverse proxy; you'd need to use ISA. HAProxy should do the job just fine even if its HTTP code cannot, since it can work with raw TCP streams as well. –  Shane Madden Jan 30 '12 at 16:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.