Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

At our company, we have three separate servers that house IIS currently. Each of these three servers have the same public IP address and essentially reside on the same network under different subnets.

We're trying to come up with a method of allowing access to all three machines in a relatively easy manner. Any ideas?

share|improve this question
    
What sort of access are you wanting? Access just to the IIS service? Or remote management/VNC/SSH? Do you have additional public addresses available to use? –  Ben Feb 20 at 8:04
    
We just need to access the websites hosted on the servers externally. We already have a VPN in place, but due to the nature of our business, we need the sites to be available without a VPN. –  Jdsfighter Feb 20 at 13:52
    
Do you have any NATing in place already where the external IP goes to a particular host? –  Ben Feb 21 at 1:36
    
Currently, no. At one point, we did have it set up to route to our web server. But when the company switched away from hosting our public site locally, they did away with it. –  Jdsfighter Feb 26 at 15:31

5 Answers 5

You can run them all on different ports or you can put a reverse proxy in front of them.

Using different ports is the easiest, but then your users need to know the port as well as the name to reach the right server.

The reverse proxy rules determine which internal IIS server to fetch based on the hostname requested.

share|improve this answer
    
I was hoping to avoid this method, we were looking to try to do something like web1.oursite.com web2.oursite.com ... etc... –  Jdsfighter Feb 19 at 23:28

I am going to make some assumptions here. You state "we have three separate servers that house IIS currently. Each of these three servers have the same public IP address" which I assume means they are only public facing for very specific services. They are probably allowing external on port 80, 433, and possibly a few others. If that is the case, I would not setup a method to connect remotely via that external address. Since the address is publicly available for web services, it can be scanned to find your "door for access" no mater what form that may take.

Option 1: The simplest solution would be to setup 4 public addresses:

1 Public Address that is load balanced for providing web services. 3 Public Address that are redirected to the ports on each server to connect manage them.

Setting up the NAT redirection for the management addresses is a simple firewall configuration. It would look like this.

  1. Public Address 1 > Private Address of Server 1
  2. Public Address 2 > Private Address of Server 2
  3. Public Address 3 > Private Address of Server 3

Optionally you could have one public address to deliver services and one public address for management, but have a different inbound port for each server. Say you had ports 1000, 1001 and 1002. If you management service was SSH, port 22, then it would appear as follows.

  1. Public Address, Port 1000 > Private Address of Server 1, Port 22
  2. Public Address, Port 1001 > Private Address of Server 2, Port 22
  3. Public Address, Port 1002 > Private Address of Server 3, Port 22

Option 2: Setup a Management Server or software that you then use to connect to each IIS server internally.

So you would have one public address for your web services and one public address for managing the servers. The First address is load balanced to your IIS servers, the second Address goes to your management server, possibly a Remote Desktop server, an SSH server or a server than provides VNC connectivity to the ISS Servers. Their are lots of third party options both free and paid that can accomplish this second option.

Option 3: Setup VPN (Virtual Private Network)

If your firewall have the ability to act as a VPN concentrator, then you can setup VPN services. This would allow you to connect remotely using VPN. Once connected, you can then connect to each IIS Service using their internal IP Address.

share|improve this answer
    
In terms of security option 3 is the best –  Ben Feb 20 at 8:02
    
Agreed. However depending on the existing hardware the company owns it could potentially be the most complex and expensive of the options. –  Jon Moody Feb 20 at 15:09

If you want to access each by the same external IP address then you'll have to use different ports and use port based NATing.

If you can use different host names/domain names then you can setup a reverse proxy to hand off the requests to the different servers based on the host names. e.g. server1.example.com, server2.example.com, etc

To do that you'll need to either have a 4th box or pick one of the existing servers to do this task.

Setup NATing to point at that server (possibly just for port 80).

Pick a proxy package. You could use something like Squid, Apache, Varnish or Apache traffic server (some of these can do caching as well).

Configure the proxy to forward requests for server1.example.com to go to internal IP or hostname for server1 and the same for servers 2 and 3.

The one thing to be aware of is if the proxy is running on one of the web servers the port that the proxy is listening on can't be the same as the web server.

So either configure the proxy to be on say port 8080 and then configure your NAT rule to forward requests on port 80 to port 8080 or alternatively configure all your web servers to run on that port. I recommend the first option though. That way your internal access is neater and bypasses the proxy.

Hopefully this all makes sense. Happy to clarify further if need be.

share|improve this answer

I personally would do a reverse proxy, but if you want to avoid that then an alternative to the other suggestions would be to run each server on a different port and pay for a service like No-IP that will do host redirects from Port 80 to another port.

Basically, host1.domain.com can be pointed to your ip:81 and users won't know a difference.

It works, but I'd still recommend a reverse proxy as the "appropriate" way of doing things.

share|improve this answer

I suggest using a Reverse Proxy, in your case Application Request Routing, an free IIS addon from Microsoft.

You pick one of your three servers and give it the public IP. Install and setup ARR to handle all requests and forward them to any of the three end-points.

This is a free solution in terms of hard- and software but you need to learn about ARR. I suggest setting up three test servers in VMs and play with it.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.