1

I have been using ISA on Windows Server 2003 to publish multiple web servers hosted on the same machine. Setup as follows:

  • ISA HTTP/S listener bound to 127.0.0.1 + external IP
  • IIS bound to 127.0.0.2
  • Apache bound to 127.0.0.3
  • Python web application bound to 127.0.0.4
  • Custom applications bound to 127.0.0.x

I could route requests depending on the hostname to the specific server by setting up publishing rules in ISA. ISA allowed me to retain the original client IP and the requested hostname, and had a lot of other features like request validation, URL mapping and rewriting and caching.

Now I'm on Windows Server 2008 R2, ISA doesn't work here, TMG is a huge PITA (and doesn't even work with my IP setup at all - default gw 10.255.255.1, subnet mask 255.255.255.255), and ISA generally proved to be difficult when it came to RPC and other internal network traffic. So I'm looking for a way to do the same, especially when it comes to retaining the original client IP. I tried Faststream IQ Proxy, which looked promising, especially because it installed it's own NDIS driver, and server publishing worked fine, but the client IP is always lost. Delegate and Squid may be candidates. but they don't install any network layer drivers, so it seems impossible for them to retain the originator IP.

I'm currently running IIS on the external IP and 127.0.0.1 and using ARP with Reverse Proxy to publish other servers, however it doesn't work too well, and the client IP is still lost for the proxied servers. To be honest, it's shit, and I am truly sorry that IIS 7.5 still does not include a viable reverse proxy solution like ISA did years ago.

Does anyone know a software that archives the same web server publishing effects like in ISA, preferably with a decent GUI (I could also live with configuration files though), that reverse proxies requests to local webservers, without loosing hostname information and the original client IP? Or am I doomed to get TMG to work in my setup?

2 Answers 2

1

You probably don't need to retain the original IP in the actual TCP header. Many reverse proxy setups will allow passing the original IP address the request was made from as an HTTP header. (See for example: Squid configuration directive forwarded_for.)

Apache with mod_proxy would also do the trick, and will also add X-Forwarded-For headers for reverse-proxied traffic. This might be convenient since you already have Apache running on the machine.

3
  • Thank you. I know that, and I'm currently doing that with IIS/ARP, but putting the X-Forwarded-For header back into the chain is also a real PITA, for instance you need to use a different log file field definition in Apache so that the X-Forwarded-For-IP instead of the proxy IP shows up, and PHP is a different story. Please, only solutions that reflect the capabilities that ISA allowed and were so convenient. Dec 4, 2011 at 21:47
  • You ruled out TMG, which is the current version of ISA; other solutions will have more pain than that. From the look of it, unless you change your addressing scheme to be TMG compatible. Yes, I know it's a pain; pick the least painful pain.
    – TristanK
    Dec 5, 2011 at 21:01
  • Last night I thought I give TMG another shot, installed a new VM with WS 2008 R2 and TMG, but the 127.0.0.x trick doesn't work anymore. As soon as "Requests appear to come from the original client" is ticked, weird things happen.With TMG listening on the external IP, and IIS bound to 127.0.0.1, the host starts to send out ARP requests for 127.0.0.1. With IIS bound to 127.0.0.2, IIS tries to answer the request directly to the client, and TMG ignores the answer, and gives a timeout. TMG is also really a PITA because every change on the configuration takes about a minute to get applied. Dec 5, 2011 at 23:19
1

Just for the record, TMG can be installed with some tricks:

  1. Install the Microsoft Loopback adapter (hdwwiz)

  2. Set a static address in the private IP range (e.g. 10.0.0.1/255.0.0.0, no default GW) for the loopback adapter and disable DNS registration in the TCP/IP settings for the adapter

  3. Install TMG

  4. Upgrade TMG to SP1 or use a bootstrapped installation

  5. Optional: promote to DC/RODC

  6. Optional: if the server is a DNS, add the "real" adapter as HKLM\SYSTEM\CurrentControlSet\Services\DNS\Parameters\PublishAddresses, so the private address won't be published

  7. Bind IIS with netsh http iplisten to 127.0.0.1 and 10.0.0.1

  8. Use server publishing rules in TMG to publish 10.0.0.1

  9. Register additional addresses on the loopback adapter and bind your applications to the addresses (10.0.0.2, 10.0.0.3, etc), so you can publish them too in TMG

Not as smooth as in ISA, but it works. Be sure to install TMG before promoting to DC because it's not supported by Microsoft to have TMG on a DC installed

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .