I have a small server running several virtual machines, some web servers and also a windows 2008 R2 Remote Desktop Gateway server. The intention is to have an Apache2 server running on Ubuntu 11.10 which will act as a reverse proxy server to forward requests to the corresponding server based on the hostname that is used.

I have this working for several other Ubuntu Apache2 servers and for the IIS7 server running on my 2008 R2 RD Gateway server.

With working, I mean that I can access all these web servers both via HTTP and HTTPS based on the hostname I'm visiting with a web browser.

What does not work however, is using the remote desktop gateway functionality, to connect from an external client to an internal RDP server.

I know that the RD gateway server is configured correctly because if I redirect external HTTPS traffic directly to it's IP (bypassing the apache2 proxy server) everything works fine. When I put the apache2 proxy in between, and try to establish an RDP connection from an external source, I get the following error in the apache proxy error.log:

[error] (70007)The timeout specified has expired: proxy: prefetch request body failed     to (rdpgw.internal.domain.com) from xx.xx.xx.xx ()

Where xx.xx.xx.xx is my external client's IP.

The remote desktop client on the remote client will give a generic timeout error, and on the RD Gateway server everything seems fine. When connecting directly to the RD gateway server I can see this in the IIS logfile:

2012-01-26 11:54:13 RPC_IN_DATA /rpc/rpcproxy.dll localhost:3388 443 - xx.xx.xx.xx MSRPC 401 1 2148074254 15
2012-01-26 11:54:13 RPC_OUT_DATA /rpc/rpcproxy.dll localhost:3388 443 - xx.xx.xx.xx MSRPC 401 1 2148074254 15

And when connecting through the apache2 proxy I can see:

2012-01-26 11:54:53 RPC_IN_DATA /rpc/rpcproxy.dll localhost:3388 443 - MSRPC 401 1 2148074254 46
2012-01-26 11:54:53 RPC_OUT_DATA /rpc/rpcproxy.dll localhost:3388 443 - MSRPC 401 1 2148074254 31

So the connection in the 2nd case is coming from the apache2 proxy. otherwise the connections seem to be the same.

About one thing I'm not quite sure how it should be setup, are the certificates on both servers. I understand that HTTPS can by design not be 'intercepted' and forwarded by the proxy server, so if I'm correct there are actually 2 seperate SSL connections involved here: 1 from the remote client to the apache proxy, and one from the apache proxy to the RD gateway server. I figured it would be best if the remote client did not see the difference, so I used the same self-signed certificate and private key on both the apache proxy and the RD gateway server.

There are the contents of the corresponding vhsot apache2 config file:

<VirtualHost *:443>
   ServerName rdgw.externaldomainname.com

   ProxyRequests off
   ProxyPreserveHost on
   ProxyPass / https://rdgw.internal.domain.com/
   ProxyPassReverse / https://rdgw.internal.domain.com/

   SSLEngine on
   SSLProxyEngine on
   RequestHeader set Front-End-Https "On"

   SSLCertificateFile /etc/apache2/certs/rdgw.externaldomainname.com.crt
   SSLCertificateKeyFile /etc/apache2/certs/rdgw.externaldomainname.com.key

Hopefully someone knows how this can be done? It should be possible as I found this MS article which describes how to setup exactly this configuration, only with MS ISA as a proxy server instead of Ubuntu/Apache2

  • Just wondering if the RD gateway actually uses HTTPS or if it's just using port 443 to tunnel its own protocol over SSL/TLS.
    – Bruno
    Commented Jan 26, 2012 at 12:26
  • Intresting thought... Would there be a way to test this? I guess I would have to do my proxy redirect to something other then https://?
    – Alex
    Commented Jan 26, 2012 at 13:28
  • If you can get hold of your server's private key, the easiest is probably to use Wireshark and look inside the packets (this won't work with all cipher suites, though, in particular not Ephemeral DH): wiki.wireshark.org/SSL . You could try using Fiddler too.
    – Bruno
    Commented Jan 26, 2012 at 13:48

2 Answers 2


Unfortunately, RPC-over-HTTP compatibility in Apache looks like a "will not fix". Its behavior doesn't jive with how mod_proxy handles communication, and they aren't inclined to bend over backwards for Microsoft's non-standard HTTP behavior.

See here. Highlight:

If it fails to comply with HTTP, it isn't HTTP, and the ASF HTTP Server project is unlikely to pay attention; particularly if it masquerades as HTTP and is not.


In the interim, after lengthy consideration, this is not an httpd proxy flaw.

If there's no other reason that you were looking at Apache specifically, maybe look into an alternative - HAProxy may be a good fit?

  • Hmm I was afraid of this. Since I don't need the proxy to be specifically Apache, I don't mind moving to another proxy server. But why are you suggesting HAProxy? I suppose that I will get best compatibility when using another W2K8R2 IIS server as a proxy for RD Gateway, no?
    – Alex
    Commented Jan 30, 2012 at 10:38
  • IIS isn't a reverse proxy; you'd need to use ISA. HAProxy should do the job just fine even if its HTTP code cannot, since it can work with raw TCP streams as well. Commented Jan 30, 2012 at 16:14

At least, we've found a solution for RPC-over-HTTP compatibility in Apache https://github.com/bombadil/mod_proxy_msrpc

It works with Outlook and MS RDS (Remote Desktop Services) on WindowsServer2012R2

Many thanks to author Micha Lenk aka bombadil!

  • Hello Paul, in which setup did you manage to get your Remote Desktop Gateway tunneled through Apache2? I'm getting errors for my setup. So may I ask which versions of Apache and the proxy module are you using?
    – Jens
    Commented Nov 28, 2018 at 10:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .