EzDevInfo.com

Does IIS with ARR support fully transparent reverse proxy?

I have got a few web servers running and I want all of them to be accessible via one domain. I set up ARR in IIS as a reverse proxy in another server and it works fine. I, however, need the source ip address to be kept when the requests are redirected to the servers. Otherwise, the servers see all the connections to be originated from localhost, which isn't very good.

I know there is an option forwarded_for which creates X-Forwarded-For header, but it is not really transparent because I have WAF(Web Application Firewall) issue.

How to trace overhead added by Application Request Routing?

We have a Delphi SOAP service which needs to be SSL-enabled. I opted to use an IIS ARR reverse proxy to do SSL offloading for ease of configuration (compared to OpenSSL and manual certificate + passphrase management). ARR works, but it adds an insane amount of overhead... Response time went from under 2 seconds to 19 seconds for 18 service requests (about 60Kb compressed total).

I added timestamp logging to client & server for when messages are both sent and received. It shows about 1 second added to each request routing through ARR between sending from the client and receipt by the service. The response is routed back very quickly, only the request routing via ARR is slow (see image below).

How can I trace the source of overhead? Is ARR not suited to this use case? I tried tweaking and disabling most settings, including caching. I tried different hosts with clean IIS setups, including a production Windows Server 2012. SSL itself is not the overhead, just having an ARR HTTP reverse proxy causes the delay.

<?xml version="1.0" encoding="UTF-8"?>
<configuration>
    <system.webServer>
        <rewrite>
            <rules>
                <rule name="ReverseProxyInboundRule1" stopProcessing="true">
                    <match url="(.*)" />
                    <action type="Rewrite" url="http://localhost:8987/{R:1}" />
                </rule>
            </rules>
        </rewrite>
    </system.webServer>
</configuration>

Request & response samples from Fiddler:

• Raw HTTP Request
• Raw HTTP Response

ARR The request cannot be routed because it has reached the Max-Forwards limit. The server may be self-referencing itself in request routing topology

I have two Windows 2008 R2 Standard Server on which IIS 7.5 is installed (Server1 and Server2). On Server1 I have installed Web Farm Framework 2.2 and created a server Farm "myFarm.com". I have also installed ARR on the Server1.

In the server farm, I have added Server2 and Server1 as the secondary servers. I have configured the ARR with default option. Load balancing is configured to "Round Robin so that request can go to both of the server randomly.

To test my setup I have created a Test.ASPX page and deployed it in both servers. This is a simple page which returns serverName on which server page is executed. This way I would know that load balancing is working or not.

Then I opened Internet Exlorer and tried to browse my Test.ASPX page from server1 which hosts Web Farm and ARR. Everytime I hit the page request goes to Server2 only. I made my server2 has unhealthy in the webfarm to check if Server1 handle the request or not. When I tried to hit the Test.aspx in the browser, I was surprised to add following error:

The request cannot be routed because it has reached the Max-Forwards limit. The server may be self-referencing itself in request routing topology.

From the error message it appears that when my server2 is not available ARR is sending the request to Server1 which is again sending it to itself causing loopback. I couldn't find a way to stop this loopback.

One of the solution which I found after searching is that I should not add Server1 to the web farm as it is hosting ARR, but I have only two servers and I don't want to use one server just for ARR.

As soon as I mark my server2 healthy request starts getting executed by server2.

Could someone suggest what should be configured to resolve this error?

Thanks

Problems publishing artifacts to remote TeamCity server on IIS

I have a rather strange problem with TeamCity. I have a TeamCity installation, with local and remote build agents. The TeamCity server is hidden behind IIS with Application Request Routing (ARR), to enable SSL, etc. I have a feeling this might be part of the problem, but I am not sure. Another reason to suspect IIS being part of the problem is, I tried to host TeamCity on an Azure Web App, and got exactly the same behaviour.

The trouble is, after building, when the build agents try to publish the artifacts to the server, I get a 404 back from the TeamCity server. TeamCity thinks it is a recoverable error (see log), and keeps trying again some times. Eventually, the publishing fails.

If I configure the local agents to access TeamCity via http://localhost, everything works smooth. But, when accessing via the public address (which is served via IIS), I get 404s. The 404 content looks like a standard IIS 404 page.

I have tries setting agent logging verbosity to DEBUG, but it still doesn't output the actual URL it is trying to call.

Does anyone have any clues on how to troubleshoot this? Getting the TeamCity agent to output the URL for which it gets the 404 would be a good start.

[Publishing artifacts] Publishing 1 file [F:/tc/ba3/temp/buildTmp/out/_PublishedWebSites/**/* => dist.zip] using [WebPublisher]
[15:34:15][Publishing artifacts] Publishing 1 file [F:/tc/ba3/temp/buildTmp/out/_PublishedWebSites/**/* => dist.zip] using [ArtifactsCachePublisher]
[15:35:10]
[Publishing artifacts] Recoverable problem publishing artifacts (will retry): <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">;
<html xmlns="http://www.w3.org/1999/xhtml">;
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"/>
<title>404 - File or directory not found.</title>
<style type="text/css">
<!--
body{margin:0;font-size:.7em;font-family:Verdana, Arial, Helvetica, sans-serif;background:#EEEEEE;}
fieldset{padding:0 15px 10px 15px;} 
h1{font-size:2.4em;margin:0;color:#FFF;}
h2{font-size:1.7em;margin:0;color:#CC0000;} 
h3{font-size:1.2em;margin:10px 0 0 0;color:#000000;} 
#header{width:96%;margin:0 0 0 0;padding:6px 2% 6px 2%;font-family:"trebuchet MS", Verdana, sans-serif;color:#FFF;
background-color:#555555;}
#content{margin:0 0 0 2%;position:relative;}
.content-container{background:#FFF;width:96%;margin-top:8px;padding:10px;position:relative;}
-->
</style>
</head>
<body>
<div id="header"><h1>Server Error</h1></div>
<div id="content">
 <div class="content-container"><fieldset>
  <h2>404 - File or directory not found.</h2>
  <h3>The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable.</h3>
 </fieldset></div>
</div>
</body>
</html>

Redirection doesn't work from ARR but works within DNN

We have an IIS web farm, of which consisting an load balancer, 4 ARRs, and 2 ASP.NET application servers running DNN CMS. The 4 ARRs will URL rewrite to DNN application servers. We have more than 100 URLs that need to be redirected into more specific resources within the website.

For example, when a user types in http://www.abcd.com/product1 from outside, the desired outcome is to redirect to www.abcd.com/index.aspx?articleid=1234 , we have configured such behavior within DNN environment, and we can sure that it works, as when we browse the site within the DNN application server, the DNN is able to detect the URL and perform redirection accordingly.

Problem occurs when we attempt to browse the http://www.abcd.com/product1 from LB and ARRs, when we type http://www.abcd.com/product1, it simply go back to http://www.abcd.com mainpage, which the redirection doesn't work at all. No IIS level HTTP redirection has been performed at the ARRs and LBs, the only setting is the default URL rewrite rule which will rewrite the URL to backend DNN servers.

Same question has been posted in IIS forum as well, it is just that I decided to post it here again to gain more exposure.

How to set IIS ARR request timeout time?

I want to decrease the timeout time when my ARR server request to back-end server. In IIS settings Interface,I cannot find any ARR settings configuration except for ARR cache.

Here is the only related information that I found.

http://www.iis.net/learn/extensions/troubleshooting-application-request-routing/troubleshooting-502-errors-in-arr

"So in this case we can clearly see that the ARR timeout was shorter than the execution of the request. Therefore, you would want to investigate whether this execution time was normal or whether you would need to look at why the request was taking longer than expected. If this execution time was expected and normal, increasing the ARR timeout should resolve the error."

As stated above,I can increase the ARR timeout.Who knows where to set it?

url rewrite and ARR across application pools

I am trying to figure out how to use url rewrite and Application Request Routing (ARR) to rewrite across different app pools on the same server.

In a simplified version, here is what I have: a REST service API is implemented with 2 virtual directories, Service.A and B, so virtual directory is part of url to access to access resources A and B

GET [https://]api.mycompany.com/Service.A/A

GET [https://]api.mycompany.com/Service.B/B

What I want to achieve is to have one single external url for the api without virtual directory names, and obviously not having to go through a code refactoring (to merge solution files and builds)

GET [https://]api.mycompany.com/A

GET [https://]api.mycompany.com/B

I implemented a url rewrite rule to match /A in path and replace with /Service.A/A, with some code like this in web.config at the default web site level, which works fine.

    <rewrite>

            <rule name="AddServicePrefix" enabled="true">

                <match url="^A[/]?.*" />

                <action type="Rewrite" url="/Service.A/{R:0}" />

            </rule>

    </rewrite>

The problem is that when I assign a different application pool to Service.A (from the app pool of default web site), this will fail immediately with a 403 error, but this is a requirement on our side to have applications/virtual directories running under different app pools to minimize impact when any pool fails or recycles.

I have done some research. This previous post below basically said "if you want to re-route request to another app-pool, you have to make a hop, whether that hop is over winsock or named pipe or whatever else" without much details. I also went through ARR guide but couldn't figure out exactly how to use ARR for this case.

http://forums.iis.net/t/1151510.aspx?Rewrite+across+application+pools+

Any help? Suggestions and comments whether I am in the right direction?

Thanks!

oh, forget to mention the environment: currently in dev environment, IIS 7.5 on Windows 7, Url Rewrite 2.0, and ARR 3.0, installed by Web Platform Installer.

Can a "Standard" or "Basic" Azure Website instance be pulled down by the ARR, mainly for being to idle?

I understand how and why "Shared" Azure Website instances get recycled, especially if idle to provide more capacity for the servers, all managed by the ARR server. So I can understand why, if idle, one's instance may go cold, ie first thing in the morning.

However......

I am using a "Standard" Website instance for production, and a "Basic" instance for testing. I assumed that these instances stayed live and "hot" 24/7. However due to encountering some suspicious "warmup" symptoms, I believe my so called "Standard" or "Basic" instance may be recycling.

I would appreciate some light on this. It may be I have misunderstood something, especially whether "Standard" or "Basic" instances stay up 24/7.

Of course a pragmatic tip for this is to have an auto ping service like pingdom and uptimerobot which we do use on production.

Finally I am currently using a single instance of each, so it could be that a patch has happened. But some clarity would help.

Handling multiple applications under the same domain

I am having a application build using pimcore (ZendFramework) which is hosted on a Linux EC2 (Apache) instance and one more application which is hosted on Windows IIS.

Now I want both of these applications to run in the following manner:

• http://example.com/app1 will redirect to pimcore
• http://example.com/app2 will redirect to application hosted on IIS

I can't use subdomains for this. I was trying to use URL Rewrite (ARR) of IIS. But ZendFramework is giving the following error:

Zend_Controller_Router_Exception No route, document, custom route or redirect is matching the request

Rewriting custom tag attributes using IIS Url Rewrite 2.0 and ARR

I've developed a custom grid control that uses data-* attributes to configure how the grid is supposed to work (in a similar vein to how Bootstrap data API components work. For a particular deployment, I'm having to proxy my web application into another web application using IIS and Application Request Routing (ARR) + URL Rewrite. The proxying part is all done, I'm currently trying to configure the outbound rules for rewriting urls to match. For instance, I currently have rules set up such as:

• Rewrite HTTP redirects by updating the Location: header.
• Rewrite Html content for URIs in standard tags (e.g., A, Area, base, etc.)
• Rewrite Css content for URI's that are relative (e.g. /cassette.axd -> /blog/cassette.axd).

The last issue I am having, is getting the URL rewrite module to accept my urls in data attributes, e.g., if my grid is such like:

<table data-grid data-query="/api/users/">

Should be rewritten as

<table data-grid data-query="/blog/api/users/">

I stress that all other tags, such as <a href and <img src work as expected and even a custom <property value tag is correctly rewritten. Just seems to by hypenated attributes.

I've tried adding a <customTags> section, with my custom tags in:

<customTags>
    <tags name="Bootgrid">
        <tag name="table" attribute="data-query" />
        <tag name="table" attribute="data-update" />
        <!-- This next tag WORKS -->
        <tag name="property" attribute="value" />
    </tags>
</customTags>

However, the above is not matching any attributes that have a hyphen. Not sure if this is actually solvable or not because I can't see anything in IIS configuration to set these.

Also annoyingly once you've created a set of Custom Tags in IIS, you can't seem to edit them again. :-/

Combining ASP.NET MVC and Reverse Proxy with URL Rewrite v2

I have a need to submit some data to a different host name and was hoping to utilize the reverse proxy guide found here for IIS 7.5

http://learn.iis.net/page.aspx/659/reverse-proxy-with-url-rewrite-v2-and-application-request-routing/

I have added the following code to my system.webserver entry in the site's root web.config

<system.webServer>
        <urlCompression doStaticCompression="true" doDynamicCompression="true" />
        <staticContent>
            <remove fileExtension=".js" />
            <mimeMap fileExtension=".js" mimeType="text/javascript" />
        </staticContent>
        <validation validateIntegratedModeConfiguration="false" />
        <modules runAllManagedModulesForAllRequests="true">
            <remove name="ScriptModule" />
            <remove name="UrlRoutingModule" />
            <add name="ScriptModule" preCondition="managedHandler" type="System.Web.Handlers.ScriptModule, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
            <add name="UrlRoutingModule" type="System.Web.Routing.UrlRoutingModule, System.Web.Routing, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
        </modules>
        <handlers>
            <remove name="WebServiceHandlerFactory-Integrated" />
            <remove name="ScriptHandlerFactory" />
            <remove name="ScriptHandlerFactoryAppServices" />
            <remove name="ScriptResource" />
            <remove name="MvcHttpHandler" />
            <remove name="UrlRoutingHandler" />
            <add name="ScriptHandlerFactory" verb="*" path="*.asmx" preCondition="integratedMode" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
            <add name="ScriptHandlerFactoryAppServices" verb="*" path="*_AppService.axd" preCondition="integratedMode" type="System.Web.Script.Services.ScriptHandlerFactory, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
            <add name="ScriptResource" preCondition="integratedMode" verb="GET,HEAD" path="ScriptResource.axd" type="System.Web.Handlers.ScriptResourceHandler, System.Web.Extensions, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
            <add name="MvcHttpHandler" preCondition="integratedMode" verb="*" path="*.mvc" type="System.Web.Mvc.MvcHttpHandler, System.Web.Mvc, Version=2.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
            <add name="UrlRoutingHandler" preCondition="integratedMode" verb="*" path="UrlRouting.axd" type="System.Web.HttpForbiddenHandler, System.Web, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
            <add name="AssetHandler" preCondition="integratedMode" verb="GET,HEAD" path="asset.axd" type="Telerik.Web.Mvc.WebAssetHttpHandler, Telerik.Web.Mvc"/>
            <add name="CrystalImageHandler.aspx_GET" verb="GET" path="CrystalImageHandler.aspx" type="CrystalDecisions.Web.CrystalImageHandler, CrystalDecisions.Web, Version=10.5.3700.0, Culture=neutral, PublicKeyToken=692fbea5521e1304" preCondition="integratedMode"/>
        </handlers>
      <rewrite>
        <rules>
          <rule name="Reverse Proxy to spellchecker" stopProcessing="true">
            <match url="^spellchecker/(.*)" />
            <action type="Rewrite" url="http://spellcheck001.XXX.yyy/{R:1}" logRewrittenUrl="true" />
          </rule>
        </rules>
      </rewrite>
    </system.webServer>

Can you not combine the built in rewrite module with MVC? I have tried google and found no straightforward answer. If I attempt to access a url within the spellchecker path I receive a 404 response.

Forwarding NTLM credentials from IIS with ARR and URL Rewrite

Thanks in advance for your help.

In my environment, I configured IIS to act as a reverse proxy and forward requests to certain paths to an application server on another host. In order to do this, I used Application Request Routing (ARR) and URL Rewrite modules, I create my rule and everything's working fine.

IIS is responsible to authenticate clients using NTLM, so my question is: is it possible to pass the authentication credentials (at least the username) to my application server after authenticating the user?

I tried to do this adding a custom header to my requests, writing a rule like this:

<rule name="ForwardToApplicationServer">
<match url=".*" />
<serverVariables>
<set name="HTTP_AUTH_USER" value="{AUTH_USER}" />
</serverVariables>
<action type="Rewrite" url="http://myappserver/myapp/{R:0}" logRewrittenUrl="true" />
</rule>

But it doesn't work: when I read it on my application my header is alwasy empty. I also tried with and but none of these worked.

So, what am I doing wrong? Should I use another server variable? Am I missing something?

More in general: is it possible to do what i'd like to do?

Again, thanks in advance for your help, and please forgive me if I'm asking something obvious but I'm new to using IIS and I couldn't find anything that helped me.

IIS7 URL Rewriting Outbound rules

I can't seem to get my head around these rewrite rules for some reason and I was hoping you guys could help. What I want is an outbound rule that will rewrite paths for link, img, script, and input tags.

I want to change this: http://www.mysite.com/appname/css/file.css

To this: http://cdn.mysite.com/css/file.css

So, basically I need to swap the host name and drop the app name from the URL. I've got the pre-condition filters to *.aspx files set already, but the rest seems like Greek to me.

EDIT for clarity

The appname in the URL above is an application in IIS. It's a placeholder for whatever appname happens to be in use. It could be any of over 50 different apps with our current setup. There will ALWAYS be an appname. Perhaps that will make the rule even easier.

The hostname, in this case www.mysite.com, can also vary slightly in terms of the subdomain. It might be www1.mysite.com, www2, etc. Also, just realized that I need to maintain the SSL if there.

So, I guess when it comes down to it, I really just need to take the URL, minus the appname, and append it to the new domain, while respecting the protocol that was used.

Original URL: http(s)://{host}/{appname}/{URL}

Output: http(s)://cdn.mysite.com/{URL}

Redirect on absolute URL doesn't work in MVC 4

For some reasons I have to redirect requests from my MVC 4 application to the pages with absolute URLs that's located in another domains. Here is the the code that I use:

public ActionResult Test(string url)
{
    return Redirect(url);
}

Everything works fine when I try it on my local machine, but when I publish the code to the production and try to get it working there then I have some problems... for example, to redirect request to the 'http://stackoverflow.com/questions/ask' it will be redirected to the 'http://{{myserverdomain.com}}/questions/ask'. So the request will be redirected to the local path 'questions/ask' instead of absolute URL.

Have no idea what and where I should check. I would appreciate any hints what could be the problem and where to check it...

Just in case: the server is Windows Server 2008 R2 Enterprise

UPDATE

URL/HTML encoding is not the reason of problem. Changing method to the

public ActionResult Test()
{
    return Redirect("http://stackoverflow.com/questions/ask");
}

will give the same result... it will be redirected to 'questions/ask'/ Suspect that the reason with the URL Rewrite module, but don't know how to check it yet...

SOLUTION

here is the link that helped to solve the issue: http://forums.iis.net/t/1171047.aspx

IIS Reverse Proxy Re-Encoding URLs Containing Percent Sign (%)

I am trying to set up a reverse proxy for Jenkins using IIS 7.5, Application Request Routing 3.0 (ARR), and URL Rewrite 2.0.

I have the proxy mostly working, but am running into issues with URLs that contain the percent symbol (%).

No matter what I try, the proxy insists on either de-encoding or re-encoding the percent sign in the rewritten URL.

This is how I want the URLs rewritten:

http://my.proxy/a%2Fb -> http://my.host:8080/a%2Fb

This is how the URLs are actually being rewritten:

http://my.proxy/a%2Fb -> http://my.host:8080/a/b
- or -
http://my.proxy/a%2Fb -> http://my.host:8080/a%252Fb

How can I get IIS\ARR\Rewrite to stop re-encoding my rewritten URLs?

Things I've tried:

1. A normal reverse-proxy (rewrites the URL as http://my.host:8080/a/b):

   <rule name="ReverseProxyInboundRule1" stopProcessing="true"> <match url="(.*)" ignoreCase="true" /> <action type="Rewrite" url="http://my.host:8080/{R:1}" /> </rule>

2. Using the UNENCODED_URL server variable (rewrites the URL as http://my.host:8080/a%252Fb):

   <rule name="ReverseProxyInboundRule1" stopProcessing="true"> <match url="(.*)" ignoreCase="false" /> <conditions logicalGrouping="MatchAll"> <add input="{UNENCODED_URL}" pattern="/(.*)" /> </conditions> <action type="Rewrite" url="http://my.host:8080/{C:1}" /> </rule>

3. Just entering the URL in straight (as a test - also rewrites the URL as http://my.host:8080/a%252Fb):

   <rule name="ReverseProxyInboundRule1" stopProcessing="true"> <match url="(.*)" ignoreCase="false" /> <action type="Rewrite" url="http://my.host:8080/a%2Fb" /> </rule>

4. All the ideas in Scott Hanselman's excellent "Experiments in Wackiness: Allowing percents, angle-brackets, and other naughty things in the ASP.NET/IIS Request URL"

   1. <httpRuntime requestValidationMode="2.0" requestPathInvalidCharacters="*,:,&amp;,\" relaxedUrlToFileSystemMapping="true" />
   2. <security> <requestFiltering allowDoubleEscaping="true" /> </security>'

Note: I ran into this behavior when my IIS reverse proxy ran afoul of Jenkins' built-in reverse proxy checking system which attempts to do an HTTP redirect to a URL of this form.