IIS reverse proxy using regular proxy - iis

I use an IIS as reverse proxy. However, the target page can only be reached via a "regular" proxy.
Currently I always get a bad gateway error. My guess is that the rewrite module of the IIS does not consider the proxy settings of the system and therefore does not get a connection to the target page.
Do I have to define own proxy settings for the rewrite module? Or is it even possible to use a reverse proxy behind a normal proxy with the IIS?

According to your description, I suggest you could try to add the proxy setting in the applicatiohost.config file.
This will make all the request to use the proxy to send to another server.
More details, you could refer to below setting:
Related article: https://learn.microsoft.com/en-us/dotnet/framework/configure-apps/file-schema/network/defaultproxy-element-network-settings
Applicationhost.config file path:
C:\Windows\System32\inetsrv\config\
Setting example:
<system.net>
<defaultProxy>
<proxy
proxyaddress="http://10.0.2.231:42"
bypassonlocal="true"
/>
</defaultProxy>
</system.net>

Related

IIS Reverse proxy configuration

I have two sites in my IIS 8 server. Site MyProjectA and MyProjectB, for each project I have a domain name, lets say myprojecta.com and myprojectb.com. I have set in my DNS provider that both domains points to the server IP. I have configured so MyProjectA runs on 443 and MyprojectB runs on 8181, both SSL.
So if I browse to:
https://myprojecta.com I see MyProjectA and its working fine
If I browse to:
https://myprojectb.com:8181 I see MyProjectB and that is working
fine.
But now I wonder, how can I configure so I can omit the :8181 part, and in turn reach MyProjectB site by browsing to https://myprojectb.com only (and with correct certificate). As far as I understood this should be possible with a reverse proxy configuration in IIS but I cannot get it to work. Anyone can help how to achieve that?
Since you are using IIS 8, the simplest approach is to set up multiple HTTPS sites at port 443 using SNI support. Then there is no need of reverse proxy.
Reference

Use Reverse Proxy rewrite rule to fetch content from site accessible through HTTP proxy

A client of mine is trying to use an IIS Application Request Routing rule to reverse proxy the contents of another site (controlled by the same client). So far, no issues.
But, from the IIS server the other site is only available through a standard HTTP proxy. It looks like ARR totally ignores the System and .NET Proxy settings.
We tried setting the default proxy in the web.config, that is ignored.
We tried setting the system proxy through netsh winhttp set proxy.
We changed the settings in the Internet Explorer connection settings.
All to no avail.
I can't find any documentation on whether ARR supports reverse proxy rules through another proxy. I can imagine this is not supported.
An HTTP request over an HTTP proxy is actually making the same request to the proxy using the absolute url instead of relative in after the method name.
GET / HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0
would be
GET http://example.com/ HTTP/1.1
Host: example.com
User-Agent: Mozilla/5.0
Of course the request needs to be made to the proxy server.
You could try achieving this changing rewrite rule. I can't provide an example since I don't have access to a Windows server but you can try to get some guidance here.

In Node.js, finding the original client URL when app is behind a reverse proxy

I'm working on a Node.js/Express application that, when deployed, sits behind a reverse proxy.
For example: http://myserver:3000/ is where the application actually sits, but users access it at https://proxy.mycompany.com/myapp.
I can get the original user agent request's host from a header passed through easily enough (if the reverse proxy is configured properly), but how do I get that extra bit of path and protocol information from the original URL accessed by the browser?
When my application has to generate redirects, it needs to know that the end user's browser expects the request to go to not only to proxy.mycompany.com over https, but also under a sub-path of myapp.
So far all I can get access to is proxy.mycompany.com, which isn't enough to create a valid redirect.
For dev purposes I'm using a reverse proxy setup in nginx, but my company is using Microsoft's ISA as well as HAProxy.
Generally this is done with x-forwarded-* headers which are inserted by the reverse proxy itself. For example:
x-forwarded-host: foo.com
x-forwarded-proto: https
Take a look here:
http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/x-forwarded-headers.html
Probably you can configure nginx to insert whatever x- header you want, but the convention (standard?) seems to be the above.
If you're reverse proxying into a sub-path such as /myapp, that definitely complicates matters. Presumably that sub-path should be a configuration option available to both nginx and your app.

Avoid rewriting URL's to external applications with reverse proxy on IIS?

Confluence IIS Reverse Proxy Setup
I have set up a reverse proxy on IIS 7.5 for Atlassian Confluence according to instructions found in the internet.
I wanted to redirect all traffic to "docs.unimaze.com" to "localhost:8090" on the same server.
This is how I did it:
Installed URL Rewrite 2.0
Installed Application Request Routing 3.0
Set up a reverse proxy rule:
Match URL: Matches the pattern (.*) using regular expressions (ignore case)
Conditions: (none)
Server variables: (none)
Action: Rewrite with http://localhost:8090/{R:1} (append to query string and stop processing of subsequent rules.
The only other thing I had to in order to make everything work (from https://serverfault.com/questions/76013/iis6-vs-iis7-and-iis7-5-handling-urls-with-plus-sign-in-base-not-querystr) was to run this command on the server so that URL's with "plus signs" in the URL's would be allowed.
%windir%\system32\inetsrv\appcmd set config "WebSiteName"
-section:system.webServer/security/requestFiltering -allowDoubleEscaping:true
Problem with external redirects
Confluence itself, seems to work perfectly BUT when attempting to edit a module from an external application (LucidChart Diagrams it fails), because a redirection to the external application also is rewritten, e.g. an attempt is made to redirect to this URL:
http://docs.unimaze.com/documents/edit/4b157fd9-8e28-4d70-8587-0fdd0839fbca?callback=...
when the redirect should actually be to the external application, so it should remain untouched by the rewriting rule:
https://www.lucidchart.com/documents/edit/4b157fd9-8e28-4d70-8587-0fdd0839fbca?callback=...
Is there an easy way to solve this?
This here helped: appcmd.exe set config -section:system.webServer/proxy /reverseRewriteHostInResponseHeaders:"False" -commit:apphost
In UI, the setting corresponding to this action on the Application Request Routing in IIS on the server node (select „Server Proxy Settings“) should be unchecked.
However, this had the effect that the page can not be loaded in Internet Explorer 11 L
The page is shown, but with empty space where the diagram is and it tries loading something forever.
In Firefox and Chrome it works fine.
I have no idea why it "freezes" in IE 11. Will check from other machines to see if this is always happening or not.
The easiest way to handle this is to take advantage of IIS host headers and make the proxied site believe it is responding as www.example.com:80 rather than localhost:8080. It turns out the AAR reverse proxy has an equivalent of Apache's ProxyPerserveHost setting it just isn't very well documented nor exposed in the UI.
To enable this setting you will need to open an elevated shell and run:
%windir%\system32\inetsrv\appcmd.exe set config -section:system.webServer/proxy -preserveHostHeader:true
Then configure the target site to listen at 127.0.0.1:80 with the appropriate host header and then configure the proxy to proxy back to localhost with the request and it should line up.

IIS as reverse proxy

I'm looking into to having IIS doing authentication in an application being executed on a J2EE server (JBoss). Is there any ways to have IIS work as reverse proxy and propagating the username and/or roles of the user the proxied application (JBoss). And also what IIS version would I need, if it's possible?
I have license for IIS, so I'd like to do it in IIS, but otherwise I'd prefer open source.
Thanks!
Tomas
It's not open source, but ApplicationRequestRouting for IIS 7.0 can act as a reverse proxy.
More Info:
http://blogs.iis.net/wonyoo/archive/2008/07/09/application-request-routing-arr-as-a-reverse-proxy.aspx
Download:
http://www.iis.net/extensions/ApplicationRequestRouting
Microsoft ISA server does that - you may want to look at that first.
IIRF does reverse proxy and URL rewriting for IIS5/6/7.
It's open source, and uses a syntax evry similar to mod_proxy / .htaccess for its rules.
You need v2.0 to get the reverse proxy capability.
You might like to look at http://www.managedfusion.com/products/url-rewriter/

Resources