IIS HTTP/S rewrite with SSL offloading non-standard local port

Question

I posted this in a different forum and got nothing, so I'm a bit desperate.

Here is my scenario:

• IIS running sites on 80 and 443 - external.foo.com and https://external.foo.com

• On the same node, a separate web service is running an app (ASP) on port 801 - "web app3" .

I need all traffic coming to http(s)://external.foo.com/app3 to be routed to the local port 801 with SSL offloading - so the connection from the client to IIS is SSL, but IIS's connection to the local service is http over port 801.

---

I have ARR configured with a Proxy setup on localhost:801 which created a default rewrite rule. I have all the IIS sites and requests to external.foo.com/app3 being redirected to app3 now via HTTPS and it appears offloading is working fine using ARR default rule. The Global rule is below.

<proxy enabled="true" />
        <rewrite>
            <globalRules>
                <clear />
                <rule name="ARR_App3Proxy_loadbalance" enabled="true" patternSyntax="Wildcard" stopProcessing="true">
                    <match url="*" />
                    <action type="Rewrite" url="http://App3Proxy/{R:0}" />
                    <conditions logicalGrouping="MatchAll" trackAllCaptures="false">
                    </conditions>
                </rule>
            </globalRules>
        </rewrite>

Now I just need to target external.foo.com/app3 specifically so my other IIS sites will be excluded from this... If I leave the rule alone, it redirects every site request to app 3 over https w/ offloading just fine, but as soon as I try to set any url matching or condition, the IIS sites revert back to their default, but I cannot get app3 to load by opening http(s)://external.foo.com/app3.

I honestly think there are 2 things wrong, I am not targeting external.foo.com/app3 properly and that port 80 or 443 is also being implied for some reason when I edit the default rule. I have tried a 100 times to make this work, but I'm running out of steam.

Any advice or assistance will be greatly appreciated!

Answer 1

Change your match pattern to only match the path you're interested in:

<rule name="ARR_App3Proxy_loadbalance" enabled="true" stopProcessing="true">
  <match url="^app3(.*)$" />
  <action type="Rewrite" url="http://App3Proxy:801{R:1}" />
</rule>

Here I've changed the rule into a regex match rather than a wildcard match, and then set the match pattern to:

• ^ start of path - in rules this is everything after the first trailing slash after the domain.
• app3 only match if the path is app3 - should ignore other folders and paths - this should be enough
• (.*)$ capture everything else to the end of the URL - this should include trailing slashes, query strings, etc.

Then the action is set to rewrite on the server to the correct protocol and port (http://app3proxy:801) with the capture from the rule {R:1} (because R:0 is the whole matched string (in this case app3/somepath)).

Finally this assumes that you have set up name resolution internally for app3proxy to your site - the easiest way to confirm that is request it in a browser on the server. If you don't have a local DNS server you can add the entry to you can either add an entry to the servers hosts file or just use the internal IP address (if it's the same server then http://127.0.0.1:801 should work).

Notes on steps taken locally to confirm:

1. Installed Application Request Routing 3.0 from Web Platform Installer.
2. Within IIS Manager, at the server level, enabled ARR with the "Enable proxy" setting - left all other options at their default, including leaving "Proxy Type | Use URL Rewrite to inspect incoming requests" unticked (although SSL Offloading is ticked) - this results in the informative note "Server routing rules have not been created".
3. Ensure that I can resolve the sub-sites correctly on the server (including one on port 801.
4. In the IIS website, added the Rewrite rules to the application.

Sample rules:

<rules>
  <rule name="Brickjax Reverse Proxy" stopProcessing="true">
    <match url="^brickjax(.*)$" />
    <action type="Rewrite" url="http://local.brickjax.doodle.co.uk{R:1}"  />
  </rule>
  <rule name="LapTimes Rewrite">
    <match url="^laptimes(.*)$" />
    <action type="Rewrite" url="http://local.laptimes.doodle.co.uk:801{R:1}" />
  </rule>
</rules>

Then when I request https://localhost/ I get the default IIS website, while https://localhost/brickjax takes me to the dev instance of my BrickJax site and https://localhost/laptimes takes me to the dev instance of my LapTimes application:

Other things to check out

Are your applications doing any checking or processing of the incoming request path? If so, you'll need to ensure that you are checking for the correct URL and path - for example I tried to configure a URL rewrite rule for my main production site, which issued a 301 redirect as I'd miss-configured the domain - this response was handed back to my local IIS, which passed it on to the browser, resulting in a different result to the expected.

Again, the Failed Request Tracing is a great help here - look for both RewriteModule and ApplicationRequestRouting they should give you some ideas as to what is happening.