I am trying to setup RD Gateway / RD Web Access with a separate IIS server acting as a reverse proxy. I have attempted this and currently I'm getting "502 - Web Server received an invalid response while acting as a gateway or proxy server". Let me provide more detail.
I have successfully setup RD Gateway and RD Web Access on our internal network. I had generated an internal SSL cert from my CA and applied that fine to the RD Gateway/Connection Broker/RDSH, etc... As far as the RD Gateway setup goes, I believe everything
was working as it should. Everything was working, but I wanted to have our public domain be the web URL for this site not the internal URL of the server. The only way to really do that is to setup another IIS instance, put that in the DMZ, and bind the
third-party signed cert to the default website (I realize I could buy a security appliance such as the one Barracuda makes, but I'm not ready for that. Also, TMG is no longer available...so here I am with IIS/AAR and reverse proxy). So initially,
I set this up with both servers on the inside of my network and both were joined to the domain. One was hosting the RD Gateway / RD Web Access, and the other server was simply just running IIS with a GoDaddy cert binded to the Default website (apps.mypublicdomain.net). On that server, I had to also install URL Rewrite and ARR (application request routing) extensions. Once I did that, I was able to setup a server farm with the RD Gateway server listed as the one and only server. I then created
a reverse proxy rule using URL rewrite to create a rule for proxying apps.mypublicdomain.net to the inside server name, ex. https://myinsideserverFQDN/RDWeb/Pages/. Surprisingly this worked. I was able to go to apps.mypublicdomain.net and boom
it reverse proxied me to apps.mypublicdomain.net/RDWeb/Pages/...
Now my challenge was to remove the reverse proxy server from the domain and put it in the DMZ. The goal here is the same, reverse proxy to the inside network and go to the RD Gateway server. The RD Gateway server remains on the inside so that
I don't have to open up so many ports from DMZ to Inside. So I did this and now when I go to apps.mypublicdomain.net, I get the IIS server error:
502 - Web Server received an invalid response while acting as a gateway or proxy server.
There is a problem with the page you are looking for, and it cannot be displayed. When the Web server (while acting as a gateway or proxy) contacted the upstream content server, it received an invalid response from the content server.
- So I tried enabling Failed Request Tracing on both IIS servers and nothing comes up in the log folder. There is nothing I see in the application or system logs that would give any clues.
- I tried recreating the URL Rewrite rules and that only seems to create other IIS errors, or the same one as 502.
- I tried removing the URL Rewrite rule altogether and then what happens is I get the default IIS logo if I go to https://apps.mypublicdomain.net. So I know I'm still making it to the server, but just can't reverse proxy.
- If I just go to the internal URL that RDGateway is hosted on, then it still comes up fine.
- I verified that the internally generated SSL cert is imported into the external reverse proxy server's certificate Trusted Certificate Authority folder.
- Currently all ports are open from this server in the DMZ to the open, until I can get this working again. Then I'll be locking it down. It should only require port 443 from IIS to IIS.
So is this a problem with the reverse proxy server because I removed it from the domain? I've heard of other people using IIS ARR, in place of the old TMG, but I'm not seeing many answers to related questions.
Thanks,
Jon