# IIS ARR reverse proxy: put Node, Java or Python behind IIS

> Install ARR and URL Rewrite, enable proxy, create a server farm, preserve Host/X-Forwarded headers, and avoid turning IIS into an open proxy.

**Tested on**

- Build: 26100.33650
- Edition: Standard / Datacenter
- Architecture: x64
- Evidence: E1
- Verified: 2026-10-29

## The short answer

ARR (Application Request Routing) turns IIS into a **reverse proxy**. It forwards a request to an upstream server/farm and returns the response.

Use it when:

- IIS terminates TLS and Node/Java/Python listens on `127.0.0.1:3000`;
- you need one hostname in front of several app servers;
- you want IIS logging/compression/health checks in front of Kestrel/Tomcat.

Do not use URL Rewrite alone: a rewrite changes the URL IIS serves; ARR forwards to another server.

## Install

ARR requires URL Rewrite. Install both x64 modules, then:

```powershell
Get-WebGlobalModule -Name ApplicationRequestRouting
Get-WebGlobalModule -Name RewriteModule
```

In IIS Manager → server → **Application Request Routing Cache** → **Server Proxy Settings** → enable proxy. Without this, farm rules return 404/502.

## Server farm

1. **Server Farms → Create Server Farm**.
2. Add `127.0.0.1:3000` (or the app server).
3. Health test: a path that returns 200 without auth.
4. Proxy settings: preserve Host header, forward `X-Forwarded-For`/`X-Forwarded-Proto`.
5. Create a URL Rewrite rule that routes the site to the farm.

A minimal rule shape:

```xml
<rule name="Proxy to app" stopProcessing="true">
  <match url="(.*)" />
  <action type="Rewrite" url="http://appfarm/{R:1}" />
</rule>
```

The farm name in the action must match ARR’s farm, not a random hostname.

## Headers and redirects

- Preserve `Host` so the app generates correct absolute URLs.
- Forward `X-Forwarded-Proto` so the app knows the client used HTTPS.
- If the app redirects to `http://` or its internal hostname, fix the app’s trusted proxy settings; do not disable HTTPS redirects globally.
- WebSocket needs ARR/URL Rewrite support and matching timeouts.

> **Danger: Do not build an open proxy**
>
> An ARR rule that proxies arbitrary destinations is an SSRF/open-proxy risk. Route only to known upstreams, restrict the site to the management network, and do not let user input choose the target URL.

## Verify

```powershell
curl.exe -I https://lab.example/
curl.exe -H "Host: lab.example" http://127.0.0.1/
Get-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' `
  -Filter 'system.webServer/rewrite/rules' -Name '.'
```

Check:

- response comes from the upstream (app header/body);
- `X-Forwarded-For` reaches the app;
- redirects use the public hostname;
- upstream down returns a controlled 502/503, not a hang.

## When not to use ARR

- Static site: IIS alone.
- Need HTTP/3 at the edge on Windows: ARR/IIS HTTP/3 support is version-specific; test it, do not assume.
- High-scale reverse proxy: a Linux Nginx/HAProxy tier is often a better fit. ARR is convenient on Windows, not a universal load balancer.

## Lab boundary

This is E1. The lab installed IIS and PHP but not ARR; no upstream farm or header test was reproduced. Install it on Server 2025 before claiming E2.

## Sources

- [Microsoft Learn — Reverse proxy with URL Rewrite and ARR](https://learn.microsoft.com/en-us/iis/extensions/url-rewrite-module/reverse-proxy-with-url-rewrite-v2-and-application-request-routing)

---

Source: https://windows.homes/en/server/web/iis-arr/