Skip to content
WinBookUnofficial

IIS ARR reverse proxy: put Node, Java or Python behind IIS

Verified 2 min read

Install ARR and URL Rewrite, enable proxy, create a server farm, preserve Host/X-Forwarded headers, and avoid turning IIS into an open proxy.

Tested onStandard / Datacenter · Build 26100.33650 · x64
E1
Build
26100.33650
Edition
Standard / Datacenter
Architecture
x64
Support
Documentation (E1)
Evidence
E1Official documentation
Verified
2026-10-29
Page type
Task

The short answer

Section titled “The short answer”

ARR (Application Request Routing) turns IIS into a reverse proxy. It forwards a request to an upstream server/farm and returns the response.

Use it when:

  • IIS terminates TLS and Node/Java/Python listens on 127.0.0.1:3000;
  • you need one hostname in front of several app servers;
  • you want IIS logging/compression/health checks in front of Kestrel/Tomcat.

Do not use URL Rewrite alone: a rewrite changes the URL IIS serves; ARR forwards to another server.

Install

Section titled “Install”

ARR requires URL Rewrite. Install both x64 modules, then:

Terminal window
Get-WebGlobalModule -Name ApplicationRequestRouting
Get-WebGlobalModule -Name RewriteModule

In IIS Manager → server → Application Request Routing Cache → Server Proxy Settings → enable proxy. Without this, farm rules return 404/502.

Server farm

Section titled “Server farm”
  1. Server Farms → Create Server Farm.
  2. Add 127.0.0.1:3000 (or the app server).
  3. Health test: a path that returns 200 without auth.
  4. Proxy settings: preserve Host header, forward X-Forwarded-For/X-Forwarded-Proto.
  5. Create a URL Rewrite rule that routes the site to the farm.

A minimal rule shape:

<rule name="Proxy to app" stopProcessing="true">
  <match url="(.*)" />
  <action type="Rewrite" url="http://appfarm/{R:1}" />
</rule>

The farm name in the action must match ARR’s farm, not a random hostname.

Headers and redirects

Section titled “Headers and redirects”
  • Preserve Host so the app generates correct absolute URLs.
  • Forward X-Forwarded-Proto so the app knows the client used HTTPS.
  • If the app redirects to http:// or its internal hostname, fix the app’s trusted proxy settings; do not disable HTTPS redirects globally.
  • WebSocket needs ARR/URL Rewrite support and matching timeouts.

Verify

Section titled “Verify”
Terminal window
curl.exe -I https://lab.example/
curl.exe -H "Host: lab.example" http://127.0.0.1/
Get-WebConfigurationProperty -PSPath 'MACHINE/WEBROOT/APPHOST' `
  -Filter 'system.webServer/rewrite/rules' -Name '.'

Check:

  • response comes from the upstream (app header/body);
  • X-Forwarded-For reaches the app;
  • redirects use the public hostname;
  • upstream down returns a controlled 502/503, not a hang.

When not to use ARR

Section titled “When not to use ARR”
  • Static site: IIS alone.
  • Need HTTP/3 at the edge on Windows: ARR/IIS HTTP/3 support is version-specific; test it, do not assume.
  • High-scale reverse proxy: a Linux Nginx/HAProxy tier is often a better fit. ARR is convenient on Windows, not a universal load balancer.

Lab boundary

Section titled “Lab boundary”

This is E1. The lab installed IIS and PHP but not ARR; no upstream farm or header test was reproduced. Install it on Server 2025 before claiming E2.

Sources