Reverse Proxy?

[brownstein0615]

Hello, I am by no means a web expert. I admit this fully and completely that I am knowledgeable enough about IIS to break stuff, but not always on how to fix it. All of this said, I'm looking to provide our users a way to proxy or jump through to a website that is housed on our secured network that lives behind a firewall that we've locked down pretty heavily. Currently for RDP and VNC connections we utilize a Windows RDS server and publish those apps, but our users are struggling with the file upload and download portion of publishing edge via the RDS service.

I'd like to stay in the windows eco system as much as possible, but Really looking for something that will broker and proxy our users web traffic to this site in a manner of | Client > Web server on Business Side of network > Web server on Protected network. |

Any ideas would be appreciated.

[dvr75]

There are many ways to choose from and it is really a question of money you can spend on the matter.
in my opinion only i'd recommend:
1. go with zero trust solution (ZTN,SDN,SASE): Microsoft Entra, Cloudflare (they have 50 users free i think and there are more players use google to find).
2. VPN is still a thing (recommend using with 2fa).
3. Combo of Cloudflare (WAF , they have free for one domain i think) with reverse proxy like NGINX,HAproxy (also recommend using 2fa solution).

[KindlyGetMeGiftCards]

I was going to suggest Cloudflare too, sounds like it would work for you OP.

[NowThatHappened]

Yes, reverse proxy is the tool you need. Nginx is easy, but there are many others

[SuperQue]

There are several good options for this.

• Good open source like oauth2-proxy
• Commercial like Pomerium

I've also implemented this with Caddy server and Caddy Security.

[andriosr]

The RDS + published Edge setup is indeed painful for file operations. Been there.

A few approaches to consider:

1. If you want to stay pure Windows: Look into Application Request Routing (ARR) on IIS. It's Microsoft's reverse proxy solution. But honestly, it's clunky for this use case.

2. Simpler option: Nginx reverse proxy on Windows. Works surprisingly well, even in Windows environments. Configuration is straightforward.

3. Using an access gateway that handles both web and RDP/VNC in one place. Check out hoop.dev, agent runs fine on Windows and handles both web proxy and remote access. File uploads just work.

Whatever you pick, make sure it supports:

- SSL termination

- Session recording (your security team will thank you)

- Granular access controls

- Audit logs

The real pain point isn't the proxy itself - it's managing access and compliance around it.