[SOLVED] IIS woes on Server2012R2

[seedubya]

I'm having some issue with accessing IIS from the WAN on this box. It was all working last week however I made some changes. I had to increase the subnet due to a lack of IPs. This seemed to casue the VPN to stop working so I fixed that by removing the role and then re-adding it which worked just fine but now I can't access the Default Web Site from the WAN. In particular, remote employees are trying to access their clock-in system which runs on IIS as an application on the Default Web Site

I have checked and re-checked the router NAT and firewall and the Windows Firewall and all, as far as I can see is good there.
I can browse all hosted sites and applications internally, regardless of the port used.
I cannot browse the default site (bound to ports 8081 and 8443) externally.
If I set up a new test site (not an application) on http port 99 I can browse that no problem but if I make a https binding it stops working.

I suspect it might be to do with the Direct Access wizard and installing Workplace Folders or possibly something to do with Certificates but beyond that I'm stumped. I'm pretty sure the bindings are related too.

I'd be grateful for any help.

 

[FremontPC]

Maybe this can help you troubleshoot it?

https://support.microsoft.com/en-us/kb/284285

 

[TurricanII]

I can browse all hosted sites and applications internally, regardless of the port used.
I cannot browse the default site (bound to ports 8081 and 8443) externally'
I'd be grateful for any help.

Are they accessing the website via the VPN or direclty?

I presume directly. The hardware firewall may have an IP object set up for the web server, and that IP object may have the old subnet mask. Can you check that? Also look for old subnet masks on inbound firewall rules.

Can you create new inbound firewall rules on the IIS box in 'Windows Firewall with Advanced Security'? Create two inbound rules, one for each port, and make sure to tick Domain, Private and Public. Then, on the advanced tab of each rule, change Block Edge Traversal to Allow Edge Traversal . Any joy?

 

[seedubya]

Hi guys. Thanks so much for the replies. Too much going on over the last few days to even get to this. It transpired that the root cause of this problem was Direct Access which I had carelessly enabled while re-running the Remote Access Role installation. Removing the role and the re-installing with just VPN enabled solved the problem immediately.