I am trying to move my EDN Arcgis Server with all the mapservices and caches to the DMZ ..

The move is from our intranet to the DMZ to provide access to mapservices to outside world using the internet port 80 or 8080.. Everything is fine when we try accessing applications and mapservices from within our network to this box in the DMZ!!

When it comes to external access it cannot access any ??

I have tried a similar setup using windows xp box in the DMZ! Both internal and external machines can access and works well.. This should account for Network configuration correctness, hopefully..

I am wondering if it has to do with ArcGIS Server on Windows 7 ?? Am I missing something wrt settings with ArcGIS Server or IIS ??

  • Explain your whole network setup in more detail regarding hardware/firewalls and we could help you out. This could be many, many things. – MLowry Sep 7 '11 at 16:42
  • Sounds like a LAN network setting; Windows 7 has the Microsoft internal firewall that may be blocking external IP traffic. Are you able to access the rest endpoints? What about accessing the default.aspx page in the basic IIS setup? – D.E.Wright Sep 7 '11 at 16:48
  • I am trying to add this arcserver to the DMZ to prevent a reverse proxy issue.. Intranet---> DMZ (Arcserver) ---> Internet(outside world)...I am not sure if this is what you wanted.. let me know? – Softnaidu Sep 7 '11 at 16:50
  • @Wright...The internal firewall is turned off on the the Windows 7 machine.. I can access rest endpoints from our intranet.. The Default page is inaccessible externally... – Softnaidu Sep 7 '11 at 16:53
  • Do you have multiple NICs in the machine? maybe you are routing internal users to a 192.168.x.x block but don't have a external address routing to a good subnet. – D.E.Wright Sep 7 '11 at 17:50

This is going to be a long post. Let's start by making some assumptions that will help us in understanding and hopefully solve your problem.

Once we have ruled out network configuration we can focus on ArcGIS.

You said that you have a server in your intranet (let's forget it is running ESRI software for the moment and just focus on the network setup). Let its ip address be with a netmask of and its name be arcserver.

You would tipically access its services from a url like the following:


depending on port configuration (for brevity I will not use port 8080 anymore).

We also gather from your email that this is working and for the moment we assume you only use ip addresses, not names, to consume your server's services.

Now you would like to move this server to the DMZ for the purpose of publishing its services on the internet. This requires that the server's networking be reconfigured. Let's suppose thet your DMZ has a addressing scheme.

This means that after connecting the server into the dmz its ip address would become with a netmask of The default gateway has to change too and in your DMZ it is so you configure your server accordingly. I also assume that you disconnected the server from any other network and left only one configured network interface enabled: that connecting to the DMZ.

Now, supposing that cabling is correct and that the configuration has been applied, you should be able to reach your server from your intranet with a url like:

if this works it means we got all the basic networking setup ok. Now the tricky part: accessing your server from the internet.

In most cases this requires that the following actions have been carried out:

  1. that you established a NAT on your firewall between the private address and a public ip address that you must have on the firewall. Let's say the the public ip address is X.Y.K.Z . If the firewall has a dynamic ip address take note of the current ip address.

  2. you configured your firewall to allow incoming traffic on the external ip address X.Y.K.Z to port 80 or 8080 of the ip address (which is the ip address of the arcgis server in the dmz)

Please note that to complicate matters even more the two steps might have to be carried out in different order depending on your firewall vendor.

Anyway, after your firewall configuration has been modified so that the ip address is accessible from the internet as X.Y.K.Z, call up somebody from outside your private intranet (wife at home would be perfect) and ask her to type this into the browser's address bar:


(again add the 8080 port as required). It should work and display whatever content you have published on your server.

If you have a dynamic ip address the ip address WILL change whenever the firewall reconnects to your ISP. You want a static public ip address if you want to publish resources reliably on the internet.

If it doesn't work the probable culprit is in the firewall (the network firewall, not the server's firewall which I am sure you have disabled by now). I might be able to help you more if you provide more details on your network setup.

Bootnote: I would lose all the ? and ! in your question, they make us anxious ;-).

  • Thanks for the insight.The Antihack tool installed on the machine was the culprit, apparently there was anti-hack tool that had been configured to prevent external access completely. This somehow over-rided the n/w config.. Silly of me , I know.. will have to use more smileys in Questions to ease up I guess ;-):-) This gives me a solution thanks for all the valuable input ;-)) Cheers – Softnaidu Sep 12 '11 at 16:51

Sounds like you need a Reverse Proxy in your setup (based on assumptions as do not administer your network)

"Two Web servers are used in this system architecture: a reverse proxy Web server and the ArcGIS Server Web server. The reverse proxy Web server hides information about the ArcGIS Server Web server running on the internal LAN, such as its real virtual directory names and host name and IP address, from external Internet clients such as Web browsers, Web services clients, and ArcGIS Desktop or Custom ArcEngine applications using Internet connections. The reverse proxy Web server is typically located in a perimeter network also known as a DMZ, demilitarized zone, or screened subnet. Inside the DMZ, the reverse proxy Web server receives incoming HTTP requests from the Internet, usually through an external firewall that restricts traffic to a known port, typically port 80, and redirects them to the ArcGIS Server Web server in the internal LAN through a port in the internal firewall, unknown to the outside world. "


  • Thanks for the reply.The Reverse Proxy does not serve my purpose.. Besides if the current set up works on a WIN XP IIS 5.1 set up with ArcGIS Sever 10..why wouldn't it work with Windows 7 ? is my question in a simple sense.. – Softnaidu Sep 7 '11 at 17:10
  • Works on our Windows 7 (64bit) setup with IIS7 (with IIS6/5 rollback) and 2008 R2 Datacenters – Mapperz Sep 7 '11 at 21:43
  • No solution yet!! Here are some options that I have tried on this machine.. 1) Unistalled IPV6 to see if that is causing problems with the static IPV4 address. 2) Checked to see IIS 7 is configured for downward compatibility.@Mapperz 3) checked to see if machine is listening on port 80 using Netstat -ano command 4) Wfetch to check on the log messages returned when we hit the machine as an External User using Interet... – Softnaidu Sep 9 '11 at 19:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.