2

The background of my server

I installed the ArcGIS server 10.3.1 (No Web Adaptor installed)

I have Windows 2012 Server x64 with SQL Server 2012 R2.

I'm also using IIS 8 as a web server on the same machine.

I am wondering if I could disable the external access to the link for the ArcGIS Server Manager.

For example, assuming the link is http://gisserver.domain.com:6080/arcgis/manager/. Could I know if there is a way to disable/block the external users to access to the link?

ArcGIS Server Manager

5
  • 1
    Block the port 6080 on your firewall and install web adapter. The whole reason for web adapter is to wrangle port 80 to 6080 to prevent external access... The firewall will only allow communication on port 80 but the admin interface is on 6080 so is blocked by the firewall forcing communication to use the standard port; only users inside the firewall can access the admin port. – Michael Stimson Mar 31 '17 at 4:00
  • Do you mean external to your network, or external to the machine running the manager? Ie, do you want to be able to access the manager from a browser on another PC on the same network, or only from a browser on the machine on which the manager is running? – Son of a Beach Mar 31 '17 at 4:05
  • Hi Michael, I appreciate your opinions. Your suggestions meets what I need. However, I am wondering if it is possible to use the feature in the IIS server to prevent the external access instead of the web adaptor. – user3320249 Mar 31 '17 at 4:25
  • I have absolutely no idea about the capabilities of web servers.. I do not pretend to be an expert on IIS but have worked with it in the context of ArcGIS Server. For this sort of question you would be much better off asking on SuperUser superuser.com as that has nothing to do with GIS at all. – Michael Stimson Mar 31 '17 at 4:52
  • Cross-posted from stackoverflow.com/q/43103790/820534 – PolyGeo Mar 31 '17 at 4:56
3

Configure a firewall rule either on the machine itself, or on your network firewall to block access to ports 6080 (http) and 6443 (https) for anything other than the local host and the host that has the web server (which may or may not be the same host).

NB: You may not actually need either Web Adaptor, nor an IIS reverse proxy if your firewall rule does all that you need. It depends on if you use the PC's firewall or the network firewall, and if you are OK with other users on the same network accessing the manager or only users on the manager host itself. If you would clarify this, then it may be possible to provide a simpler answer.

If you do require control within your web server and do not want to use Web Adaptor, then...

Use reverse proxy settings on your web server to configure a different URL on which the manager can be accessed. I'm not sure of how to do this in IIS, but in Apache it's fairly straightforward, and the Esri website even has instructions for this at:

http://server.arcgis.com/en/server/10.3/administer/windows/using-a-reverse-proxy-server-with-arcgis-server.htm

See if you can find equivalent instructions for IIS. Googling for "iis reverse proxy" seems to show relevant results (but I'm more of an Apache person, so I don't know how relevant they really are.)

Then on the web server you can configure rules as to who (or what) can access this new reverse proxy URL.

1
  • I appreciate your valuable information. I tried to follow your instruction to create the Inbound Rules to block the program "ArcGIS Servier Manager" ("~\ArcGISServer\Server\framework\etc\service\bin\ArcGISServer.exe"). I will keep you all updated. – user3320249 Mar 31 '17 at 19:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.