Sites in IIS not available externally

Question

I'm trying to access my IIS test site using the server IP. Internally I have no problems, but externally it tries for a while and then times out.

I've run Shields Up and it shows that there are no open ports. It's a 1&1 VPS server running Windows Server 2003 so I assume there would be no firewall blocking in the middle. I've read somewhere that I may have to make changes in Administrative Tools > Local Admin Settings to allow access to port 80, but I don't know where to begin looking in here.

Edit:

I am accessing the server using its external IP address, the same I use to log into RDP. 1&1 also provide all VPSs with a subdomain which resolves to the server, which again is fine for RDP but fails with IIS over port 80. Using both the IP and subdomain on the server itself return the site successfully.

Solution 1

Have you checked is Windows Firewall is on? If it is, you should either disable it or (better) allow incoming traffic to port 80.

Also, are you behind some NAT? You can check it quite easily: run IPCONFIG on the server and have a look at its IP address; if it's different from the external one, then there's some NAT in te middle, and you need your provider to properly configure it.

Last chance, even if you have no firewall on your server and it's actually sitting on its public IP address, there actually could be some firewall in the middle, so you should check that with your provider, too.

Solution 2

The first basic test is to use telnet.exe to connect to the port:

        telnet <ip address> 80

If you get a 'Connection refused' error then the port is not open.

Also WS 2003 has a firewall: type firewall.cpl and you should see the local control panel.

Solution 3

I have a 1&1 VPS as well, and what I did was run the Security Configuration Wizard

http://www.microsoft.com/windowsserver2003/technologies/security/configwiz/default.mspx

After going through all of this, and setting everything up how I wanted, I was able to have complete control over everything on the server.

I'm sure there is a more complicated way of doing this, but I was impressed with this tools ease of use.

Comments

[Beel]

Rob, sorry to ask the obvious but just to get it out of the way, are you using an internal address to access the server, such as 10.x.x.x, 172.16.x.x, 192.168.x.x ? In other words, is the address of the IIS server in one of those ranges? If so, please clarify what you mean by internally and externally.

[Oskar Duveborn]

+1 Very good suggestion, the secwizard is an awesome base for hardening a windows server... and in this case it most likely will help you open up port 80 as well - by detecting IIS.

[Massimo]

Thank you very mouch for the bounty, but now I'm curious as to what the issue was :-)