IIS7 / 2008 Sql / Service Connections
While trying to connect a SQL Server to a 2008 server, I noticed a change in the 2008 IP stack that left me a little confused. I'm looking for either an OS way to override this, or a programmatic way in .NET to override this.
For this argument, let's say I have a web server with multiple IPs on a multiple site server, connecting to multiple resources (web service, sql, etc.) behind a firewall.
SERVER IP: 10.10.10.1
SITE1 IP: 10.10.10.10
SITE2 IP: 10.10.10.11
SQL SERVER: 10.10.10.2
WEB SERVICE: 10.10.10.15
The firewall is set up, naturally, to deny everything, to allow only what is needed. In other words:
ALLOW FROM 10.10.10.1 TO 10.10.10.2
ALLOW FROM 10.10.10.1 TO 10.10.10.15
DENY ALL
Prior to Windows 2008, Windows 2000/2003 always used the machine's IP address (10.10.10.1) when requesting network resources. Thus, the firewall rules were met and access was granted. In 2008 it appears to be picking the closest match:
Connection to 10.10.10.2 comes from IP 10.10.10.1. The firewall is happy. Connecting to 10.10.10.15 comes from IP 10.10.10.11, the firewall prohibits connections.
Removing all virtual IPSs from the NIC of course makes everything work because each one will appear on 10.10.10.1
Now I understand a little that this machine has two network adapters, it makes sense due to changes in RFC3484 and IPv6 implementation ( http://support.microsoft.com/kb/968920 ) and strong / weak host model, but for life I don't understand why this had to change, how IP works with one NIC.
I have support open, and I'm not going anywhere. I can hear the muttering "just open your firewall to allow 10.10.10.11 connections." This is impractical. This would mean adding an allow rule for each ip address on a multi-user identical machine for windows 2008 only. I can't believe more holes in your firewall for the ips 2008s package alone is a good answer.
Is there a way to disable this "feature" in 2008 at the machine level? Is there a way to disable this in .NET at the machine level? Is there a way to disable this for each connection (SqlConnection, WebClient)?
a source to share
You see the side effect of calculating automatic routes. When multiple addresses have a route to an address and automatic metrics (in Advanced settings ... in TCP), Windows will try and predict the "fastest" path to that address.
I suspect both of your interfaces (virtual or otherwise) have similar route metrics, so the choice is not deterministic. You can encourage him to use his "return" address by setting a higher route metric to your .10 / .11 addresses. With auto metrics disabled, you can also specify an explicit static route using your 10.10.10.1 address.
More on TechNet - Search the page for automatic metrics.
http://technet.microsoft.com/en-us/library/bb727001.aspx
For better or worse. If both interfaces advertise a path with equal metrics, either interface can win. Behavior in the past was non-deterministic - it has changed.
The best approach is to use route
on the command line to create a static persistent TCP route with the lowest or lowest cost between .1 and .2. Alternatively, increase the cost of each route at addresses .14 and .15. I would use the former as there is less support and fewer side effects for other communications.
a source to share