API (HTTPS) Reverse Proxy

Setting Up a Reverse Proxy on Windows Server for HTTPS #

Choose IIS if you want tight Windows integration or Nginx for high performance. Here’s how to set one up on Windows:

Option 1: Using IIS as Reverse Proxy (Recommended for Windows) #

Step 1: Install IIS and required modules #

You need 2 IIS modules: 1. URL Rewrite 2. Application Request Routing (ARR).
If you are not seeing them in IIS restart IIS or download and install the modules manually.

# Install IIS
Enable-WindowsOptionalFeature -Online -FeatureName IIS-WebServerRole
Enable-WindowsOptionalFeature -Online -FeatureName IIS-WebServer
Enable-WindowsOptionalFeature -Online -FeatureName IIS-ApplicationDevelopment

# Install URL Rewrite Module (required for reverse proxy)
Invoke-WebRequest -Uri "https://download.microsoft.com/download/1/2/8/128E2E22-C1B9-44A4-BE2A-5859ED1D4592/rewrite_amd64_en-US.msi" -OutFile rewrite.msi
Start-Process msiexec.exe -ArgumentList '/i rewrite.msi /quiet' -Wait
Invoke-WebRequest -Uri "https://download.microsoft.com/download/E/9/8/E9849D6A-020E-47E4-9FD0-A023E99B54EB/requestRouter_amd64.msi" -OutFile router.msi
Start-Process msiexec.exe -ArgumentList '/i router.msi /quiet' -Wait
Remove-Item rewrite.msi
Remove-Item router.msi

Step 2: Create new Website #

  1. In IIS, add new Website
  2. Add HTTPS binding with your valid certificate

Step 3: Configure Reverse Proxy in IIS #

  1. Open IIS Manager (inetmgr)
  2. Open ServerEngine API website
  3. Open “URL Rewrite” feature
  4. Add a new Reverse Proxy rule:

Run this PowerShell script to allow API Ports in your Firewall settings:

# Define all ports to check/create
$portsToConfigure = @(
    @{Port=5555; Name="Allow ServerEngine API (5555)"}
)

foreach ($portConfig in $portsToConfigure) {
    $existingRule = Get-NetFirewallRule -DisplayName $portConfig.Name -ErrorAction SilentlyContinue

    if (-not $existingRule) {
        try {
            New-NetFirewallRule -DisplayName $portConfig.Name `
                               -Direction Inbound `
                               -Protocol TCP `
                               -LocalPort $portConfig.Port `
                               -Action Allow `
                               -Profile Any `
                               -Enabled True
            
            Write-Host "Created firewall rule for port $($portConfig.Port)"
        }
        catch {
            Write-Host "Error creating rule for port $($portConfig.Port): $_" -ForegroundColor Red
        }
    }
    else {
        Write-Host "Rule '$($portConfig.Name)' already exists" -ForegroundColor Yellow
        
        # Ensure existing rule is enabled
        if ($existingRule.Enabled -ne "True") {
            Set-NetFirewallRule -DisplayName $portConfig.Name -Enabled True
            Write-Host "Enabled existing rule for port $($portConfig.Port)"
        }
    }
}

Now access your API via https://server-name:5555/

What if you cant access your API via https?

Sometimes ARR wont enable the reverse proxy routing, so you have to enable it. In IIS go to server then double-click “Application Request Routing”:

Click on “Server Proxy Settings”

And make sure Proxy is enabled 🙂