Sophos UTM is a great Reverse Proxy solution. However, it currently lacks the capability to redirect a request.
There are several reasons you might want to redirect a site, but the most common scenario is to temporarily take a site offline and display a 'Site Under Maintenance' page instead. This is far better for a public site than to simply drop off the Internet or start showing an error if someone attempts to connect to the site during maintenance.
In this article, I'll take you through you how to setup a URL redirect using Microsoft IIS and Sophos UTM's Web Server Protection feature.
The reason I specifically mention an existing IIS server is because your redirector will typically only be used periodically. Since it won’t really handle any load, as it only serves 302 redirects, it makes no sense to deploy a complete separate Windows Server (even if it is a virtual one).
Before we start make sure the HTTP Redirection feature is installed on your IIS server:
The following steps are all preformed from the IIS Management console:
IIS Bindings allow you to have multiple sites on the same server, on the same IP, on the same port. This is the right way to host multiple sites. We have already specified 'redirector' as a hostname for our site, but you are most likely passing the host header for your public site in your publishing rule.
To accommodate for this we add a similar binding to our redirector:
To actually enforce the URL redirect on the public internet site, we also need to configure Sophos UTM's Web Application Firewall. We have to add the redirector server as a real webserver for the UTM to use. To do this:
The following steps will actually cause the public site to redirect. So only do this when you are ready to redirect the site:
This should be all that is required to enable the URL redirect. Once the site maintenance is complete, simply reverse the steps in the last procedure to get the normal site back up and running.
If you have a public site for a brand that has numerous sub-brands, domains or old sites aliased to the main public site, you need to accommodate for those names too. A couple of entries are easy enough to add manually. But if you have more than a couple, you can export and import to configure them faster.
For the import, we are going to use a very simple PowerShell script. Since you are likely to only do this very infrequently let’s do it from the ISE.
foreach ($bindname in get-content C:\install\binding.txt)
New-WebBinding -Name "redirector" -IPAddress "*" -Port 80 -HostHeader $bindname
Check the IIS site's bindings to confirm that all of the hostnames are imported. This means all of the public names will be correctly redirected.
By implementing this work-around, you can extend the functionality of Sophos UTM's Web Application Firewall to redirect 'under maintenance' web sites. For former Forefront TMG administrators who used redirects frequently, this is hopefully a good substitute!
Download the free 30 day trial, or schedule a demo and we'll show you how it works!
Easy WAN Emulation for Application Testing
Deploying Endpoint Protection with Sophos UTM and Enterprise Console