Exposing ArcGIS Server rest services from a single ArcGIS server directory through a firewall?

RobertBuckley1 · ‎03-25-2020

I am not a network specialist first of all. I am a GIS Coordinator for a regional authority and am using ArcGIS Server 10.5 inside our firewall. All rest services can only be seen from inside the organisation. We do have one ArcGIS Server directory out of which I can publish WMS services visible from the internet routed by a reverse proxy in our DMZ.

As I am using more and more ArcGIS Online, it would be nice to use the rest interface to have increased control over my data and maps in AGOL. Therefore I am wondering if I can also expose only those rest services in a certain directory which has been exposed through the firewall.

Could anyone say if this is possible?

BenTurrell · ‎03-25-2020

Hey Robert Buckley‌,

If I understand the question correctly you want to expose only certain services to the public while hiding the others? You could secure all your services except for the ones you want to go out to the public using this: Securing services with users and roles specific to ArcGIS Server—ArcGIS Server Administration (Windo...

If I have missed the mark please let me know!

Thanks,

Ben

If this answer was helpful please mark it as helpful. If this answer solved your question please mark it as the answer to help others who have the same question.

RobertBuckley1 · ‎03-25-2020

Thanks for the reply. The problem here is that my ArcGIS Server is hidden behind the firewall and not reachable from outside my network. Therefore there is not

way to expose any rest services (AFAIK). Saying this though, I have managed to set up a reverse proxy in our DMZ which is able to route https requests to a specific directory.

https://egov3.heidekreis.de/webgis/services/Geoportal/Verwaltungsgrenzen/MapServer/WMSServer?Request...

In this way, I am able to publish WMS services.

Due to the limited nature of WMS it would be very useful to exposes the REST interface but not to all services - I am just thinking only to those is a single directory. I have absolutely no idea though if this is feasable or doable.