Windows Server 2022 — IIS ARR reverse proxy returning 502.3 timeout errors — Fix & Prevention

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution — Primary Fix
7. Solution — Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

IIS ARR front-end returns HTTP 502.3 when backend response exceeds proxy timeout or connection fails intermittently. End users see random outages despite front-end health.

Environment & Reproduction

Typically seen with high-latency API backends, long-running requests, or mis-sized ARR timeout/retry settings.

Get-WinEvent -LogName Application -MaxEvents 50 | Where-Object {$_.Message -match '502.3|ARR'}
Test-NetConnection -ComputerName  -Port 443
Get-Content C:/inetpub/logs/LogFiles/W3SVC1/u_ex*.log -Tail 100

Root Cause Analysis

ARR timeout defaults are too low for backend behavior, or backend intermittently stalls due resource pressure, thread pool starvation, or TLS trust errors.

Quick Triage

Confirm backend reachability and isolate if failures are network, TLS, or application latency related.

Invoke-WebRequest -Uri 'https:///health' -UseBasicParsing
Get-Counter 'Web Service(_Total)Current Connections'
netsh winhttp show proxy

Step-by-Step Diagnosis

Inspect ARR/serverProxy settings and failed request traces to map exact timeout phase.

%windir%/system32/inetsrv/appcmd list config -section:system.webServer/proxy
%windir%/system32/inetsrv/appcmd list config '' -section:system.webServer/rewrite/rules
Get-ChildItem C:/inetpub/logs/FailedReqLogFiles -Recurse -ErrorAction SilentlyContinue

Solution — Primary Fix

Increase ARR timeout for known long-running routes, optimize backend health, and recycle app pools.

%windir%/system32/inetsrv/appcmd set config -section:system.webServer/proxy /timeout:00:05:00 /commit:apphost
%windir%/system32/inetsrv/appcmd recycle apppool /apppool.name:''
iisreset /noforce

Solution — Alternative Approaches

Create route-specific rewrite/proxy rules or split heavy endpoints to dedicated backend pool with tailored timeout budgets.

%windir%/system32/inetsrv/appcmd set config '' -section:system.webServer/rewrite/rules /+"[name='api-long',patternSyntax='Regular Expressions',stopProcessing='true']" /commit:apphost

Verification & Acceptance Criteria

502.3 rates drop to baseline, backend latency is within new timeout envelope, and synthetic probes stay green.

Invoke-WebRequest -Uri 'https:///api/slow-endpoint' -UseBasicParsing
Get-Content C:/inetpub/logs/LogFiles/W3SVC1/u_ex*.log -Tail 200 | findstr 502
Get-WinEvent -LogName Application -MaxEvents 20 | Where-Object {$_.Message -match '502.3'}

Rollback Plan

If increased timeout causes queue pressure, revert proxy timeout and roll back rewrite route changes.

%windir%/system32/inetsrv/appcmd set config -section:system.webServer/proxy /timeout:00:00:30 /commit:apphost
iisreset

Prevention & Hardening

Define endpoint SLO-based timeout classes, baseline backend latency, and alert on rising 502.3 before user impact widens.

Get-Counter 'Web Service(_Total)Current Connections'
Get-Counter 'ASP.NET Applications(__Total__)Requests Queued'

Related Errors & Cross-Refs

Related to HTTP 504 upstream timeout, backend TLS trust failures, and ARR connection pool exhaustion under burst load.

View all Windows Server 2022 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

Microsoft IIS ARR proxy documentation, failed request tracing references, and reverse-proxy tuning best practices.