While at a client the past week, we spent a few days debugging the following scenario:

 We have an ASP.NET web site with impersonation on hosted on web server A attempting to call a WCF service hosted on web server B (through IIS). When running the application locally on server A the application operates as expected, however if we attempt to access the web site remotely we have a strange socket exception with none of the code for the service being executed. 

Our configuration:  NetTCP or WSHTTP binding with impersonation is on in web.config and anonymous enabled in IIS.  User needed to be properly impersonated by web server call for WCF calls to work properly.

 Here is the error we were receiving:

The socket connection was aborted. This could be caused by an error processing your message or a receive timeout being exceeded by the remote host, or an underlying network resource issue. Local socket timeout was '00:00:30.7500000'.

We tried many different configurations recommended in the following links, but here is what worked for our implementation:

• Created a domain user that can be trusted for delegation using the following instructions: http://technet.microsoft.com/en-us/library/cc739474(WS.10).aspx
• Added the above domain user as the AppPool user for the IIS website and included it as the UserPrincipalName in the Identity section of the endpoint

<identity>
  <userPrincipalName value="domain/user" />
</identity>

Below are some very helpful links that may help you setup your WCF configuration properly:

• How to configure an ASP.NET application for a delegation scenario:
• http://support.microsoft.com/kb/810572
• Authentication delegation through Kerberos does not work in load-balanced architectures:
• http://support.microsoft.com/kb/325608/
• Whitepaper on Kerberos Authentication for Load Balanced Web Sites:
• http://www.microsoft.com/downloads/details.aspx?familyid=035465F0-5090-4F9C-AC44-FC0500769BE9&displaylang=en
• Preventing Anonymous Access blog post 
• http://blogs.msdn.com/drnick/archive/2007/03/23/preventing-anonymous-access.aspx
• How to: Impersonate the Original Caller in WCF Calling from a Web Application:
• http://msdn.microsoft.com/en-us/library/cc949013.aspx