3

In my little lab I want to use SSTP VPN AND a HTTPS-Webpage, which should be accessible from the internet. I just have 1 public IP and the lab is behind NAT (Port forwarding 443). SSTP already works great and also my webpage is accessible! But clearly not over the same port:443!

Current Infrastructure:

[gateway <- windows server 2012 R2 with SSTP]
[webserver <- ubuntu server with apache and a single https webpage]
[router <- standard router which forwards the 443 to... one of the above]

Is there a way to use some kind of proxy/reverseproxy/ssl-redirect to use the 443 port for both services? How would you do that? I wish to configure something on the gateway to redirect all non-sstp-traffic (maybe getting the http.sys directly?) to the ubuntu server...

any idea?

dataCore
  • 206
  • 3
  • 7
  • 1
    Nope. One service per ip/port combo. Something has to use a different port. – quadruplebucky Feb 26 '14 at 10:30
  • 1
    There are ways you could do it with certain "non-standard" routers and dirty tricks like OS fingerprinting or layer 7 snooping but I'm not going to entertain that any further. – quadruplebucky Feb 26 '14 at 10:34
  • so there is no way to "inspect" all incoming traffic over 443 before he goes to the https.sys and then decide, to which other server the traffic should go? – dataCore Mar 06 '14 at 15:13
  • 1
    @quadruplebucky: Uuu... and what do you think about this article? http://blogs.technet.com/b/rrasblog/archive/2007/11/08/configuring-iis-on-the-sstp-server-implications-and-how-to-resolve.aspx?Redirected=true and this one? https://blogs.technet.com/b/rrasblog/archive/2007/01/25/sstp-faq-part-3-server-specific.aspx?Redirected=true – dataCore Mar 06 '14 at 15:18
  • That's fine but logically (cryptographically) you're multiplexing a *single* service. Which is not what you asked. – quadruplebucky Mar 08 '14 at 22:23

3 Answers3

2

Obviously the question is quite old but doing this is possible if you're willing to reconsider your chosen web server. Obviously you already have a Windows Server 2012R2 server so, in order to reduce complexity, there's no reason why you can't use IIS 8.5 to host your https site. I actually use this myself along side an SSTP VPN but I've also given you another option beneath the screenshot.

Once you have set the site up in IIS, create an https binding on the site to use a host header (Host name:) appropriate to the domain name of the site. This is how IIS knows which site to send the request to - yes, this means you can have multiple SSL websites on your IIS server too. I have a single certificate with multiple subject alternative names (SAN cert) that I use for both my SSTP VPN and the websites hosted on my IIS server, though you should be able to use separate certificates if you so wish.

Bindings

You should also investigate Server Name Indication which is supported by IIS, though not enabled on my server.

http://en.wikipedia.org/wiki/Server_Name_Indication

If you desperately need to keep your Ubuntu box, install the Web Application Proxy role (sub-role of the Remote Access role) on to the Windows Server 2012R2 server (this role is new in 2012 R2). Configure that using the Remote Access Management Console (not RRAS console). Publish a web application using pass-through, define an external URL (the one external users will type in and resolve to your external IP and then an internal URL (that the Web Application Proxy server can resolve to your Ubuntu server's internal IP (HOSTS file works fine!). Use the SSL cert that you would have put on your Ubuntu box where it asks for a certificate. You can choose to not bother with defining SSL on your Ubuntu box and essentially let the Web Application Proxy service do SSL offloading. One thing to bear in mind is that your web server logs will show the WAP server's IP, not the user's external IP.

Two options there. Personally, I'd go with a single IIS 8.5 server to minimise estate sprawl :)

-Lewis

Lewis
  • 697
  • 4
  • 6
  • Importend for me is: how can you run "SSTP VPN" AND "HTTPS Page(s)" on the same Windows 2012 R2 Server? Cause SSTP isn't something you can host in IIS... – dataCore Feb 01 '15 at 17:40
  • Windows Server 2012 R2 is intelligent enough to understand when it's an SSTP connection or an HTTPS request. As I said, I do this myself using Windows Server 2012 R2. I have RRAS installed and SSTP configured, I also have IIS 8.5 installed and have several HTTPS sites configured - all on the same server and there is no issue. What have you tried? – Lewis Feb 13 '15 at 14:31
  • Don't get confused thinking about it. Set your SSTP VPN up and get it working, then set up IIS, create a site and give it an HTTPS binding and you'll see that it just works. – Lewis Feb 13 '15 at 14:39
  • Is the installation order relevant? – dataCore Feb 16 '15 at 09:20
  • ............Nope – Lewis Mar 06 '15 at 13:55
0

I think there is, but you'll need an extra windows server 2012 R2: a reverse proxy. you could try this site for how to: http://blogs.technet.com/b/rrasblog/archive/2007/03/07/configuring-sstp-in-a-reverse-proxy-scenario.aspx.

Here you 'll find a blog on how to setup the reverse proxy (called web application proxy) http://www.schmarr.com/Blog/Post/13/Installing-Reverse-Proxy-on-Windows-Server-2012-R2-(Web-Application-Proxy).

technet info from MS themselves: technet.microsoft.com/en-us/library/dn584113.aspx.

So the goal is: you forward port 443 from FW to the reverse proxy, and based on the FQDN the proxy forward the request to the correct server.

At this time we have a wap for several https servers, but didn't try that for now for a SSTP.

Good luck with it.

roeland
  • 1
  • Please don't post link-only answers as links tends to go dead over time, but put some of the important info from the links into your answer and refer the links as the source. – Frederik Feb 13 '15 at 14:22
0

You can achieve this using a multiplexer: http://www.unixmen.com/sslh-a-sslssh-multiplexer-for-linux/

user3015010
  • 19
  • sslh does not support SSTP. – Theveloper Jul 17 '17 at 00:02
  • This isn't true. SSLH can handle SSTP. You would need to use SNI to make sure any RWA https request or SSTP packet is routed to the IIS server on the LAN. Transparent mode is a bit more complex though. – James White Jan 02 '20 at 08:01