4

My network has an exchange server and an apache server hosting a web site.

Exchange is 192.168.1.10

Apache is 192.168.1.12, secured with SSL

Router/firewall is 192.168.1.1

My external static ip address (for example) is 1.1.1.1 www.aaa.com

I have set up my router to port forward 80 and 443 to 192.168.1.12

So when I browse to www.aaa.com it will show the web site only.

Doing this prevents external access to the Exchange server through a mobile phone, since 443 is going only to the web site.

Is there a way to configure this so that the mail based traffic can be passed through the web server onto the email server? I tried to look into subdomains for apache (for example calling the mail domain mail.aaa.com) but I am not clear on what I am trying to achieve so couldn't work out what I was looking for.

Darren
  • 51
  • 1
  • Did you need SSL on the Website? If you keep the 443 port for Exchange and use the Port 80 only for the Apache server it might work (depending on your Exchange Version and how Auto Discover is configured). So your Exchange version would be also useful to know. – BastianW Feb 22 '17 at 08:34
  • Unfortunately yes the web site needs SSL, so that's where the problem lies. – Darren Feb 23 '17 at 00:18
  • What is your router? If you'd employ Microsoft TMG as a router/firewall, it can publish 192.168.1.10:443 as one name, 192.168.1.12:443 as another name, and you can then configure your IIS to bind on 192.168.10.443 and have both birds down with one shot. Other routers that can terminate SSL connections should be able to do the same. – Vesper Mar 10 '17 at 10:45
  • Additionally, you can change IIS port on your Exchange Outlook Anywhere connector to say 444, and port forward on your router 1.1.1.1:444 to 192.168.1.10:444, together with changing those bindings. This will however require you to port forward 80 into your autodiscover website (on IIS), thus rendering Apache available only on port 443. – Vesper Mar 10 '17 at 10:48

2 Answers2

1

Yes it is possible, but you will need to configure Apache as a reverse proxy for Exchange.

Since you need coexistence of the web server for www.aaa.com, you will also need to configure another name for exchange. Indeed, you will need 2 names only for exchange, autodiscover.aaa.com and something like owa.aaa.com or outlook.aaa.com.

  1. Configure virtual host external URL for Exchange external URL (autodiscover, owa, ...)
  2. Setup the public DNS to point all those name to 1.1.1.1 (your router public IP)
  3. Keep redirection of 80 and 443 to 192.168.1.12
  4. Add virtualhost to apache configuration to setup reverse-proxy (you can check https://github.com/phr0gz/Apache-reverse-proxy-for-Exchange-2010-2013-2016/blob/master/webmail.conf for reference)

If the configuration of apache is too much trouble, you can also add a reverse-proxy base on IIS and setup the redirection to that server. It'll be in charge of directing trafic to apache or Exchange based on the name. More for that topic : https://blogs.technet.microsoft.com/exchange/2013/07/19/part-1-reverse-proxy-for-exchange-server-2013-using-iis-arr/

Michaël Bozio-Made
  • 11
  • 2
0

What you're probably looking for is an ingress controller supporting something called "SNI" (server name indication), which can be used to create virtual hosts based on the host name being accessed. You can use Apache, as @michaël-bozio-made suggested. You can also use a number of other web servers, like nginx, or dedicated load balancer applications like haproxy (my preference). With any of those solutions, you would forward port 443 to the ingress controller application (also possibly called an "application firewall" or similar), and then have the controller relay connections to the appropriate backend server (which could be on any port you choose now) based on whatever criteria is appropriate - the hostname the client requested, in this case. You could also theoretically use /exchange on the URL for your web server to proxy through to the exchange server (look at the mod_proxy documentation), but some applications don't like being hidden behind a URL prefix. This is, at a high level, how large-scale sites generally work.

You other option is to use an alternate port for one of the services. For example, you could forward 8443 to Exchange, so clients would use https://exchange.yourdomain.com:8443/ as the URL (assuming you are not actually running the aaa.com web site for the american automobile association).

dannysauer
  • 751
  • 4
  • 8