-1

I am limited to one external IP on my server thus to run a mail server alongside with other Apache instance for web hosting, I believe I am forced to use mod_proxy.

I tried using mod_proxy in the past but I recall only to get it to work within my internal network, but I need this to work outside of my network.

The mail server is on a VM which is on the same server as the other sites, but I have it setup as a bridged network so the VM has a different internal IP.

A few extra notes:

  • The main server internal IP is 192.168.1.59
  • Mail Server internal IP is 192.168.1.171
  • My main site must preserve the HTTPS certificate/rewrite I created. If possible, it would be nice to use the same key on the mailserver.
  • Everything is running on Debian 7.7 (includes the VM). Both instances are fully up to dates, etc.

/etc/apache2/ports.conf:

##########  Global Properties  ############################
# Ensure that Apache listens on port 80/443
Listen 80
Listen 443

# Listen for virtual host requests on all IP addresses
NameVirtualHost *:80
NameVirtualHost *:443

<Proxy *>
Order Allow,Deny
Allow from all
</Proxy>

ProxyRequests Off

##########################################################

##############  SSL Properties  ##########################

<VirtualHost *:443>
DocumentRoot /var/www/site1.net
SSLEngine On
SSLCertificateFile /etc/apache2/ssl/apache.crt
SSLCertificateKeyFile /etc/apache2/ssl/apache.key
</VirtualHost>

<IfModule mod_gnutls.c>
    Listen 443
</IfModule>

##########################################################

###################  Websites  ###########################
<VirtualHost *:80>
DocumentRoot /var/www/site1.net/
ServerName site1.net
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule (.*) https://%{SERVER_NAME}%{REQUEST_URI} [R,L]
</VirtualHost>

<VirtualHost *:80>
ServerName http://www.mail.site1.net
ProxyPreserveHost On
ProxyPass / http://192.168.1.171:80/mail/
ProxyPassReverse / http://192.168.1.171:80/mail
RewriteRule ^/(.*)$ http:///192.168.1.171:80/mail/$1 [P,L]
</VirtualHost>

<VirtualHost *:80>
DocumentRoot /var/www/site2.com/
ServerName www.site2.com
</VirtualHost>

<VirtualHost *:80>
DocumentRoot /var/www/site2.com/
ServerName site2.com
</VirtualHost>

It is not like this is the only thing I have tried, but after so long I forget what I have tried myself.. Just hoping someone else has more experience. Thanks for any help!

1 Answer 1

0

Your setup assumes that the webmail front end has to be hosted on the same host as the back end mail server. But that's not the natural way to do it, because (1) it requires you to run two web servers instead of one, and (2) it creates direct connections from outside to your internal mail server, which should stay protected within the LAN.

Instead why not host the webmail front end on the public web server (192.168.1.59), and configure it to pull mail from the back end IMAP server on 192.168.1.171? Then there's no need for an HTTP proxy. You can serve webmail from www.site1.net/mail by adding

Alias /mail /path/to/webmail/app

to the site1.net virtual host, or from www.mail.site1.net with

<VirtualHost *:80>
ServerName http://www.mail.site1.net
DocumentRoot /path/to/webmail/app
</VirtualHost>

or whatever.

If your webmail app is Roundcube for example, then you'd set $rcmail_config['default_host'] = '192.168.1.171' to tell it to connect to your IMAP server.

Public-facing SSL certificates now become easier because you only have to host them on the web server. If you still want to encrypt IMAP connections between the web and mail servers over the LAN, you can do that, but it would use a different, internal certificate.

Connections from outside to SMTP can be forwarded from 192.168.1.59 to 192.168.1.171 by iptables. That won't conflict with Apache, since they're running on different ports.

3
  • Are you trying to suggest to run my mail server on the main machine? I am using iRedMail (roundcube) but its Apache/ip table config completely messes with my other instances running - I have had to completely restart from scratch when I tried this in the past. Part of my issues is that I am not sure how to do "/path/to/app" when trying to access another material on another machine - if port 80 on my local 192.168.1.171 hosts the webmail, how would I create a path to that destination?
    – kyij
    Oct 29, 2014 at 8:30
  • No. Run webmail on the web server (.59). Run IMAP on the back end server (.171). Configure Roundcube on .59 to talk to IMAP on .171 using the configuration snippets I provided. Oct 29, 2014 at 11:33
  • Thanks for the reply but I have much more then just a few websites that are running on the front server (.59). I understand what you are saying but I can not take down my main server while I play guessing games with config files. Do you have any ideas which will let me actually just use the VM as the email server by itself and be able to connect to it outside/inside the network. I would be willing to connect to it other than port 80/443 if need be but it would be nice to have it still use HTTPS if that is possible.
    – kyij
    Oct 30, 2014 at 16:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .