As the result of a recent penetration test, in which we did not fare well, it has been brought to my attention that our internet facing, all-roles-in-one, Exchange 2010 SP3 server has no firewall in place, and is therefore completely exposed to the internet. I verified the results myself, and it is indeed pretty bad. SMB, LDAP, remote registry, RDP, and every other default service you'd find in a Windows Active Directory environment are exposed to the internet through our Exchange server.
Naturally, I'd like to fix this, and plan to do so with Windows Firewall, but in Googling about, all I've been able to find on point from official sources are port references which seem to apply to internal Exchange traffic, and a Technet blog posting saying not to use those references to configure your firewalls, because the only supported configuration between Exchange servers is the equivalent of an
ANY:ANY allow rule. :/
Given that we use Active Sync, OWA, IMAP, calendar/address book sharing, autodiscover and Outlook client access, does anyone know what firewall rules are required for an all-roles-in-one Exchange server that's internet facing? (Bonus points in the form of a small bounty to anyone who has an official MS source, too.)
Off the top of my head, with a bunch of experience as an accidental Exchange admin and accidental IT security guy, I've come up with the list below (which seems both too long and too short to me), but before I go and potentially break email for a thousand whiny users, I'd really like some verification of what I'm planning to do.
TCP:25 for SMTP TCP:465 for SMTPS TCP:587 for SMTP TCP:80 for OWA http to https redirect TCP:443 for https/OWA/Active Sync/EWS/Autodiscover TCP:143 for Endpoint Mapper/IMAP4 Client Access TCP:993 for IMAP4 Client Access (also) TCP:110 for POP3 (because some technological dinosaur of a VIP probably uses POP3 at his beach house/ski cabin/where ever) TCP:995 for POP3 (because some technological dinosaur of a VIP probably uses POP3 at his beach house/ski cabin/where ever)