Exchange and Apache servers on same external IP

Question

My network has an exchange server and an apache server hosting a web site.

Exchange is 192.168.1.10

Apache is 192.168.1.12, secured with SSL

Router/firewall is 192.168.1.1

My external static ip address (for example) is 1.1.1.1 www.aaa.com

I have set up my router to port forward 80 and 443 to 192.168.1.12

So when I browse to www.aaa.com it will show the web site only.

Doing this prevents external access to the Exchange server through a mobile phone, since 443 is going only to the web site.

Is there a way to configure this so that the mail based traffic can be passed through the web server onto the email server? I tried to look into subdomains for apache (for example calling the mail domain mail.aaa.com) but I am not clear on what I am trying to achieve so couldn't work out what I was looking for.

Answer 1

Yes it is possible, but you will need to configure Apache as a reverse proxy for Exchange.

Since you need coexistence of the web server for www.aaa.com, you will also need to configure another name for exchange. Indeed, you will need 2 names only for exchange, autodiscover.aaa.com and something like owa.aaa.com or outlook.aaa.com.

1. Configure virtual host external URL for Exchange external URL (autodiscover, owa, ...)
2. Setup the public DNS to point all those name to 1.1.1.1 (your router public IP)
3. Keep redirection of 80 and 443 to 192.168.1.12
4. Add virtualhost to apache configuration to setup reverse-proxy (you can check https://github.com/phr0gz/Apache-reverse-proxy-for-Exchange-2010-2013-2016/blob/master/webmail.conf for reference)

If the configuration of apache is too much trouble, you can also add a reverse-proxy base on IIS and setup the redirection to that server. It'll be in charge of directing trafic to apache or Exchange based on the name. More for that topic : https://blogs.technet.microsoft.com/exchange/2013/07/19/part-1-reverse-proxy-for-exchange-server-2013-using-iis-arr/

Answer 2

What you're probably looking for is an ingress controller supporting something called "SNI" (server name indication), which can be used to create virtual hosts based on the host name being accessed. You can use Apache, as @michaël-bozio-made suggested. You can also use a number of other web servers, like nginx, or dedicated load balancer applications like haproxy (my preference). With any of those solutions, you would forward port 443 to the ingress controller application (also possibly called an "application firewall" or similar), and then have the controller relay connections to the appropriate backend server (which could be on any port you choose now) based on whatever criteria is appropriate - the hostname the client requested, in this case. You could also theoretically use /exchange on the URL for your web server to proxy through to the exchange server (look at the mod_proxy documentation), but some applications don't like being hidden behind a URL prefix. This is, at a high level, how large-scale sites generally work.

You other option is to use an alternate port for one of the services. For example, you could forward 8443 to Exchange, so clients would use https://exchange.yourdomain.com:8443/ as the URL (assuming you are not actually running the aaa.com web site for the american automobile association).