Re: Website inside or outside domain

From: D. Ian Miller (miller@ucalgary.ca)
Date: 02/13/03

  • Next message: Henry Sieff: "Ye Olde OWA Topic (Was RE: Website inside or outside domain)" 
    Date: Thu, 13 Feb 2003 09:22:54 -0700
From: "D. Ian Miller" <miller@ucalgary.ca>
To: KEITH KOOYMAN <pcsolutions101@hotmail.com>

    The one time I implemented OWA, I wrestled long and hard with how to minimize
    the security risks while giving the users the convenience of accessing their
    email via the www. I came across a rather unique solution which worked well in
    my environment.

    Instead of dishing out more cash for ISA, I used a redhat Linux 7.x PII PC in
    the DMZ with about 128-MB RAM to act as proxy (using apache's mod_proxy) to the
    IIS OWA website. The IIS OWA website was on the LAN and it in turn talked to
    the exchange server on the LAN. Having the Linux box also allowed the
    additional advantage of adding SSL (using apache mod_ssl) to the data stream
    between the end user and the Linux box itself. The firewall was then
    configured to only allow traffic between the Apache and IIS box. I also had to
    modify some of the asp code that comes with OWA to make this work.

    KEITH KOOYMAN wrote:

    > As I have followed this thread I have noticed that no one has addressed the
    > similarities between this situation and OWA. Essentially, this is much the
    > same scenario, where a public web server is in the DMZ and the question is:
    > How do I allow access to the back-end Exchange Server?
    >
    > You can:
    > 1. Put a firewall between the DMX and the LAN (many firewalls have a
    > preconfigured DMZ so a second firewall is not needed) and open up so many
    > ports from the DMZ to the LAN that the firewall is useless = the official
    > Microsoft solution
    > 2. You can leave the front-end in the DMZ and use pass-through
    > authentication which takes web traffic straight to your back-end = not
    > desireable
    > 3. Multi-home the front-end public web server, use TCP/IP filters, IPSEC
    > and firewall rules to filter, authenticate and encrypt traffic going to the
    > back-end; a good idea but time consuming and difficult to set up
    > 4. Move the front-end public web server to the LAN = not desirable
    > 5. Use a third party hybrid solution = expensive
    >
    > Does anyone else have a take on this Exchange point of view on the public
    > web server?
    >
    > KC
    >
    > _________________________________________________________________
    > MSN 8 with e-mail virus protection service: 2 months FREE*
    > http://join.msn.com/?page=features/virus

    Relevant Pages

    • RE: win2k firewall
      ... web server...both the firewall and web server would be ... necessary between the Internet and a LAN. ...
      (Security-Basics)
    • Re: Lan to Wan reprise
      ... On Sun, 2005-03-13 at 23:05 -0500, Claude Jones wrote: ... >> router, firewall, web server, DHCP server to my Lan, etc. ... >> Machines on the Lan are getting DHCP assigned IP addresses. ... the machines on the Lan can't get past the firewall. ...
      (Fedora)
    • E2K3-OWA "Wird geladen..."
      ... 1x E2K3 auf W2K3 als Frontendserver in der DMZ der Firewall als ... dass beim Zugriff auf OWA statt der Mails nur ... Rufe ich OWA im LAN auf dem Backendserver auf, ... Die Firewall ist stumm, die Ereignisanzeige zeigt (auch nach dem ...
      (microsoft.public.de.german.exchange2000.general)
    • Re: Lan to Wan reprise
      ... > router, firewall, web server, DHCP server to my Lan, etc. ... > Machines on the Lan are getting DHCP assigned IP addresses. ... the machines on the Lan can't get past the firewall. ...
      (Fedora)
    • Re: Lan to Wan reprise
      ... >>router, firewall, web server, DHCP server to my Lan, etc. ... >>Machines on the Lan are getting DHCP assigned IP addresses. ... the machines on the Lan can't get past the firewall. ...
      (Fedora)
    Loading