Vlan Server Access

The only way to restrict all access except for Exchange is set up a firewall between the two vlan. That said, you have to set the rules in your firewall to restrict all except for port 25 (for Exchange). Normally, if you grant access to port 80 for OWA (outlook web access) you leave all Internet open. Therefore, you should block port 80. All your client PCs will get Internet access from its own server, which outside of the firewall.
You can set HW firewall (SonicWall, Cisco...) or software firewall Zone Alarm...

K

if i allow port 25 traffic is that enough? wont exhange expect the users to logon therefore requiring active directory lookup? therefore more ports needing opened?

cheers

That's it for typical Exchange in corporate. If you also run POP and IMAP, you also need 143 and 110. Here is the list of ports that you may need:
http://www.petri.co.il/ports_used_by_exchange.htm

Intranet port open. However, you may open the door for other access if port 80 is granted:
http://technet.microsoft.com/en-us/library/bb125069(EXCHG.65).aspx

K

"They need to connect to Outlook on a server ont he other LAN"

How are you sharing Outlook?  RDP?  Citrix?  RDP is TCP 3389, Citrix is TCP 1494 or TCP 2598.

basically i want them to contact the exchange server via outlook the normal way ie the standard outlook/exhange setup

cheers

Ahh...

Then you'll need DNS, LDAP, and RPC.  Unless you've configured RPC over HTTP.

if you have cisco routers you can set up access lists on  the router and apply it to the required network.

All firewalls work on the same basic idea. enter a line of logical commands to permit and deny traffic based on ip and ports.

in the ccase of ciscco it would look like this

assuming the PC valn is 192.168.50.0 /24
and the exchange server is 192.168.60.25/24

acccess list Excchange.

permit ip 192.168.50.0 0.0.0.255  any eq 53
permit ip 192.168.50.0 0.0.0.255  192.168.60.25 0.0.0.0 eq 25
deny any any

you then apply this to the incomming interface to the router from the PC vlan.

you would need to add in the same lines for ports for ldap rpc and any thing else you want to allow.

basicaly if you read the first permit line it says

allow any ip traffic from the 192.168.50.0 network (any port) to any host as long as its on port 53 (DNS),

the second statement does the same thing but is further limited to a specific host, ie the email server)

Access lists are very powerfully and for limiting specific access like this and tieing it down to only one or two protocals it would be my choise.

Port 25 is not going to help you..   Port 25 is the port number that Exchange accepts SMTP mail on.  As in when another mail server connects to exchange to deliver mail that is destined for a mailbox that resides on that server.  It is not the port used by Outlook.  If all you all is 53 and 25, you're going to have broken Outlook clients.

Also, let's not overlook the need for either inter-vlan routing or a static routes.  You'll need admin access to your router or layer 3 switch.