I am only interested in OWA, or port 80/443 proxying, etc. Port 25 with SMTP is well taken care of.
I would like to separate OWA off the production server, that all 800 clients connect to on the internal network for their Outlook client. Yes I would like to increase security, and I know that this could be argued against. I see it as this; the internal network is a private class of IP's (192.168.125.0), the DMZ is a private class of ip's (192.168.1.0), and the external interface has a public ip. They are both non routable, NAT'd networks, and to expose a port to either specific server IP's on the DMZ, or Internal nets, and they are translated to the external interface. Specific ports, say port 80 from the external inteface, to the DMZ server IP on port 80. This would be the same process/result as if you forwarded it through to the internal exchange server's ip.
The thing that I think it gets me is that it is a separate server, that if compromised, doesn't down my production server on the internal network. I guess this depends on the attack, and the payload... It would have to be hacked at the IIS level port 80 or 443 if that is all that is exposed externally. If somehow someone could take over the computer from either of those ports 80/443, and ride it through on the specific ports to specific IP's on the internal network (which they would have no idea what servers and ports were in the ACL), then I suppose they could possibly get into the internal network. I would think it to be M U C H more difficult to accomplish to gain "full" access to the internal network in this manner, than if it we port forwarded 80/443 to the internal server ip.
This scenario opens more ports than I would like, but I feel it is an improvement over forwarding to internal network. Also as a FE server the server would have no Data stores on them, and all services but IIS would be running on it for it to process OWA, the authentication, and data would be served up from the internal network servers. Unlike what you recommend, the internal exchange server has data stores on it, that could be compromised. I do not want to compromise the security and reliability of my internal exchange server.
What something's would you suggest to put in between Exchange and OWA. Any examples, or configurations?
What type of firewall are you using?
Thanks,
Bryan
Main Topics
Browse All Topics
by: SembeePosted on 2004-12-29 at 13:01:57ID: 12921998
What is your reason for putting a domain member and Exchange server in to a DMZ?
No one has given me a valid reason for doing so to date.
The most common reason is because people think it will increase security.
It doesn't.
For an Exhcange to communicate through a firewall a number of ports need to be opened, and dynamic ports in Exchange must be made static.
This basically turns your firewall in to swiss cheese. Your DMZ machine gets compromised the attacker has a clear run in to your domain.
Instead leave everything inside. Open port 25 (SMTP) and 443 (SSL) only from the Internet to your Exchange server. This means you only have two ports open. I operate the policy of the least ports open as possible.
If there is still unease about having an Exchange server directly exposed to the Internet then put something inbetween. OWA needs to be still exposed but Windows 2003 makes an excellent relay server. MS even have an article on how to set it up: http://support.microsoft.c
Simon.