Accessing Exchange Server via Internet

As stated above ^^^^^^^^^ do this at your own risk (AND MAKE SURE EXCHANGE ISNT AN OPEN RELAY!!!)

Outlook through Firewalls

To connect MS Outlook to Exchange through a Firewall you need to do the following,

The following ports must be open

TCP Port 25 SMTP
TCP Port 143 IMAP4

Now the problem is RPC – exchange server do a lot of connections over high port numbers that will be blocked on your firewall, you need to manually configure Exchange to use specific port numbers.

To do this you need to make some registry changed on the exchange box,

NOTE you can use any port number you like (above 1024) for the purpose of this exercise I’ll use Ports 1026 to 1029

On the Exchange Box

Start > Run > Regedit {enter}

Navigate to the following keys and create the following entries

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeSA\Parameters
Value name: TCP/IP Port
Value type: REG_DWORD
Value data: 1026

And

Value name: TCP/IP NSPI Port
Value type: REG_DWORD
Value data: 1027

Now Navigate to

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeIS\ParametersSystem
Value name: TCP/IP Port
Value type: REG_DWORD
Value data: 1028

Now Navigate to

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MSExchangeSRS\Parameters

Value name: TCP/IP
Value type: REG_DWORD
Value data: 1029


Now you MUST reboot the Exchange server

Open the following ports on the firewall

TCP 1026, 1027, 1028 and 1029

Ref: http://support.microsoft.com/default.aspx?scid=KB;en-us;q270836

And if you have taken leave of your good senses totally.......................................

Logging into the domain through a Firewall

Note this is to log in - NOT for Exchange, SQL or a Domain Controller, I’ve not tried those so I can't comment.

The following ports have to be open from the outside (or DMZ) to the domain controllers.
NB: I know having these open from outside/DMZ has security implications but sometimes it needs to be done.

Ports open from DMZ\Outside


UDP      domain            53
TCP      domain            53
UDP      Kerberos            88
TCP      Kerberos            88
UDP      Time            123
TCP      Kerberos Auth      135
UDP      netbios-ns            137
TCP      netbios-ssn      139
TCP      ldap            389
UDP      ldap            389
TCP      microsoft-ds      445
TCP      ldap to GC            3268

However the process still fails (or runs like a two legged dog and appears to work) this is because
of the RPC system that runs on the domain controllers, when you log in the client fires up a
communication over port 135 the Domain controller, which then fires back a port number it wants to communicate
with the client over (this can be any number over 1024) your firewall lets this through outbound.

When it hits your client, it tries to open comms on that port, which is inevitably blocked on the firewall

When this happens you will see errors like

Error 1053
There are no more endpoints available from the endpoint mapper.

if you run netdiag on the machine you will see errors like
[WARNING] Cannot call DsBind to servername.domain_name.com (<ip address>). [EPT_S_NOT_REGISTERED]

There are two ways to solve the problem

1. Open every port above 1024 on your firewall, however this is about as sensible as eating yellow snow.

2. Change the way your domain controller handles RPC requests,

NOTE this must be done on EVERY domain controller

Click Start > Run > regedit {enter}

Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters\

Create a new DWORD value called "TCP/IP Port"  (remove the quotes and include the space)
double click it and change the "base" to decimal type in a port number (between 1024 and 64000) for the sake of argument use 1024

Exit the Registry Editor and you MUST reboot the server.

Now go back to the Firewall and open the following port

 
TCP      static RPC      1024


Now the process will work.

So you say RPC over HTTP is the way to go?

Yes :) but your clients HAVE to be on Outlook 2003 for it to work :)

Yes no problem. Do I have to make any changes in Echange for that?

Cheers  gbarrientos I look forward to helping you in the future *NOT*

:(

OMG! So sorry, i didnt notice that was someone else. I will get it changed.

How can i reopen the question or redistribute the points?

http://www.experts-exchange.com/Community_Support/Q_21747191.html