Users were suddenly unable to access RWA from remote devices. Also, email to people's phones (activesync) stopped working. There were no changes made to the server. This happened over a weekend when no one was in the office. Updates are not set to run automatically.
When you browse RWA internally either via hostname or localhost/remote the page displays properly. However, if you try to go to the same URL that has been working for years you initially get a certificate error. If you view the certificate it is not from the server. If you choose to continue you get a 404 file not found error (or 400 bad request), however, the erroris not from the server it turns the screen pink and says "mini_httpd/1.19_19dec2003" It appears to be from the router (zyXel PK5000z) due to the fact that the certificate is from zyxel.com.tw. Calls to our ISP (centurylink) have resulted in them insisting that it is the code on our website.
The router has port forwarding set up to forward to the server. This has been in place and working for 1+ years.