server publish under host headers - ISA 2004

good afternoon

our setup is sbs 2k3 with isa 2k4 under fixed ip address
the setup is usual one : internet - router - sbs nic 1 | sbs | - sbs nic 2
inside lan

on the inside, we have a linux server hosting egroupware, available to the
ouside world on port 8000, so under
 http://www.**--****.com/ :8000/egroupware , we can reach the linux
server.
now my question is, can we reach egroupware on the linux server from the
outside world, typing  http://www.**--****.com/  ?? publishing
internally the 8000 port server under this host name ??

thank you and best regards.

PLeite from Portugal

> good afternoon
Create general web publishing rule for publishing your linux server,
then open properties of this rule and select "Bridging" tab. Change
default port 80 to 8000 (option named "redirect request to HTTP port").




-- 
With best regards
Nickolay Domukhovsky, MCSA

good morning

thank you for your kind reply.
but this doesn't deals with the host header issue, does it ??

i would liko to reach the inside linux server from the outside by using
 http://www.**--****.com/ 
under port 80. can this be done ??

thank you very much
PLeite
------------------------------------------------------
"Nick Domukhovsky" < XXXX@XXXXX.COM > escreveu na mensagem


2
the

> good morning
I see I should explain my answer further.
So. Your external clients resolve egroupware.ourdomain.com into external
ISA's address. Then they connect simply to port 80 (i.e. type
egroupware.ourdomain.com in their browsers), then on ISA this request
intercepted by web listener (which you created with your rule), this
listener redirects the request as stated in publishing rule - to your
linux host, but on port 8000 (if you stated it in bridging tab of rule
properties).  If this is what you want, but you need more precise
instructions how to configure it - I can give you step-by-step
instruction. If I misunderstand you, so please state where I think
different...






-- 
With best regards
Nickolay Domukhovsky, MCSA

hi
thank you once again for your help. i beleive is better that i describe what
an hipothtical user would do, and describe what i want to happen in the
background.

as said, sbs 2k3 premium isa 2k4. thus being, we use outlook web access.
our main domain is " ourdomain.com "

as of now, on the internet, our server responds to
 http://www.**--****.com/ , presenting the sbs welcome page and to
https://sbserver.ourdomain.com presenting the same page and
https://sbserver.ourdomain.com/exchange for secure owa.
inside our lan, there is a linux server, hosting groupware. apache is
listening on port 80 and 8000 and ssl 8003, but this other issue.

so, there is an external hosted dns, under which, there is a
egroupware.ourdomain.com pointing to our ip address.
what i want is that a user types in the browser :
 http://www.**--****.com/  ( eventually " /egroupware" ) still sorting
the paths and this happens.

* isa receives a request to the site egroupware.ourdomain.com. i beleive i
could set a listener for this domain name, but couldn't use port 80 and 443
* isa forwards this request to the inside server 192.168.0.100 / egroupware
under port 8000. here, this can be a non issue because if isa can hear the
proper request and forward to the proper server, i ca discard the port 8000.
also, i want to be able to use https://egroupwear.ourdomain.com, and
terminate the ssl tunnel at isa, thus, forwarding the requests as plain html
inside the lan. i remember an option on isa 2000, to publish sites with ssl
bridgind or tunneling but can't find it on isa 2k4. ( still learning
though ).
as of now, i can reach with :  http://www.**--****.com/ :8000/egroupware
and the inside site works fine.

i hope i made myself clear on these questions.
i remember reading publishing multiple sites on iis using different host
headers but this is not exactly the same thing.

thank you
Pedro Leite
--------------------------------------------------------------




"Nick Domukhovsky" < XXXX@XXXXX.COM > escreveu na mensagem

OK. I understand. You *already* has IIS listening to port 80 and 443 and
you cannot afford new public IP. However, there is a solution (I've
already tested it in my lab).

So, pristupim... (let's begin).

1. You should move your IIS listening sockets to another port (I've
tried to move IIS to other network interface, however this fffff...amous
web server listens at 0.0.0.0:80 even if you configure exact IP at web
site properties... So, you should change port or you will be unable to
bind ISA's web listener. So, for example, you moved your OWA to port
8000 (and 8003 for secured connections).

2. Create a web listener network object.
- Navigate to Firewall Policy node in ISA server management console,
open Toolbox tab
- In network objects set select New->Web listener (wizard should starts)
- Name your listener (for example, "listener").
- Select network, from where your listener should accepts connections
(in our example it should be "External"), also you can refine your
selection by typing exact IP address on which listener should listen.
- In next window you check port which you need (port 80 for http, 443
for https by default, https by default unchecked). This port numbers for
*listener*, not for your sites.

3. Publish back your OWA.
In firewall policy select "Publish Mail server" (in fact you can use
publish web server wizard for this task), name your rule, for example,
"OWA access".
- in next windows select "Web client access"
- in next windows check "Outlook web access"
- configure secure connection as you wish
- enter name of your OWA server (sbsserver.ourdomain.com)
- select "accept requests for: this domain name (type below)"
- type sbsserver.ourdomain.com
- select listener from drop-down list
- after wizard's end open properties of your new rule, open "Bridging"
tab and edit port numbers (8000 for HTTP and 8003 for HTTPs).

4. Publish your Linux box.
- Create "Web publishing rule", name it "Linux box", for example.
- Enter your IP of your Linux box in next window (field "Computer name
or IP address"
- again select "accept requests for: this domain name (type below)".
Type egroupware.ourdomain.com
- select our listener from drop-down list
- after wizard finished open properties of your rule, navigate to
"bridging" tab and again change port numbers as you need.

5. Let's get it all work!
- *make sure* that your IIS web site for OWA changed it's default
location (for example, with netstat command).
- Apply your changes in ISA
- after changes takes effect, check, that web listener successfully
binded to port 80 (and 443 if you configured secure HTTP).
- if all looks good, then try to access your sites from external
network. All should be fine.


If you have some more questions I'm ready to assist.



-- 
With best regards
Nickolay Domukhovsky, MCSA

> 
This is simple. But first you need to get Web server certificate for
ISA. There are a number of ways to do that (for example, you can use IIS
certificate request wizard, and then export certificate from IIS and
import on your ISA server).

After you have Web server certificate, open Web listener properties,
navigate to "preferences" tab, check "Enable SSL", leave default port
number (443), press "Select" button near "certificate:" label. Then
select your ISA's certificate.

Then you need to create secure web publishing rule (in fact, you can
simply extend our web publishing rule, but for education purpose it is
simpler use specialized wizard).

So,
- select "Publish secure web server" from tasks plane, name your rule
- now select publishing type "SSL bridging" (that's what you need, in
tunneling mode ISA simply pass through all SSL traffic).
- in bridging mode select "Secure connection to clients"
- in computer name type egroupware.ourdomain.com
- in "accept requests for:" select "This domain name (type below)"
- select our listener
And thats all... Now you have secured connection from external users to
ISA server and usual HTTP connection from ISA to your Linux box.





-- 
With best regards
Nickolay Domukhovsky, MCSA