Topic: ProxyPass and Exchage

[steve288]

I have been trying with very little success to get ProxyPass to forward to an exchange server. It seems I can get so far and then it doesn’t work.

My first problem is that when ever I create a proxypass it doesnt finish properly.
When ever I finish filling the "Create a new ProxyPass Virtual domain entry", It doesn’t finish properly. It gives me a “the page cannot be displayed” Despite the fact that I have a virtual domain, (machinename.domain.com)

However things seem to work despite this. (perhaps)

Then when I go to my external IP address it takes  me to the exchange web site internally. Great. (by the way Im useing a dialup connection so Im not doing it from inside the network) First it asks me for my exchange. Then for those of you who know the Outlook Web Access interface it begins with a blue line dividing the left column from the right. But then that is as far as it goes.

My reading seems to indicate from various posts that it may have something to do with “webDAV” and squid. I don’t know anything about webDAV or really what it is. But it appears that Squid can stop it.

I have read I think that if I use Opera the webDav does not come into play. Well that doesn’t work either. I get the same thing. The login and the blue line then “the page cannot be displayed.” in IE and could not connect to remote server in opera. Message repeated In the two frames. That should be filled with outlook goodies.

When I look at my Exchange logs I get the following, messages. I don’t know enough about exchange to decifer the log, but it sure looks like it works eg It shows me "sjones" connecting with opera. But alas  I don’t get my mail interface.

***** C:\WINDOWS\SYSTEM32\LOGFILES\W3SVC1\ex070125.log
 2285:  2007-01-25 16:41:49 W3SVC1 10.1.0.2 PROPFIND /applications - 80 - 10.1.0.191 Microsoft-WebDAV-MiniRedi
/5.1.2600 404 0 0
 2286:  2007-01-25 16:42:22 W3SVC1 10.1.0.2 GET /exchange/ - 80 - 10.1.0.250 Opera/9.10+(Windows+NT+5.1;+U;+en
 401 2 2148074254
 2287:  2007-01-25 16:42:30 W3SVC1 10.1.0.2 POLL /exchange/steve/Inbox - 80 sjones 10.1.0.16 Mozilla/4.0+(comp
tible;+MSIE+6.0;+Windows
 2288:  NT+5.1;+SV1) 207 0 0
 2289:  2007-01-25 16:42:45 W3SVC1 10.1.0.2 GET /exchange/ - 80 sjones 10.1.0.250 Opera/9.10+(Windows+NT+5.1;+
;+en) 200 0 0
 2290:  2007-01-25 16:42:45 W3SVC1 10.1.0.2 GET /exchange/favicon.ico - 80 sjones 10.1.0.250 Opera/9.10+(Windo
s+NT+5.1;+U;+en) 404 0 0
 2291:
 2292:  2007-01-25 16:44:30 W3SVC1 10.1.0.2 POLL /exchange/steve/Inbox - 80 sjones 10.1.0.16 Mozilla/4.0+(comp
tible;+MSIE+6.0;+Windows
 2293:  NT+5.1;+SV1) 207 0 0

Finally,

 I have tried some of the solutions suggested in the news groups eg.
http://forums.contribs.org/index.php?topic=23281.0

Adding the following lines to the squid.config
Either
extension_methods SEARCH SUBSCRIBE UNSUBSCRIBE POLL BCOPY BPROPPATCH

or

extension_methods SEARCH GNUTELLA BPROPPATCH SUBSCRIBE CCM_POST

I don’t know what they do but they are suppose to allow webDAV to get through.
Both don’t work for me. I also tried
http://forums.contribs.org/index.php?topic=31988.0
extension_methods SEARCH  
As per that post. Still nothing.

Can anyone shed some light on this problem Im having.  Im using SME7

I have tried even for a moment to shutdown squid, but this doesn’t seem to work. Although Im a little confused if it really shutsdown. I type squid –k shutdown but then when I to a ps command
ps -ef |grep squid

root      2125  1837  0 Jan24 ?        00:00:00 runsv squid
smelog    2159  2125  0 Jan24 ?        00:00:00 /usr/local/bin/multilog t s5000000 /var/log/squid.run
squid     5278  2125  0 12:06 ?        00:00:00 /usr/sbin/squid -f /etc/squid/squid.conf -sN -D
squid     5279  5278  0 12:06 ?        00:00:00 (unlinkd)
root      5281  5190  0 12:08 pts/1    00:00:00 grep squid

It still seems to be running. (is it ??)

Any help please?

Regards

[byte]

Moving this topic to the SME 7.x contribs forum, it is more appropriate there. Thanks!

[steve288]

Ok thanks.

[raem]

steve288

You should keep your posts in the same thread so that others can see what has happened earlier ie
http://forums.contribs.org/index.php?topic=35392.0

I don't use exchange so I know nothing about it.
The proxy pass contrib will redirect http port 80 and depending which type of entry you set up will also redirect https port 443.

I'm guessing that your connection to exchange uses ports other than these and perhaps that why the proxy pass won't work ???
Can anyone who knows exchange confirm that ?

[raem]

steve288

> I'm guessing that your connection to exchange uses ports other
> than these and perhaps that why the proxy pass won't work ???

This link refers to quite a few ports
http://www.msexchange.org/tutorials/OWA_Exchange_Server_2003.html

[steve288]

Thanks for the link.

I read it over. The ports that the link talks about are only if you set it up in a certain way. In either case I added it to the port forward. But it didnt help. I then checked with a exchange "expert" and they  confirmed this. That you are right the only ports that need to be allowed are 80 and 443.

The thing is that when I do go to the site with or w/o port forwarding but proxypass enabled (to go to the site) I get a login and it tries to resolve the OWA screen. It just doesnt download any pictures and text, just the beginnings of a blue OWA face. This to me means (please correct if IM wrong) that the 80 or 443 are getting through. If they did not would I not be able to get the login at all??

While I can hear everyone screeming dont do it... is there a way just to turn the firewalling features off, just for a few moments to see if it can forward and get through. IF it does then it would confirm that it is some setting on the sme that is causing the problem. If it still doesnt well IM not sure what that tells me.

Regards

[Franco]

Can you tell us how are you trying to get this to work? How have you configured?
- created a new domain i.e.: owa.yourdomain.com
-then go to proxypass and select this new domain pointing to your internal IP where exchange is being hosted, making sure the selection for http and https is enabled.

I'm using with IIS and works just fine.

[william_syd]

The thing is that when I do go to the site with or w/o port forwarding but proxypass enabled (to go to the site) I get a login and it tries to resolve the OWA screen. It just doesnt download any pictures and text, just the beginnings of a blue OWA face. This to me means (please correct if IM wrong) that the 80 or 443 are getting through. If they did not would I not be able to get the login at all??

Is your internal exchange server https or http ?

[steve288]

>Can you tell us how are you trying to get this to work? How have you configured?

Its the weekend, when I get in on monday I will list some of the steps.

>Is your internal exchange server https or http ?
As far as whether Im using http or https. I get to it internally by typing http:// so the answer is http

Why do you ask ?

Regards

[william_syd]

Why do you ask ?

Regards

I don't think you can proxy https without some additional directives in httpd.conf.

[steve288]

>Can you tell us how are you trying to get this to work? How have you configured?
>- created a new domain i.e.: owa.yourdomain.com
>-then go to proxypass and select this new domain pointing to your >internal IP where exchange is being hosted, making sure the selection >for http and https is enabled.

>I'm using with IIS and works just fine.

You asked me how I do this here are the steps.

1. I go to proxypass and set up a ProxyPass Virtual Domain Entry

2. I click the available domains: The only one there is one I created called
Exchange.wmail.mydomain.com (frankly I don’t really understand this because shouldn’t all the domains that sme sets up for you be there. Eg ftp.wmail.mydomain.com, proxy.wmail.mydomain.com, www.wmail.mydomain.com, aren’t they virtual also? ) The [Hostnames and addresses] for this entry is set to [location self] with no [ipaddress].

3. Anyway then I set up the Target as  http://10.1.0.2/exchange
(this is the internal machine and directory that brings up the exchange login when I am locally on network )

4. Of course I click create, it seems to fail.  When ever I finish filling the "Create a new ProxyPass Virtual domain entry", It doesn’t finish properly. It gives me a “the page cannot be displayed” Im not sure how to check the actual file it is changing to see if it finishes. However the fact that when I go to my outside domain and it does take me to the exchange server and then fail seems to indicate that this part of it is working.

That is pretty much it. Again, and I say this over and over because I think it is important. I do get the OWA login. And two OWA frames open up (NO text however) then it does not go any further.

The question that I think I have asked before and not really had answered is, if it is giving me the login from OWA, and actually begins to show a little of the web page doesn’t that mean that the ports are open?

Strangely I cannot see anything in the squid logs at all. I mean normally when I go to another sme6 machine that we use I can go to /var/log/squid/access.log and see all sorts of activity. But when I do it on this machine. Why would that be?

Also is there anyway to turn off all the screening of things that could be causing problems just to see if it will get through.  Just for testing purposes, perhaps I can narrow down what software or security feature is blocking it.

>  don't think you can proxy https without some additional directives in httpd.conf.

What would those changes Be? , please read above, doesnt the fact that I get a login to the exchange, or even when I come in via https it asks me for a Certificate mean that its getting through the linux computer. Otherwise it would be blocked.

[andy_wismer]

Hi Steve

I had to use a slash after exchange...

I use a "ProxyPass URL entry", allowing access to exchange by using the URL of my webserver https://www.anwi.net/exchange/.

My "Target" looks like this:

http://Name_or_Internal_IP_of_Exchange/exchange/

Without that slash I'd just get an error message, but from the IIS on Windows, not a Browser or Apache error!

Directly (Say from LAN) I can access Exchange without a closing slash, but not with ProxyPass...

YMMV

Andy Wismer

[steve288]

Thanks for the reply. I have for the moment all but given up on this right now. But will return to it. I spent about 2 weeks trying to resolve it and gave up. I may try again.

Thaks.

[raem]

steve288

The proxypass contrib panel option you are using (Proxypass virtual domain entry) only forwards port 80. You said that the experts say you only need port 80 and 443 forwarded, so there is your main problem, port 443 is NOT being forwarded, and I'm assuming that's why the login screen does not complete.

The other Proxypass contrib panel option for Proxypass URL entries does allow you to specify both http & https (port 80 & 443), but that panel is proxying an ibay eg an ibay called foo, so if someone goes to
www.yourdomain.com/foo then they will be redirected to your OWA server.
But that's not what you want though.
You could try configuring Proxypass URL & accessing OWA via a ibay type URL to see if it is accessible that way as an experiment, and if that works OK then move on to working out how to do it with code changes.

William suggested you will need to learn how to tweak templates & config files re httpd.conf and I think that is the answer for you, search & read these forums, devinfo lists, devinfo guide etc and the actual existing code fragments for examples, as there are probably all the answers you need there, it's just a matter of finding them.