mail server access from the web

[Mike_Berube]

Hello, I have a mail on my network that I would like accessible from external clients. How can I make my mail server accessible to on the go users? The user would use a mail client like Outlook to send and receive to and from my mail server. TY Mike

[Mike_Berube]

For a more secure connection I leaned towards accessing the email via web. This is what I did: -Inbound -Source: All -Destination: MailWeb virtual IP (external IP with port 80 to Internal Mail server IP on port ***). -Service: ANY If I add HTTP instead of ANY for service then I don’t have access. Why and is it secure to leave it as ANY? Ty Mike

[ede_pfau]

Hi, you would use a VIP to forward the external public IP to the internal private IP of your server. I am not 100% sure but I think OWA uses several ports, not only port 443. Therefore, I would NOT use port forwarding in the VIP but limit the services via the policy. If you can you should isolate your mail server from the rest of your LAN, using a DMZ port or a virtual (VLAN) port at a pinch. Leading guideline: if you consider a publicly accessible server as ' hacked' , would that mean havoc to your other hosts?

[ede_pfau]

oops, you were faster than me. Try to log which ports are used: allow HTTP only and add a subsequent policy to this server with action DENY, allow ' log violation traffic' .

[Mike_Berube]

Hi, When I don' t use port forwarding I am unable to connect since the mail server web access does not use a standard port. I don' t know how to limit the services via the policy to make this work. Is there a security issue in using port forwarding? Ty Mike

[ede_pfau]

*puzzled* if you don' t use port forwarding you effectively forward ALL ports to the server, regardless of the port/service OWA uses. No, p.f. is not a security concern, rather it circumvents the exact knowledge which ports are used by OWA (such is the plan). What does the documentation (google) say about the ports in use? Do you see dropped traffic via the DENY policy (this doesn' t take long to set up)?

[ede_pfau]

All references on the net say that you only have to forward port 443. Be sure then that your FGT does not listen to port 443 itself!! (System>Admin>Settings, HTTPS, set to 4443 or the like). You should be able to reach the exchange server via telnet (' telnet publicIP 443' ), for testing if you can connect at all.

[Mike_Berube]

Hi, I don' t use MS Exchange or OWA. I use MDaemon. I connect via http on a different port then 80 so the MX mail address on the web points to my external IP and the VIP translates the demand to my internal mail server to a different port hence the port forwarding. This setup works and was wondering of there is a security issue using this configuration. I can' t make it work any other way mainly because I lack the FG training witch I should get soon. TY Mike

[ede_pfau]

No security concerns with port forwarding. Just make sure you narrow down the services to what you allow on the server.

[Mike_Berube]

Backing up the truck a bit….My mail server is actually on the AD Domain server so this port forwarding scares me. I don’t want my AD server hacked. I’m looking into transferring my mail server to a DMZ. Here is the issue: All my internal users receives and sends mail via Outlook Express so the connection is done through port 25 and 110. How will I connect to the mail server if it’s in the DMZ? Do I open ports between LAN1 to DMZ? Isn’t that a security breach? Mike