Worked example: two Exchange servers behind one IP#
This is the set-up HAPMan was built for: a production Exchange server and a lab Exchange server, each with its own namespace, and only one public IP address. Both need port 443, and you want Let's Encrypt certificates on both.
| Prod | Lab | |
|---|---|---|
| Names | mail.contoso.com, autodiscover.contoso.com |
mail.lab.contoso.com, autodiscover.lab.contoso.com |
| Server | 192.168.10.11 |
192.168.20.21 |
| HAProxy VM | 192.168.10.5 |
It assumes HAPMan is installed and you can sign in.
1. Public DNS#
Point every name at your public IP: mail and autodiscover for both namespaces. If they're in Cloudflare, set them to DNS only (grey cloud), as Cloudflare's proxy doesn't pass through Exchange's other protocols.
2. HTTPS routes#
Add two HTTPS routes:
| Name | Hostnames | Backend servers | Health check |
|---|---|---|---|
| Exchange prod | mail.contoso.com, autodiscover.contoso.com |
192.168.10.11:443 |
HTTP(S) page, /owa/healthcheck.htm |
| Exchange lab | mail.lab.contoso.com, autodiscover.lab.contoso.com |
192.168.20.21:443 |
HTTP(S) page, /owa/healthcheck.htm |
Leave Balancing on Least connections. With a second prod server later, add it as another line in Backend servers and you have load balancing.
3. HTTP routes for Let's Encrypt (HTTP-01)#
Let's Encrypt HTTP-01 validation connects to each name on port 80. With one public IP, port 80 has to be split by hostname too, so add two HTTP routes:
| Name | Hostnames | Backend servers | Health check |
|---|---|---|---|
| Exchange prod HTTP | mail.contoso.com, autodiscover.contoso.com |
192.168.10.11:80 |
TCP connect |
| Exchange lab HTTP | mail.lab.contoso.com, autodiscover.lab.contoso.com |
192.168.20.21:80 |
TCP connect |
Each server's IIS then answers its own challenges. Exchange Certificate Manager does this for you, writing the challenge files into IIS on every server and renewing automatically.
Leave Redirect to HTTPS on in Settings, so anyone browsing to http:// on any other name is sent to HTTPS.
Don't want port 80 open?
Use DNS validation for the Exchange certificates instead (Exchange Certificate Manager supports it through Cloudflare). Then you don't need the HTTP routes or a port 80 forward. Turn Redirect to HTTPS off if you don't forward 80 at all.
4. SMTP#
HAProxy can't split SMTP by hostname. Either forward port 25 on the router straight to prod Exchange (simplest), or add a TCP route on port 25 to 192.168.10.11:25 and forward 25 to the HAProxy VM.
With a TCP route, Exchange sees every connection coming from the HAProxy VM. That matters if a receive connector or anti-spam relies on the sender's IP, so forwarding 25 straight to Exchange is usually better.
5. Apply#
Open Changes, check the diff and validation, add a note such as Exchange prod and lab behind one IP, and click Apply to HAProxy. The first apply replaces Ubuntu's sample config; the original is kept as /etc/haproxy/haproxy.cfg.hapman-prev.
Back on Routes, every server should show UP within about 20 seconds.
6. Test with a hosts file#
Before you move the router's port forwards, test through HAProxy from a machine on your LAN by pointing the names at the VM in its hosts file (C:\Windows\System32\drivers\etc\hosts on Windows, /etc/hosts on a Mac or Linux):
192.168.10.5 mail.contoso.com autodiscover.contoso.com
192.168.10.5 mail.lab.contoso.com autodiscover.lab.contoso.com
Then browse to https://mail.contoso.com/owa and https://mail.lab.contoso.com/owa. Each should show its own server's sign-in page and certificate, with no certificate warning. From a command line:
# Which certificate comes back for each name?
openssl s_client -connect 192.168.10.5:443 -servername mail.lab.contoso.com </dev/null 2>/dev/null | openssl x509 -noout -subject
# Without a hosts file
curl -sI --resolve mail.contoso.com:443:192.168.10.5 https://mail.contoso.com/owa/healthcheck.htm
Remove the hosts file entries when you've finished.
7. Router port forwards#
On the router:
| Port | Forward to | |
|---|---|---|
| TCP 443 | HAProxy VM (192.168.10.5) |
Change it from the prod Exchange server |
| TCP 80 | HAProxy VM | Only if you added HTTP routes or want the HTTPS redirect |
| TCP 25 | Prod Exchange (192.168.10.11) |
Or the HAProxy VM, with a TCP route |
| TCP 8443 | Nothing | Never forward HAPMan's port |
If the backends are on different VLANs from the VM, allow the VM to reach each one on 443 (and 80) through the firewall between them.
Test from outside your network, for example on a phone with Wi-Fi off, then issue or renew the Let's Encrypt certificates on each Exchange server.