Links to Outlook Web Access

I have an Exchange Server Outlook Web Access page that I would like to be able to create a link on an Internet web page for. Ideally, I would like this link to work whether it is accessed from outside the local are network or inside the network. As things are currently set up, two links are needed. The details below outline the network setup.

Current setup:
http://mail.mydomain.com/exchange - works from outside the LAN
http://xxx.xxx.xxx.xxx/exchange - works from inside the LAN (static IP address)

The system is running SBS2003 and Exchange 2003, and is connected to the Internet through a Linksys Cable/DSL router.

I'd like to get the http://mail.mydomain.com/exchange link to work from inside the LAN if. It is probably some simple change that is needed, but I don't want to change something that enables the outside link to work from inside the LAN while breaking some other functionality. Any ideas would be appreciated. Thanks.

How many DNS servers do you have serving info for your public domain (mydomain.com), where are they (ie you or an ISP/host), and do they serve different groups (ie do some handle requests from you and some handle requests from the Internet)? Also, roughly how many something.mydomain.com records do you have, and are they fairly static?

Note that I'm not terribly interested in the servers your PCs use to look names up (that's just the SBS box), but what servers claim to be authoritative for queries about mydomain.com. I'm also assuming that the active directory domain name for your network is different to the public one (ie it's not mydomain.com).

The solution here is to rig DNS so that anyone inside your network asking for mail.mydomain.com gets the internal IP address, but to work out how I need a better picture of your existing DNS infrastructure.

Thanks for the reply. I figured a DNS change was needed, but I didn't want to mess anything up.

The SBS2003 PC is set up for mail.mydomain.com and mail.mydomain.local I have not specifically wet up any something.mydomain.com entries, so the only ones would be whatever SBS2003 setup might create automatically. It might also help to mention that while this server does host the e-mail using Exchange Server 2003, it does NOT at present host the web site. The web site hosting is outsourced at present.

After further research, it looks like I may need to add a new forward lookup zone to the DNS on the SBS2003 server. It currently has a mydomain.local zone with a mail entry under that, but no mydomain.com zone and mail entry. However, since I don't want to do anything that could end up causing problems, I'm still looking for any instructions on exactly what to change or add. Thanks.

Sorry, forgot about this one. You're right in that you need to add a mydomain.com primary zone to your internal DNS server, but you need to create sensible records for all the stuff.mydomain.com records you have. Once you create that primary zone, no queries for mydomain.com will be passed out to the servers that serve your domain's DNS info publicly.

After doing additional research, the usual suggestion to solve this problem is to set all of the internal network PC's to use ONLY the SBS 2003 DNS server as their DNS server. With this setup, DNS lookups that the SBS 2003 server does not control are passed out to other DNS servers. However, I do not want to do this since it will cause internet access to fail for all PC's on the network if the SBS 2003 server is not up and functioning properly.

A forward lookup zone would also seem to have problems. I have not created any stuff.mydomain.com records, but I don't know how many are already there as part of a standard SBS 2003 installation. Also, I don't want to create other problems while trying to solve what should be a simple problem. For example, I don't know what problems the issue listed below would cause.

Quote:

---

Once you create that primary zone, no queries for mydomain.com will be passed out to the servers that serve your domain's DNS info publicly.

---

Any additional ideas on how to solve what would seem like a simple problem without creating more problems would be greatly appreciated. The address issue is a pain for those users who have laptops and travel frequently. They have to keep changing mail server and Outlook Web Access addresses depending on whether they are connected internally or not.

Thanks.

In a properly set up domain the DC should be set as the DNS serve for all domain members.

When folks who travel login, are they connecting to the domain (via VPN) or logging in locally and connecting to the internet via other means?

When I traveled, I used a Netsh script to adjust my location. A simple click would redefine the network connection to match each location I was at.

Thanks for the reply

I realize that Microsoft's preferred way is for the server to act as the DNS server for the domain PC's. However, that is not the best option for this particular situation. Those users off site that need access use a VPN connection. However, the majority of users only require e-mail, and that is through a POP3 connection to the Exchange Server.

Most remote users are not computer gurus - they are lucky if they know how to retrieve their e-mail. They will not want to be using any netsh scripts or other means to change settings, they just want it to work. In any case, the problem is not with remote use, it is the internal network setup that I am trying to configure so it works the same as it would for an external user for e-mail access only. This would allow mobile users to use the same settings for both internal and external connections for their e-mail access.

An option is to put a HOSTS file on their system the points to the correct place when they are in the office since the external DNS server will not have a reference to the .local domain.

Thanks.

I thought of that, but I would need to create a script or program to enable/disable the hosts file or entry for when they are gone. That would work OK, but they would need to remember to use it.

Make a HOSTS entry for mail.mydomain.com using the public IP address.
It will work from inside or outside. That is exactly how my home network is setup. The only difference is that I'm using Win2k3 Server rather than SBS.

In most SOHO cases, using the public IP address from inside the network won't work -- cheap routers generally don't do loopback NAT. That's why you either need split DNS or a way to reconfigure the mail client when you move around.

Work fine with my cheap home router, Netgear FVS318.

The public IP address for the mail server from inside the network gets you the router setup page (with login dialog box) on my setup.

Port 80 must be forwarded to to the internal IP address of the server that runs IIS and Exchange.

Port 80 is forwarded to the server's IP address in the router's UPnP forwarding settings page.

Port 443 is also forwarded to the server's IP address. According to the info I have seen, this should allow http://companyweb access, but it doesn't. The http://companyweb page cannot be accessed at all except on the server itself.

The shared fodleres can be accessed from internal PC's using the \\Servername of course.

I tried a HOSTS file entry, and changing the DNS server settings on the client PC's, but neither of those had any effect.

If anyone knows of any books on VPN and remote acess, and/or DNS for Server/SBS 2003, I'd appreciate the recommendations.

Thanks.

The URL http:/companyweb must be replaced by a fully qualified domain name pointing to your "company website". To use port 443 (SSL) you need a PKI security certificate. Most are expensive, but there are a few free alternatives such as OpenSSL. I've found it easier to use SSL for OWA email rather than VPN while traveling.

You must also have public DNS entries pointing to your domain and server.

Here is the response from a dig command for my home domain (minus identifying info).

Code:

---

06/01/07 20:08:35 dig domain.com @ xxx.xxx.xxx.xxx  (this is a public DNS server)
Dig [email protected] (xxx.xxx.xxx.xxx) ...
Authoritative Answer
Recursive queries supported by this server
 Query for domain.com type=255 class=1
  domain.com A (Address) xxx.xxx.xxx.xxx
  domain.com NS (Nameserver) dns1.xxxx.net
  domain.com SOA (Zone of Authority)
        Primary NS: dns1.xxxx.net
        Responsible person: responsible person
        serial:2
        refresh:3600s (60 minutes)
        retry:600s (10 minutes)
        expire:86400s (24 hours)
        minimum-ttl:3600s (60 minutes)
  domain.com MX (Mail Exchanger) Priority: 10 xxx.xxx.xxx.xxx.
  domain.com TXT (Text Field)
    v=spf1 mx -all
  dns1.xxxx.net A (Address) xxx.xxx.xxx.xxx

---

The above entries are sufficient for running a IIS and Exchange with complete internal and external access. I use Outlook Web Access, FTP and web access using a public computer or my notebook from around the world frequently.

Don't you have access to the domain records over the public internet?

This is simple

Setup an A record on your DNS hosting site and setup a forward lookup zone in your internal DNS for your company. You need nothing more. Internal LAN hosts will using the internal DNS for blah.com lookups, and obviously internet users will use whatever is published via records thru your dsn mgmt company (i.e. GoDaddy.com or whatever)