Reverse Proxy for Microsoft Exchange Server 2019

[jmccreary]

The only thing not working on my Nginx Proxy Manager setup is my Exchange server, I can access the webmail portion just fine. The problem is with outlook desktop clients, no matter what I do they won’t sign in. I believe it has something to do with the way the autodiscover sub-domain proxy is setup, but I have no idea how to configure this in on Nginx Proxy Manager. I can’t seem to find any information online about how to configure it.

I did find this setup for Nginx, but I’m not sure how this would transfer over to Nginx Proxy Manager.

server {
if ($host = $mail.domain.tld) {
return 301 https://$host$request_uri;
} # managed by Certbot

    listen 80;
    listen [::]:80;

    server_name $mail.domain.tld;
    return 404; # managed by Certbot

    ssl_verify_client       off;

}
server {

    listen [::]:443 ssl http2 ipv6only=on; # managed by Certbot
    listen 443 ssl http2; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/$mail.domain.tld/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/$mail.domain.tld/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    server_name $mail.domain.tld;

    ssl_verify_client       off;

    location /                              { proxy_pass https://$exchange_server; }
    location /owa                           { proxy_pass https://$exchange_server/owa; }
    location /exchange                      { proxy_pass https://$exchange_server/exchange; }
    location /ews                           { proxy_pass https://$exchange_server/ews; }
    location /mapi                          { proxy_pass https://$exchange_server/mapi; }
    location /rpc                           { proxy_pass https://$exchange_server/rpc; }
    location /oab                           { proxy_pass https://$exchange_server/oab; }
    location /autodiscover                  { proxy_pass https://$exchange_server/autodiscover; }
    location /Microsoft-Server-ActiveSync   { proxy_pass https://$exchange_server/Microsoft-Server-ActiveSync; }
    location /ecp                           { proxy_pass https://$exchange_server/ecp; }

    proxy_pass_request_headers on;
    proxy_pass_header Date;
    proxy_pass_header Server;

    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto https;
    more_set_input_headers 'Authorization: $http_authorization';
    proxy_set_header Accept-Encoding "";
    more_set_headers -s 401 'WWW-Authenticate: Basic realm="$mail.domain.tld"';

    proxy_read_timeout 3600;

    proxy_buffer_size 128k;
    proxy_buffers 4 256k;
    proxy_busy_buffers_size 256k;

    access_log /var/log/nginx/$mail.domain.tld-access.log;
    error_log /var/log/nginx/$mail.domain.tld-error.log;

}

any suggestions?? Thanks in advance

[EffKay-muc]

I found a very similar file in the container under /data/nginx/proxy_host/number.conf

But I found no way, to edit that file with nano in the container (used the consol in portainer)

The "funny" part is, the EWS access worked for me until I updated NPM

[EffKay-muc]

In fact, it works with 2.9.2

[stanthewizzard]

Not an answer to your question but in my case
haproxy for exchange and remote desktop
everything else goes to NPM
If you found a solution to make it work with NPM. I'm interested

[PrieserMax]

How did you setup haproxy and Nginx Proxy Manager?
From external it is only possible to forward the ports to one host. So how did you open 80/443? Do you have multiple WAN IPs?
Freetings
Max

[chjud]

I would love to know the same as Max. Is the Haproxy first or the NPM first, could you share your config?

[Chrishan68]

Hi
I have the same problem. Everything is working except my Outlook client. During profile setup it is asking for credentials again and again and then it stops. I need to cancel setup.
In custom locations I setup every folder, but I think I need to add something to Advanced - Custom Nginx Configuration. But what? Is there any explanation what I can add?

I tried

upstream mail {
server 192.168.168.168:443;
ntlm;
sticky learn create=$remote_addr lookup=$remote_addr
zone=client_sessions:10m timeout=3h;
}

but this takes my host offline

[g-karpov]

You need this https://github.com/gabihodoroaga/nginx-ntlm-module

[gyd1]

@jmccreary
Is this your complete configuration of using nginx as a reverse proxy for Microsoft Exchange Server 2019?

[GhostS13]

Hello,

Somebody solve this problem? I tried to solve it but nothing. I use NPM in docker on proxmox

[fargotto481]

Да. Включи Basic Authentication для API, EWS, MAPI, OAB в IIS и в виртуальных каталогах ECP в веб-морде.

Единственный минус - у тебя не будет снаружи работать NTLM, но это не существенный недостаток

[fargotto481]

Всё работает. Но NTLM работать не будет на 7 уровне OSI reverse proxy

[Du-lumos]

Hello, have you solved this problem? I have reverse proxy for Exchange, but some users always report that their Outlook will pop up a window asking them to enter a password. The problem is fixed every time they restart Outlook.I referenced the ntlm module for nginx: gabihodoroaga‘s nginx-ntlm-module

[Lukinno713]

Im using clear NGINX compiled by myself. I was moving from apache2 reverse proxy to nginx reverse proxy, so I was solving this issue as well.

As of now, I have confirmed by myself that configuration above provided by our fellow colleague is working perfectly.

I have used this options for nginx compilation (System is Ubuntu 22.04, nginx is being compiled from version 1.27.3.):

./configure
--prefix=/etc/nginx
--sbin-path=/usr/sbin/nginx
--modules-path=/usr/lib/nginx/modules
--conf-path=/etc/nginx/nginx.conf
--error-log-path=/var/log/nginx/error.log
--http-log-path=/var/log/nginx/access.log
--pid-path=/var/run/nginx.pid
--lock-path=/var/run/nginx.lock
--http-client-body-temp-path=/var/cache/nginx/client_temp
--http-proxy-temp-path=/var/cache/nginx/proxy_temp
--http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp
--http-scgi-temp-path=/var/cache/nginx/scgi_temp
--http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp
--user=nginx
--group=nginx
--with-compat
--with-debug
--with-file-aio
--with-threads
--with-pcre
--with-pcre-jit
--with-libatomic
--with-http_ssl_module
--with-http_v2_module
--with-http_v3_module
--with-http_realip_module
--with-http_stub_status_module
--with-http_gzip_static_module
--with-http_gunzip_module
--with-http_auth_request_module
--with-http_random_index_module
--with-http_secure_link_module
--with-http_degradation_module
--with-http_slice_module
--with-http_dav_module
--with-http_flv_module
--with-http_mp4_module
--with-http_addition_module
--with-http_sub_module
--with-http_image_filter_module=dynamic
--with-http_geoip_module=dynamic
--with-http_xslt_module=dynamic
--with-stream
--with-stream_ssl_module
--with-stream_ssl_preread_module
--with-stream_realip_module
--with-stream_geoip_module=dynamic
--with-openssl=/tmp/quictls
--with-openssl-opt="enable-tls1_3"
--with-cc-opt="-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC"
--with-ld-opt="-Wl,-Bsymbolic-functions -Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie"
--add-module=/tmp/nginx-ntlm-module
--add-module=/tmp/headers-more-nginx-module

For exchange on prem to work behind nginx reverse proxy, u must compile nginx with NTLM module ( --add-module=/tmp/nginx-ntlm-module ) and headers more module (--add-module=/tmp/headers-more-nginx-module) - headers more is required because of configuration colleague provided to us. By some tweaking with the configuration file, it might not be required, but if u want to just copy and go, this module is required.

[GhostS13]

Im using clear NGINX compiled by myself. I was moving from apache2 reverse proxy to nginx reverse proxy, so I was solving this issue as well.

As of now, I have confirmed by myself that configuration above provided by our fellow colleague is working perfectly.

I have used this options for nginx compilation (System is Ubuntu 22.04, nginx is being compiled from version 1.27.3.):

./configure --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --user=nginx --group=nginx --with-compat --with-debug --with-file-aio --with-threads --with-pcre --with-pcre-jit --with-libatomic --with-http_ssl_module --with-http_v2_module --with-http_v3_module --with-http_realip_module --with-http_stub_status_module --with-http_gzip_static_module --with-http_gunzip_module --with-http_auth_request_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_addition_module --with-http_sub_module --with-http_image_filter_module=dynamic --with-http_geoip_module=dynamic --with-http_xslt_module=dynamic --with-stream --with-stream_ssl_module --with-stream_ssl_preread_module --with-stream_realip_module --with-stream_geoip_module=dynamic --with-openssl=/tmp/quictls --with-openssl-opt="enable-tls1_3" --with-cc-opt="-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC" --with-ld-opt="-Wl,-Bsymbolic-functions -Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie" --add-module=/tmp/nginx-ntlm-module --add-module=/tmp/headers-more-nginx-module

For exchange on prem to work behind nginx reverse proxy, u must compile nginx with NTLM module ( --add-module=/tmp/nginx-ntlm-module ) and headers more module (--add-module=/tmp/headers-more-nginx-module) - headers more is required because of configuration colleague provided to us. By some tweaking with the configuration file, it might not be required, but if u want to just copy and go, this module is required.

Aha, This is the reason. I'm using Nginx Proxy Manager. Maybe you have clear VM with NGINX and NTLM and you share with me. Because i tried to make my own clear NGINX but I haven't enough knowledge for it. Maybe you have good manual. Any help will be great for me.

[Du-lumos]

Sorry, I've been so busy lately that I've been stuck on that question.

Compiling nginx is simple. You can refer to online resources or chatgpt. The ./configure method provided by the friend above is very comprehensive. After compiling nginx, start nginx and configure my configuration.

[Du-lumos]

我使用的是我自己编译的清晰的 NGINX。我正在从 apache2 反向代理迁移到 nginx 反向代理，所以我也在解决这个问题。

截至目前，我已经亲自确认，我们的同事提供的上述配置工作正常。

我已使用此选项进行 nginx 编译（系统是 Ubuntu 22.04，nginx 是从 1.27.3 版编译的）。

./configure --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --user=nginx --group=nginx --with-compat --with-debug --with-file-aio --with-threads --with-pcre --with-pcre-jit --with-libatomic --with-http_ssl_module --with-http_v2_module --with-http_v3_module --with-http_realip_module --with-http_stub_status_module --with-http_gzip_static_module --with-http_gunzip_module --with-http_auth_request_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_addition_module --with-http_sub_module --with-http_image_filter_module=dynamic --with-http_geoip_module=dynamic --with-http_xslt_module=dynamic --with-stream --with-stream_ssl_module --with-stream_ssl_preread_module --with-stream_realip_module --with-stream_geoip_module=dynamic --with-openssl=/tmp/quictls --with-openssl-opt=“enable-tls1_3” --with-cc-opt=“-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wp，-D_FORTIFY_SOURCE=2 -fPIC” --with-ld-opt=“-Wl，-Bsymbolic-functions -Wl，-z，relro -Wl，-z，now -Wl,--as-needed -pie” --add-module=/tmp/nginx-ntlm-module --add-module=/tmp/headers-more-nginx-module

为了使本地交换在 nginx 反向代理后面工作，您必须使用 NTLM 模块 （ --add-module=/tmp/nginx-ntlm-module ） 和 headers more 模块 （--add-module=/tmp/headers-more-nginx-module） 编译 nginx - 由于配置同事提供了给我们，因此需要 headers more。通过对配置文件进行一些调整，可能不需要它，但如果您只想复制并移动，则需要此模块。

Hi, I'm using Nginx as a reverse proxy for Exchange, and I've confirmed that there's a problem with the NTLM module. It can cause Nginx to crash under high concurrency conditions. I've located the issue, but I haven't been able to resolve it yet, and I'm still working on refining the code.

[GhostS13]

Thanks a lot for your help and information. I will definitely try to install and create a virtual machine with NGINX now. If you have time and opportunity to make a ready virtual machine with installed module for exchange as an example, I will be very grateful to you.

[Lukinno713]

Here you have step by step guide how to compile nginx with NTLM + headers more + HTTP/3 QUIC moduls. As said before, I confirmed that this currently works, some issues might arise as our colleague commented. This guide is working on Ubuntu 22.04.

# Switch to root user
sudo su

# Update & upgrade packages
sudo apt update && sudo apt upgrade -y

# Create nginx system user (for security)
sudo adduser --system --no-create-home --shell /bin/false --group --disabled-login nginx

# Install build dependencies
sudo apt install build-essential libpcre3-dev libssl-dev zlib1g-dev libgd-dev \
  libgeoip-dev libxslt-dev cmake git wget curl gnupg libatomic-ops-dev \
  libxml2-dev libxslt1-dev libgd-dev libgeoip-dev -y

# Prepare working directory
cd /tmp

# Clone QUIC TLS OpenSSL repo
git clone https://github.com/quictls/openssl.git quictls
cd quictls

# Configure and build OpenSSL (TLS 1.3)
./Configure --prefix=/opt/quictls \
    --openssldir=/etc/ssl \
    --libdir=lib \
    enable-tls1_3 \
    shared \
    no-ssl3 \
    no-weak-ssl-ciphers

make -j$(nproc)
sudo make install

# Register new OpenSSL library
echo '/opt/quictls/lib' | sudo tee /etc/ld.so.conf.d/quictls.conf
sudo ldconfig

# Download latest nginx source
cd /tmp
wget https://nginx.org/download/nginx-1.27.3.tar.gz
tar -xzf nginx-1.27.3.tar.gz

# Clone modules for NTLM and "Headers More"
git clone https://github.com/gabihodoroaga/nginx-ntlm-module.git
git clone https://github.com/openresty/headers-more-nginx-module.git

# Configure nginx with all required modules and custom OpenSSL
cd nginx-1.27.3
./configure \
  --prefix=/etc/nginx \
  --sbin-path=/usr/sbin/nginx \
  --modules-path=/usr/lib/nginx/modules \
  --conf-path=/etc/nginx/nginx.conf \
  --error-log-path=/var/log/nginx/error.log \
  --http-log-path=/var/log/nginx/access.log \
  --pid-path=/var/run/nginx.pid \
  --lock-path=/var/run/nginx.lock \
  --http-client-body-temp-path=/var/cache/nginx/client_temp \
  --http-proxy-temp-path=/var/cache/nginx/proxy_temp \
  --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp \
  --http-scgi-temp-path=/var/cache/nginx/scgi_temp \
  --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp \
  --user=nginx \
  --group=nginx \
  --with-compat \
  --with-debug \
  --with-file-aio \
  --with-threads \
  --with-pcre \
  --with-pcre-jit \
  --with-libatomic \
  --with-http_ssl_module \
  --with-http_v2_module \
  --with-http_v3_module \
  --with-http_realip_module \
  --with-http_stub_status_module \
  --with-http_gzip_static_module \
  --with-http_gunzip_module \
  --with-http_auth_request_module \
  --with-http_random_index_module \
  --with-http_secure_link_module \
  --with-http_degradation_module \
  --with-http_slice_module \
  --with-http_dav_module \
  --with-http_flv_module \
  --with-http_mp4_module \
  --with-http_addition_module \
  --with-http_sub_module \
  --with-http_image_filter_module=dynamic \
  --with-http_geoip_module=dynamic \
  --with-http_xslt_module=dynamic \
  --with-stream \
  --with-stream_ssl_module \
  --with-stream_ssl_preread_module \
  --with-stream_realip_module \
  --with-stream_geoip_module=dynamic \
  --with-openssl=/tmp/quictls \
  --with-openssl-opt="enable-tls1_3" \
  --with-cc-opt="-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC" \
  --with-ld-opt="-Wl,-Bsymbolic-functions -Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie" \
  --add-module=/tmp/nginx-ntlm-module \
  --add-module=/tmp/headers-more-nginx-module

make -j$(nproc)
sudo make install

# Create required directories for cache, logs, web root
sudo mkdir -p /var/cache/nginx/{client_temp,proxy_temp,fastcgi_temp,scgi_temp,uwsgi_temp}
sudo mkdir -p /var/log/nginx
sudo mkdir -p /var/www/html
sudo mkdir -p /etc/nginx/{sites-available,sites-enabled,conf.d}

# Set permissions
sudo chown -R nginx:nginx /var/cache/nginx
sudo chown -R nginx:nginx /var/log/nginx
sudo chown -R nginx:nginx /var/www/html

# Create nginx systemd service unit
sudo tee /etc/systemd/system/nginx.service > /dev/null << 'EOF'
[Unit]
Description=The NGINX HTTP and reverse proxy server
Documentation=http://nginx.org/en/docs/
After=network-online.target remote-fs.target nss-lookup.target
Wants=network-online.target

[Service]
Type=forking
PIDFile=/var/run/nginx.pid
ExecStartPre=/usr/sbin/nginx -t
ExecStart=/usr/sbin/nginx
ExecReload=/usr/sbin/nginx -s reload
ExecStop=/bin/kill -s QUIT $MAINPID
TimeoutStopSec=5
KillMode=mixed
PrivateTmp=true

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl daemon-reload
sudo systemctl enable nginx

You have now succesfully compiled nginx with NTLM, headers more and HTTP/3 QUIC modules.

Now, lets create nginx basic config - /etc/nginx/nginx.conf:

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;

events {
    worker_connections 1024;
    use epoll;
    multi_accept on;
}

http {
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                   '$status $body_bytes_sent "$http_referer" '
                   '"$http_user_agent" "$http_x_forwarded_for"';

    access_log /var/log/nginx/access.log main;
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    server_tokens off;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    # SSL Settings
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;

    # Gzip Settings
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_types
        text/plain
        text/css
        text/xml
        text/javascript
        application/json
        application/javascript
        application/xml+rss
        application/atom+xml
        image/svg+xml;

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;

    # Default server
    server {
        listen 80 default_server;
        listen [::]:80 default_server;
        server_name _;
        root /var/www/html;
        index index.html index.htm;

        location / {
            try_files $uri $uri/ =404;
        }

        location ~ /\.ht {
            deny all;
        }
    }
}

For our exchange reverse proxy, we need to add this part into nginx.conf (Add this into http part of nginx.conf}:

upstream exchange_backend_ntlm {
    ip_hash;
    server YOUR_EXCHANGE_SERVER_IP:443;
    keepalive 256;
    keepalive_timeout 3h;
    ntlm_timeout 300000;
    ntlm 300000;
}

upstream exchange_backend {
    ip_hash;
    server YOUR_EXCHANGE_SERVER_IP:443;
    keepalive 128;
    keepalive_timeout 10000s;
}

map $host $exchange_server {
    default mail.YOURDOMAIN.com;
}

upstream auth_backend {
    ip_hash;
    server YOUR_EXCHANGE_SERVER_IP:9090 max_fails=3 fail_timeout=10s;
}

And there goes final exchange server reverse proxy virtualhost configuration file, add this into /etc/nginx/sites-enabled/vhost_name:

server {
listen       443 ssl;
listen       443 quic;
server_name mail.yourdomain.com autodiscover.yourdomain.com;
ssl_session_cache shared:SSL:1m;
ssl_certificate /etc/nginx/certificates/quic.cert;
ssl_certificate_key /etc/nginx/certificates/quic.key;
ssl_session_timeout 5m;

ssl_early_data on;
add_header Alt-Svc 'h3=":443"; ma=7200'; # Pro HTTP/3 klienty;

proxy_connect_timeout 20s;
large_client_header_buffers 32 64k;
client_body_buffer_size 50M;
proxy_buffer_size 64k;
proxy_buffers  32 64k;
proxy_busy_buffers_size 1024k;
proxy_temp_file_write_size 2048k;


fastcgi_buffer_size 122880;
fastcgi_buffers 4 81920;
fastcgi_busy_buffers_size 163840;

proxy_request_buffering off;
tcp_nodelay on;
client_max_body_size 3G;
proxy_read_timeout 3h;
proxy_send_timeout 3h;
proxy_pass_header Date;
proxy_pass_header Server;
proxy_pass_header Authorization;

proxy_pass_request_headers on;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Accept-Encoding "";
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Authorization $http_authorization;


proxy_set_header Connection "";
proxy_http_version 1.1;


location /ews/mrsproxy.svc {
        proxy_pass https://exchange_backend/ews/mrsproxy.svc;
        more_set_input_headers 'Authorization: $http_authorization';
        more_set_headers -s 401 'WWW-Authenticate: Basic realm="$exchange_server"';
    }

location = /auth {
        internal;
#        access_log logs/auth_request.log auth_request_log;
#        error_log logs/exchange-error.log debug;
        proxy_pass http://auth_backend/mp/service/exchange/auth$request_uri;

    proxy_connect_timeout 120s;
            proxy_send_timeout    80s;
            proxy_read_timeout    80s;
        proxy_set_header X-Cmd $arg_Cmd;
        proxy_set_header X-User $arg_User;
        proxy_set_header X-DeviceId $arg_DeviceId;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Original-URI $request_uri;
        proxy_set_header X-Original-Host $host;
    }

location /owa/auth/logon.aspx {
        proxy_pass https://exchange_backend/owa/auth/logon.aspx;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        more_set_input_headers 'Authorization: $http_authorization';
        more_set_headers -s 401 'WWW-Authenticate: Basic realm="$exchange_server"';
    }

location / {
    return 301 https://mail.yourdomain.com/owa;
}

location /owa {
    proxy_pass https://exchange_backend/owa;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        more_set_input_headers 'Authorization: $http_authorization';
        more_set_headers -s 401 'WWW-Authenticate: Basic realm="$exchange_server"';
}


location /Microsoft-Server-ActiveSync {
        auth_request /auth;
        auth_request_set $arg_Cmd $arg_Cmd;
        auth_request_set $arg_User $arg_User;
        auth_request_set $arg_DeviceId $arg_DeviceId;
        auth_request_set $auth_status $upstream_status;

    proxy_pass https://exchange_backend/Microsoft-Server-ActiveSync;
        proxy_connect_timeout 300s;
    proxy_read_timeout 300s;
    proxy_send_timeout 120s;
    proxy_buffer_size 64k;
    proxy_temp_file_write_size 256k;
    proxy_http_version 1.1;
    proxy_set_header Connection "";

    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header Accept-Encoding "";
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    #more_set_input_headers 'Authorization: $http_authorization';
        #more_set_headers -s 401 'WWW-Authenticate: Basic realm="$exchange_server"';
    }


location /Autodiscover {
        #auth_request /auth;
        #auth_request_set $auth_status $upstream_status;
    proxy_pass https://exchange_backend_ntlm;
    #proxy_set_header Connection "Keep-Alive";
    #proxy_set_header Accept-Encoding "";
    #more_set_input_headers 'Authorization: $http_authorization';
    #more_set_headers -s 401 'WWW-Authenticate: Basic realm="$exchange_server"';
    }

location /AutoDiscover {
        #auth_request /auth;
        #auth_request_set $auth_status $upstream_status;
        proxy_pass https://exchange_backend_ntlm;
    #proxy_set_header Connection "Keep-Alive";
    #proxy_set_header Accept-Encoding "";
    #more_set_input_headers 'Authorization: $http_authorization';
    #more_set_headers -s 401 'WWW-Authenticate: Basic realm="$exchange_server"';


        }

location /autodiscover {
        #auth_request /auth;
        #auth_request_set $auth_status $upstream_status;
    proxy_pass https://exchange_backend_ntlm;
    #proxy_set_header Connection "Keep-Alive";
    #proxy_set_header Accept-Encoding "";
    #more_set_input_headers 'Authorization: $http_authorization';
    #more_set_headers -s 401 'WWW-Authenticate: Basic realm="$exchange_server"';

}

location /mapi/nspi {
        #proxy_pass https://exchange_backend_ntlm;
        proxy_pass https://exchange_backend_ntlm;
        proxy_set_header  Host            $host;
        proxy_set_header  X-Real-IP       $remote_addr;
        proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_connect_timeout 300s;
        #proxy_read_timeout 120s;
    proxy_read_timeout 300s;
        proxy_send_timeout 300s;

    proxy_request_buffering off;
    #proxy_buffer_size 64k;
    #proxy_buffers 32 64k;
    #proxy_temp_file_write_size 1024k;
        keepalive_timeout 3h;

    proxy_http_version 1.1;
    proxy_set_header Connection "";
    #proxy_set_header Connection "Keep-Alive";

    #more_set_input_headers 'Authorization: $http_authorization';
    #proxy_set_header Accept-Encoding "";
    #more_set_headers -s 401 'WWW-Authenticate: Basic realm="$exchange_server"';
    }

location /mapi {
    auth_request /auth;
    auth_request_set $auth_status $upstream_status;
    proxy_pass https://exchange_backend_ntlm;
    #proxy_pass https://exchange_backend;
        proxy_set_header  Host            $host;
    proxy_set_header  X-Real-IP       $remote_addr;
    proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_connect_timeout 300s;
    #proxy_read_timeout 120s;
    proxy_read_timeout 300s;
    proxy_send_timeout 300s;
    #proxy_buffer_size 64k;
    #proxy_buffers 32 64k;
    #proxy_temp_file_write_size 1024k;
    keepalive_timeout 3h;
    proxy_request_buffering off;

    proxy_http_version 1.1;
    proxy_set_header Connection "";
    #more_set_input_headers 'Authorization: $http_authorization';
    #proxy_set_header Accept-Encoding "";
    #more_set_headers -s 401 'WWW-Authenticate: Basic realm="$exchange_server"';

}


location ~* ^/rpc {
    auth_request /auth;
    auth_request_set $auth_status $upstream_status;
    proxy_connect_timeout 600s;
    proxy_read_timeout 120s;
    proxy_send_timeout 120s;
    #proxy_buffer_size 68k;
    #proxy_buffer_size 4 64k;
    proxy_temp_file_write_size 256k;
    proxy_http_version 1.1;
    proxy_set_header connection "";
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header Accept-Encoding "";
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_pass https://exchange_backend_ntlm;
        }
location ~* ^/oab {
    proxy_pass https://exchange_backend_ntlm;
        #proxy_pass https://exchange_backend;
    #proxy_set_header Accept-Encoding "";
    #more_set_input_headers 'Authorization: $http_authorization';
    #more_set_headers -s 401 'WWW-Authenticate: Basic realm="$exchange_server"';

    }



location /ews {
        #auth_request /auth;
        #auth_request_set $auth_status $upstream_status;
    proxy_pass https://exchange_backend_ntlm;
    #proxy_pass https://exchange_backend;

    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header Accept-Encoding "";
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    proxy_connect_timeout 300s;
    proxy_read_timeout 300s;
    proxy_send_timeout 300s;
    #proxy_buffer_size 64k;
    #proxy_temp_file_write_size 256k;

    proxy_request_buffering off;
    proxy_http_version 1.1;
    proxy_set_header Connection "";
    #more_set_input_headers 'Authorization: $http_authorization';
    #more_set_headers -s 401 'WWW-Authenticate: Basic realm="$exchange_server"';

}

location /EWS {
        #auth_request /auth;
        #auth_request_set $auth_status $upstream_status;
    proxy_pass https://exchange_backend_ntlm;
    #proxy_pass https://exchange_backend;
        proxy_set_header  Host            $host;
        proxy_set_header  X-Real-IP       $remote_addr;
        proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_connect_timeout 300s;
    proxy_read_timeout 300s;
    proxy_send_timeout 300s;
    proxy_buffer_size 64k;
    proxy_temp_file_write_size 256k;

    proxy_request_buffering off;
    proxy_http_version 1.1;
    proxy_set_header Connection "";
    #more_set_input_headers 'Authorization: $http_authorization';
    #proxy_set_header Accept-Encoding "";
    #more_set_headers -s 401 'WWW-Authenticate: Basic realm="$exchange_server"';

}

proxy_ssl_verify off;

#error_log /var/log/nginx/exchange-error.log;
#access_log /var/log/nginx/exchange-access.log auth_log;


}

Please note 1 thing:

at the beginning of server config for exchange revese proxy, there is "listen 443 quic;", if this is your first virtual host, it must be "listen 443 quic reuseport;" otherwise it will be failing for you. Just google it or remove line "listen 443 quic" if you dont know anything about QUIC and dont want to use it. I recommend to google it, as QUIC gives u a lot of benefits.

Now simply restart nginx and your exchange have to work behind this reverse proxy.

As u have noticed, I have added also HTTP/3 QUIC module, its newest, fastest protocol of HTTP utilizing UDP. When accessing web parts of exchange, like OWA, u might notice better resposivnes, better loading times, etc.. This wont be a thing when you will access exchange via outlook, as outlook utilize only TLSv1.2 with HTTP/1.1.

[GhostS13]

You dont need NTLM on Front End!!

Use Basic Auth + SSL (Double Termination, SSL Bridge). It is all very safe.

NTLM not working correct in free version nginx (SSL Bridge).

Haproxy is difficult to configure. And does not have the necessary functions like nginx (GeoIP). And this is more important than the ancient NTLM protocol.

The person above did not say whether he has double termination SSL (bridge) or SSL offloading.

With double termination (ssl bridge) - this module 100% does not work.

Another additional question. I use basic authentication on the Exchange server, but it works through NPM with interruptions, sometimes Outlook connects, sometimes it doesn't.

[fargotto481]

Это проблема конфигурации некорректной.

Используйте чистый Nginx.conf и всё.

Внутренние клиенты NTLM или Kerberos + SSL

Внешние Basic + SSL.

Всё. Ничего не должно снаружи отваливаться. У меня и EWS и толстые клиенты работают и EAS клиенты. Всё ок

[GhostS13]

Это проблема конфигурации некорректной.

Используйте чистый Nginx.conf и всё.

Внутренние клиенты NTLM или Kerberos + SSL

Внешние Basic + SSL.

Всё. Ничего не должно снаружи отваливаться. У меня и EWS и толстые клиенты работают и EAS клиенты. Всё ок

Блин, я если честно ничего не менял со стандартной NPM. Указал ИП адрес на майл.домен.бу и на автодискавер.домен.бу. В эксчендже заменил все на стандарт. И получается, что подключение работает и даже на логине пропускает, потом в какой-то момент нифига. Потом спустя время опять все ок. У меня сервер стоит дома на белом ИП с доменом. Уже с чатом ГПТ все перепробовал. Может подскажешь куда копать? ССЛ к почтовику привязал от летс энкрипт.

[fargotto481]

Это проблема конфигурации некорректной.
Используйте чистый Nginx.conf и всё.
Внутренние клиенты NTLM или Kerberos + SSL
Внешние Basic + SSL.
Всё. Ничего не должно снаружи отваливаться. У меня и EWS и толстые клиенты работают и EAS клиенты. Всё ок

Блин, я если честно ничего не менял со стандартной NPM. Указал ИП адрес на майл.домен.бу и на автодискавер.домен.бу. В эксчендже заменил все на стандарт. И получается, что подключение работает и даже на логине пропускает, потом в какой-то момент нифига. Потом спустя время опять все ок. У меня сервер стоит дома на белом ИП с доменом. Уже с чатом ГПТ все перепробовал. Может подскажешь куда копать? ССЛ к почтовику привязал от летс энкрипт.

Чтобы "понять" NPM - нужно сначала научиться работать с nginx.conf голым.

Но есть минус, после того как научишься - не захочешь использовать NPM)))

Потому что ты не знаешь "как оно там под капотом" работает.

Смотри вот мой рабочий конфиг

## Server для ***.***.ru
#####

upstream exchange_http {
    server ip_серый:80;
    keepalive 64;
    }

upstream exchange_https {
    server ip_серый:443;
    keepalive 64;
    }

server {
    listen 80;
    server_name mail.****** imap.****** pop.***** smtp.***** autodiscover.*******;

    proxy_cookie_path / "/; Secure; HttpOnly; SameSite=Lax";
    proxy_set_header X-Forwarded-Proto $scheme;

    # Проксируем запросы к HTTP-01 challenge на бэкенд (80 порт)
    location /.well-known/acme-challenge/ {
        proxy_pass http://exchange_http;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}

    location / {
    return 301 https://$host$request_uri;
    }

}

server {
    listen 443 ssl http2;
    server_name mail.****** imap.****** pop.***** smtp.***** autodiscover.*******;

    ssl_certificate     /etc/letsencrypt/live/************/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/**********/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;

    # HSTS для улучшенной безопасности
    ####### #       add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;


    location /.well-known/acme-challenge/ {
        proxy_pass http://exchange_http;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
}


        location /                              { proxy_pass https://exchange_https; }
        location /api                           { proxy_pass https://exchange_https/api; }
        location /owa                           { proxy_pass https://exchange_https/owa; }
        location /exchange                      { proxy_pass https://exchange_https/exchange; }
        location /ews                           { proxy_pass https://exchange_https/ews; }
        location /mapi                          { proxy_pass https://exchange_https/mapi; }
        location /rpc                           { proxy_pass https://exchange_https/rpc; }
        location /oab                           { proxy_pass https://exchange_https/oab; }
        location /autodiscover                  { proxy_pass https://exchange_https/autodiscover; }
        location /Microsoft-Server-ActiveSync   { proxy_pass https://exchange_https/Microsoft-Server-ActiveSync; }
        location /ecp                           { allow ********/32; allow *********/32; deny all; proxy_pass https://exchange_https/ecp; }

    proxy_pass_request_headers on;
    proxy_pass_header Date;
    proxy_pass_header Server;


    proxy_http_version 1.1;
    proxy_set_header Connection "";

    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    more_set_input_headers 'Authorization: $http_authorization';
    proxy_set_header Accept-Encoding "";
    more_set_headers -s 401 'WWW-Authenticate: Basic realm="mail***.*******.ru"';

    proxy_read_timeout 3600;

    proxy_buffer_size 128k;
    proxy_buffers 4 256k;
    proxy_busy_buffers_size 256k;

    proxy_ssl_verify off;

    ssl_verify_client off;
    proxy_buffering off;

    proxy_redirect off;

    proxy_cache off;
    proxy_no_cache 1;
    proxy_cache_bypass 1;
}

[fargotto481]

SSL у меня тоже от win-acme

Обязательно включи Basic Auth (обычную аутентификацию) для Default Web Site (для фронтенда) - во ВСЕХ КАТЕГТОРИЯХ! что указаны в конфиге nginx (моём)

Потом обязательно проверь в ECP что в каждом.....не помн как называется из головы вылетело - там тоже есть Mapi, ECP, OWA итд - там тоже обычную проверку включи.

Проверь Get-OutlookAnywhere

external должен быть BASIC
internal Negotiation
IIS - basic, NTLM, Kerberos (и/или Negotiation) там сам погугли в документации какие параметры принимает IISauthentication.

Вот после этого ЗАХОДИШЬ в IIS в RPC на фронти там тоже ручками включаешь Basic auth.

Ну и всё...Мой конфиг 100% рабочий.

На Nginx у меня wildcard сертификат *.domain.ru

На бэкенде exchange SAN сертфиикат win-acme.

Конфиг идеален, но есть 1 нюанс.

Если ВНУТРИ сети включаешь VPN то Outlook не сможет подключиться из за Negotiation.

Просто закрываешь и открываешь клиент. Либо прописываешь ручками файл hosts

Больше минусов нет. Ну вообе это от админа зависит тот кто вам даёт ВПН и не может настроить Spli Tunneling.

Best Practise.

[fargotto481]

У NTLM есть риск "смешивания" сессий. У Nginx 100%. В платной не знаю.

Тут тольо Haproxy поможет.

Но переделывать весь конфиг ну нахрен. Не так уж он и нужен этот NTLM.

Вот как то так.

Отпишись, можешь на пиво потом кинуть если помог))

[fargotto481]

Я эту тему довольно долго и давно изучал. Нормального рабочего решения нет.

И кстати по-моему "смешивание" сессий было именно в случае Haproxy когда один польза заходит под другим. Это эпик фейл.

лучше уж BasicAuth over SSL.

Та же безопасность но без гемора.

Тебе один хрен через NTLM та же придётся пароль вводить.

Я поэтому не понимаю тех людей которые вот прям обязательно хотят проксировать NTLM.... У него по RFC противоречия и даже Мелкомягкие не рекомендуют проксировать NTLM.

[GhostS13]

Возможно у меня как раз проблема в смешивании сессии. Вот буду пробовать. Инфы сейчас хватает для всех тестов и самое главное есть где спросить

[fargotto481]

Вот ещё часть HTTP блока.

Мой конфиг вылизан до идеала был в своё время, кровью и потом.

Проксирует на 10 бэкендов - впн, веб сайт, 1С, Nextcloud, видео звонки и тд...

events {
worker_connections 16384;
# multi_accept on;
}
http {
#PROXY BUFFER SIZE
proxy_max_temp_file_size 16384m;
fastcgi_read_timeout 3600;
proxy_buffering off;

proxy_buffer_size 128k;
proxy_buffers 4 256k;
proxy_busy_buffers_size 256k;
client_header_buffer_size 128k;
large_client_header_buffers 4 256k;
chunked_transfer_encoding on;

# WebSocket support
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

include       mime.types;
default_type  application/octet-stream;
log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                  '$status $body_bytes_sent "$http_referer" '
                  '"$http_user_agent" "$http_x_forwarded_for"';
access_log  /var/log/nginx/access.log  main;
sendfile        on;
keepalive_timeout  3h;
proxy_read_timeout 3h;
tcp_nodelay on;

server_tokens off;
proxy_hide_header Server;
client_max_body_size 16G;

ssl_session_tickets off;
ssl_buffer_size 4k;

proxy_headers_hash_max_size 4096;
proxy_headers_hash_bucket_size 512;

[fargotto481]

Чат ГПТ тебе тут не поможет к сожалению. Только мозг, опыт

[GhostS13]

Чат ГПТ тебе тут не поможет к сожалению. Только мозг, опыт

Подскажи можно с тобой, как нибудь связаться и поговорить например в ТГ мой логин @GhostS13. Я ща еще попробую с тем что написано. Может получится.

[fargotto481]

У меня нет времени, извини. В конфиге исчерпывающая инфа. Он рабочий 100%

[GhostS13]

в любом случае огромное спасибо. Буду пытаться настроить это. К сожалению я пока не эксперт в этом, а только учусь со своей домашним сервером.

[robertpacella]

Hello all. I have been trying to set up an NGINX reverse proxy with Exchange Server 2019 and a website behind, similar to what is discussed above, except that the NGINX instance is within a Docker image of "Nginx Proxy Manager". I have recompiled the NGINX software to include the NTLM module, but even so, it does not seem to be working. My tech skills may not be enough for this, and so I was wondering if anyone could suggest an NGINX consultant that I could engage to do this job for me? This is not a commercial version of NGINX, so I do not have any support from F5. Thanks in advance.

[fargotto481]

Зачем тебе NTLM?

[fargotto481]

И, зачем вам NPM? Используйте "голый" nginx без Докер.

[Du-lumos]

Hello, I developed an ntlm module based on the open-source nginx by myself. We are currently reverse proxying the exchange server. May I ask what problem you are encountering now? What is the purpose of doing this with you? Do you have any other social media apps so that communication would be more convenient

[GhostS13]

I can show you the problem with exchange server and NPM. I working with it in my home lab servers. my email is [email protected]

[fargotto481]

Hello, I developed an ntlm module based on the open-source nginx by myself. We are currently reverse proxying the exchange server. May I ask what problem you are encountering now? What is the purpose of doing this with you? Do you have any other social media apps so that communication would be more convenient

Hello. What about:

1. "Mixing" NTLM sessions, when one user logs in as another?
2. SSL Offload and SSL Bridge with dual termination? Is there support?
   SSL Offload with https on backend? Or only http on backend?
   Should the certificates be the same or can they be different?

If they're the same, how do you propose automating this? Besides paid wildcard certificates...

Using HTTP on Exchange is not an option.

It's much easier to abandon the idea of ​​proxying NTLM in favor of BasicAuth + SSL.

[robertpacella]

Спасибо, попробую чистый nginx без Докер. From: fargotto481 ***@***.***> Sent: Thursday, 18 September 2025 3:04 PM To: NginxProxyManager/nginx-proxy-manager ***@***.***> Cc: robertpacella ***@***.***>; Comment ***@***.***> Subject: Re: [NginxProxyManager/nginx-proxy-manager] Reverse Proxy for Microsoft Exchange Server 2019 (Discussion #2725) И, зачем вам NPM? Используйте "голый" nginx без Докер. — Reply to this email directly, view it on GitHub <#2725 (reply in thread)> , or unsubscribe <https://github.com/notifications/unsubscribe-auth/BRHVAXNQDUUEDKRNCYBIDOL3TI4MRAVCNFSM6AAAAAAWCW75KCVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTINBTHAYTMOA> . You are receiving this because you commented. <https://github.com/notifications/beacon/BRHVAXM3YNNCIKCYKIHDBND3TI4MRA5CNFSM6AAAAAAWCW75KCWGG33NNVSW45C7OR4XAZNRIRUXGY3VONZWS33OINXW23LFNZ2KUY3PNVWWK3TUL5UWJTQA3RHRQ.gif> Message ID: ***@***.*** ***@***.***> >

[GhostS13]

Ну решение NPM проще т.к. работает с коробки и нужны минимум знаний. Но как показала практика это то же кактус.

[fargotto481]

NPM хорош для типовухи

[GhostS13]

Ну я например не шарю в этой теме. Вот только начал разбираться. Захотел сделать самохостинг дома. У меня есть свой белый ИП и домен. НПМ оказалось самым простым решением. Пробовал traefik он кстати тоже имеет такую же проблему с почтовым сервером и т.д. Сейчас уже дошел как советуют выше. Использовать голый nginx или чтото рядом. Развел кучу контейнеров в проксмокс и упражняюсь =)