Im hoping someone has some experience with RCP over HTTP, and using it in a natted senario, public to private. My challenge is this. One of my clients is hosting an exchange 2003 behind a 2.8.28 mikrotik router. The router is configured with a public address directly connected to a T-1, and the exchange server is connected via a 192.168.100.x private address an another interface. The router currently provides all functionality to the mail server- smtp, http, https, and pop. The only thing that im not able to implement yet is rpc over http. From what i understand, it has to do with how mikrotik allows a certificate to be installed in an ssl transaction. Anyone with experience with this i would love to get some help from. thanks-

Matt Bochsler
PineValley Networks

Matt

I doubt that the MT is causing the problem. Unless you're doing Proxying the router doesn't care what's in a packet, HTTP or otherwise. It's a layer 3 device.

Regards

Andrew

From what i understand, it has to do with how mikrotik allows a certificate to be installed in an ssl transaction.

From the sound of the rest of your post, it seems like you are simply using dst-nat to forward these ports to the internal SMTP server. If you dst-nat 443/tcp (SSL) to the internal server, Mikrotik has absouletly nothing to do with the actual SSL connection.

What version are you using? Some older versions had in some rare cases issues with masq'ing SSL - but again, you should not be masq'ing, you should be dst-natting...

You'll need to be a bit more specific in regards to what errors you are getting

We have an identical scenario.

You only need to allow and/or port forward TCP 80 and 443. (actually, its probably only 443)

MS RPC over HTTP / Exch2k3 Server is 'rather tricky' to setup. Not to mention some client machines can also be a nightmare.

If you can surf to https://your.2k3.server and http://your.ms.server from inside and outside your network, the problem is not your MT.
The RPC Outlook client simply proxies to the server via the HTTP or HTTPS ports securely and eliminates the 'travelling salesman that cant send mail on port 25' issue