Sophos UTM different HTTPS websites on one public IP

In the webserver protection you can select different URLs in the virtual servers and redirect them to different real servers.

In (public?) DNS you have to point all URLs to the same IP

I have created 2 separate Real Web servers and 2 separate Virtual web servers.

I have also registered the 2 different URL's in the public DNS to point to the same Public IP Address.

They both work, as the first one is coming through Port 443 and the second one through Port 80.

If I change the second web server Port 80 to Port 443, it resolves to the webpage of the first web server (my Exchange OWA page)

How do I stop this from happening?

I have tried creating an "Additional Addresses" on the interface with its own IP Address and using this. It makes no difference, it still resolves to the first web page (Exchange OWA)

I have DNAT rules for the Exchange /OWA/Autodiscover and a DNAT rule for HTTP connection to the second webserver

As I understand the architecture of the Sophos, and I'm not an expert nor an employee/official support, a DNAT will override the WAF. You need to pick one to use. the WAF is going to look at the URL and assign the appropriate backend, the DNAT isn't. In order to have all your subdomains come into the same IP, I think you'd have to use the WAF and cut the DNAT rules. The DNAT rule is probably taking all the requests to (your public IP- it doesn't care about the url) and sending them to your owa backend server. 

I will try disabling all the DNAT rules and see what happens and get back to you, thanks Aaron.

Hi Aaron, when I disable the DNAT the website does not work on port 80.

As expected, your websites were being routed via the DNATS through the firewall, not the WAF. 

Now you get to explore why your WAFs are not functioning properly. As BAlfson mentioned below, provide images of the edits of the WAF frontents (Virtual Web Servers) because that's likely where the misconfiguration error lies. 

You won't be able to accomplish what you want through the firewall using purely DNATS unless your webserver behind the firewall is doing some type of virtual web hosts (sometimes called v-hosts if you're using HTTPD/apache).

Hi Aaron, here are the images for the Virtual server, Real webserver, and DNAT rule

Both the Exchange server and the second web server are on Windows Servers, so IIS. No Linux based web servers.

Windows IIS servers can do the same virtual hosting, but I forget what they call it as it's been a while since I've worked on IIS. 

Either way - What happens when you enable both the real and virtual servers, leave the DNAT disabled, and attempt a website access? Can you provide the logs from that test?

It is connecting now with the DNAT rule disabled.

Did you still want the logs?

If it's working, then you need to leave your DNAT rule disabled and start building the Virtual web servers / real servers/ exceptions for Exchange as I liked to in one of the initial posts. If you already have this done, then I would verify the connectivity of Exchange. 

If it's working, then you need to leave your DNAT rule disabled and start building the Virtual web servers / real servers/ exceptions for Exchange as I liked to in one of the initial posts. If you already have this done, then I would verify the connectivity of Exchange. 

Update - So I have disabled all the DNAT rules for Exchange (I did this out of business hours, hence the delay)

I have purchased a certificate with the full FQDN of the web site and I have installed this on both the webserver and the FW. (not using the wild card cert as mentioned by dirkkotte)

I have edited the Virtual Webserver to use the new Certificate.

I can browse to the website internally and get the HTTPS connection with no issues.

I can telnet from external to the FQDN of the webserver on port 443.

When I connect to the website, I get the Exchange OWA Cert and web page??

Here is the Virtual web server log file I got when I tried to connect. Not sure if it helps?

2021:01:28-19:37:07 SophosFW httpd[6119]: AH00112: Warning: DocumentRoot [/var/www/REF_RevFroExchaWebse] does not exist
2021:01:28-19:37:08 SophosFW httpd[6119]: AH00112: Warning: DocumentRoot [/var/www/REF_RevFroOrders] does not exist
2021:01:28-19:37:08 SophosFW httpd[6121]: [remoteip:notice] [pid 6121:tid 4147427008] AH03494: RemoteIPProxyProtocol: disabled on 127.0.0.1:4080
2021:01:28-19:37:08 SophosFW httpd[6121]: [security2:notice] [pid 6121:tid 4147427008] ModSecurity for Apache/2.9.3 (http://www.modsecurity.org/) configured.
2021:01:28-19:37:08 SophosFW httpd[6128]: [remoteip:notice] [pid 6128:tid 4147427008] AH03494: RemoteIPProxyProtocol: disabled on 127.0.0.1:4080
2021:01:28-19:37:08 SophosFW httpd[6128]: [mpm_worker:notice] [pid 6128:tid 4147427008] AH00292: Apache/2.4.39 (Unix) OpenSSL/1.0.2j-fips configured -- resuming normal operations
2021:01:28-19:37:08 SophosFW httpd[6128]: [core:notice] [pid 6128:tid 4147427008] AH00094: Command line: '/usr/apache/bin/httpd'
2021:01:28-19:37:09 SophosFW httpd[6294]: Started
2021:01:28-19:41:06 SophosFW httpd: id="0299" srcip="127.0.0.1" localip="127.0.0.1" size="165" user="-" host="127.0.0.1" method="GET" statuscode="200" reason="-" extra="-" exceptions="-" time="728" url="/lb-status" server="localhost:4080" port="80" query="" referer="-" cookie="-" set-cookie="-" websocket_scheme="-" websocket_protocol="-" websocket_key="-" websocket_version="-" uid="YBJcghxS3lzxdzdIupNF@gAAABw"
2021:01:28-19:41:29 SophosFW httpd: id="0299" srcip="127.0.0.1" localip="127.0.0.1" size="165" user="-" host="127.0.0.1" method="GET" statuscode="200" reason="-" extra="-" exceptions="-" time="285" url="/lb-status" server="localhost:4080" port="80" query="" referer="-" cookie="-" set-cookie="-" websocket_scheme="-" websocket_protocol="-" websocket_key="-" websocket_version="-" uid="YBJcmRxS3lzxdzdIupNF@wAAACg"

DNAT isn't specific to the application/website. It's simply taking all traffic going to (your public IP) on port 443 and sending it to whatever DESTINATION (hence DNAT) you have set. When you say "you disabled the DNAT for exchange" - it makes me think you aren't understanding the DNAT rule doesn't know or care if you're accessing Exchange or the other website. 

All your DNATs need to be disabled for the WAF to work, as far as I know. 

If connecting to the website sends your request to the exchange backend (real webserver - either 1) your DNAT is still enabled or 2) your virtual webserver/real webserver is misconfigured. 

You're right about DNATs taking precedence over WAF, Aaron.  See #2 in Rulz (last updated 2020-11-12).

Cheers - Bob

Bob - I did check your Rulz page - I didn't see WAF listed specifically. Is it part of the "Proxies" category? 

Correct - the name of the log file in Linux is reverseproxy.log.

Cheers - Bob

Hello Gents

Thank you for your help. BAlfson you can close this if you would like, as it does not seem to work.

If I disable ALL the DNAT rules Exchange breaks and the 2nd website then works. I cannot have this, email is more important.

I have used this link https://support.sophos.com/support/s/article/KB-000035032?language=en_US to set up the Exchange but no success.

I will find another way to do this, thank you all (especially Aaron) for your time and help.

I'm not sure you'll find another way to do this on the Sophos - but I'm not a subject expert. In the event you choose to revisit this: I'm fairly confident you can't have any NAT rules active for the public IP you're trying to balance your different websites behind. Properly configure the WAF for the different websites you're trying to host, and things will start to work. 

Thanks Aaron, yes I realize that I am looking at using another firewall system and going away from Sophos.