Sophos UTM different HTTPS websites on one public IP

Here is the Virtual web server log file I got when I tried to connect. Not sure if it helps?

2021:01:28-19:37:07 SophosFW httpd[6119]: AH00112: Warning: DocumentRoot [/var/www/REF_RevFroExchaWebse] does not exist
2021:01:28-19:37:08 SophosFW httpd[6119]: AH00112: Warning: DocumentRoot [/var/www/REF_RevFroOrders] does not exist
2021:01:28-19:37:08 SophosFW httpd[6121]: [remoteip:notice] [pid 6121:tid 4147427008] AH03494: RemoteIPProxyProtocol: disabled on 127.0.0.1:4080
2021:01:28-19:37:08 SophosFW httpd[6121]: [security2:notice] [pid 6121:tid 4147427008] ModSecurity for Apache/2.9.3 (http://www.modsecurity.org/) configured.
2021:01:28-19:37:08 SophosFW httpd[6128]: [remoteip:notice] [pid 6128:tid 4147427008] AH03494: RemoteIPProxyProtocol: disabled on 127.0.0.1:4080
2021:01:28-19:37:08 SophosFW httpd[6128]: [mpm_worker:notice] [pid 6128:tid 4147427008] AH00292: Apache/2.4.39 (Unix) OpenSSL/1.0.2j-fips configured -- resuming normal operations
2021:01:28-19:37:08 SophosFW httpd[6128]: [core:notice] [pid 6128:tid 4147427008] AH00094: Command line: '/usr/apache/bin/httpd'
2021:01:28-19:37:09 SophosFW httpd[6294]: Started
2021:01:28-19:41:06 SophosFW httpd: id="0299" srcip="127.0.0.1" localip="127.0.0.1" size="165" user="-" host="127.0.0.1" method="GET" statuscode="200" reason="-" extra="-" exceptions="-" time="728" url="/lb-status" server="localhost:4080" port="80" query="" referer="-" cookie="-" set-cookie="-" websocket_scheme="-" websocket_protocol="-" websocket_key="-" websocket_version="-" uid="YBJcghxS3lzxdzdIupNF@gAAABw"
2021:01:28-19:41:29 SophosFW httpd: id="0299" srcip="127.0.0.1" localip="127.0.0.1" size="165" user="-" host="127.0.0.1" method="GET" statuscode="200" reason="-" extra="-" exceptions="-" time="285" url="/lb-status" server="localhost:4080" port="80" query="" referer="-" cookie="-" set-cookie="-" websocket_scheme="-" websocket_protocol="-" websocket_key="-" websocket_version="-" uid="YBJcmRxS3lzxdzdIupNF@wAAACg"

Hello Ian,

no pictures from you ...

DNAT isn't specific to the application/website. It's simply taking all traffic going to (your public IP) on port 443 and sending it to whatever DESTINATION (hence DNAT) you have set. When you say "you disabled the DNAT for exchange" - it makes me think you aren't understanding the DNAT rule doesn't know or care if you're accessing Exchange or the other website. 

All your DNATs need to be disabled for the WAF to work, as far as I know. 

If connecting to the website sends your request to the exchange backend (real webserver - either 1) your DNAT is still enabled or 2) your virtual webserver/real webserver is misconfigured. 

They're in an earlier reply in another "thread" of the page. Scrollup.

You're right about DNATs taking precedence over WAF, Aaron.  See #2 in Rulz (last updated 2020-11-12).

Cheers - Bob

Bob - I did check your Rulz page - I didn't see WAF listed specifically. Is it part of the "Proxies" category? 

Correct - the name of the log file in Linux is reverseproxy.log.

Cheers - Bob

Hello Gents

Thank you for your help. BAlfson you can close this if you would like, as it does not seem to work.

If I disable ALL the DNAT rules Exchange breaks and the 2nd website then works. I cannot have this, email is more important.

I have used this link https://support.sophos.com/support/s/article/KB-000035032?language=en_US to set up the Exchange but no success.

I will find another way to do this, thank you all (especially Aaron) for your time and help.

I'm not sure you'll find another way to do this on the Sophos - but I'm not a subject expert. In the event you choose to revisit this: I'm fairly confident you can't have any NAT rules active for the public IP you're trying to balance your different websites behind. Properly configure the WAF for the different websites you're trying to host, and things will start to work. 

Thanks Aaron, yes I realize that I am looking at using another firewall system and going away from Sophos.