OPNWAF Exchange Server – HTTP to HTTPS redirect

[Zwiebelhacker]

Hi,

I'm using OPNsense Business Edition with the OPNWAF plugin as a reverse proxy for an on-premises Exchange Server.
I have enabled the global "Redirect HTTP to HTTPS" option under the OPNWAF general settings.

According to the documentation, this option:
"Enables a permanent redirect (301 Moved Permanently) from HTTP to HTTPS. This will bind the default HTTP port additionally for all virtual hosts."

Therefore, I assumed that a request such as:
http://webmail.example.com/ would be redirected to: https://webmail.example.com/

However, this does not seem to be the case with an Exchange Server virtual host.

The generated Apache configuration contains the following for the HTTP virtual host:

<VirtualHost *:80>
    ServerName webmail.example.com
    Options -FollowSymLinks
    Options -Indexes
    Options -ExecCGI
    LogLevel warn
    ProxyRequests Off

    # Start ExchangeHttps
    Header always set X-Frame-Options SAMEORIGIN
    Header set Server Apache
    RequestHeader unset Expect early
    Header unset X-AspNet-Version
    Header unset X-OWA-Version
    Header unset X-Powered-By

    RewriteEngine On
    RewriteCond %{HTTPS} !=on
    RewriteRule ^/owa(.*) https://webmail.example.com/owa$1 [R,L]
    RewriteRule ^/ecp(.*) https://webmail.example.com/ecp$1 [R,L]
    RewriteRule ^/Microsoft-Server-ActiveSync(.*) https://webmail.example.com/Microsoft-Server-ActiveSync$1 [R,L]

    # End ExchangeHttps
</VirtualHost>

As you can see, there are rewrite rules for:

•   /owa
•   /ecp
•   /Microsoft-Server-ActiveSync

but there is no general rule for /.

When I run:
curl.exe -I http://webmail.example.com/

I get:
HTTP/1.1 403 Forbidden
Server: Apache

Whereas the request is correctly handled when accessing /owa.

The documentation for the Exchange Server location also states:
"Access to path / is filtered per default with a redirect to /owa."

This makes me wonder whether the behavior I'm seeing is intentional.

My questions

1.   Is it expected that the global "Redirect HTTP to HTTPS" setting does not generate a HTTP→HTTPS redirect for the / path of an Exchange virtual host?
2.   Should the Exchange Server template normally generate an additional / → /owa redirect?
3.   If both behaviors are expected, should I see something similar to:

RewriteRule ^/(.*) https://webmail.example.com/$1 [R=301,L]

and/or a rule redirecting / to /owa in the generated configuration?

4.   If this is intentional, what is the recommended way to redirect the root path / to HTTPS (and subsequently /owa) without manually modifying the generated gateway_vhosts.conf? Just

I'm asking because the wording of the global HTTP→HTTPS option led me to expect that all HTTP requests for all virtual hosts, including the root path of an Exchange virtual host, would receive a 301 redirect.

Thanks!

[Monviech (Cedrik)]

What is returning on the base URI that needs https protection? Is there any authentication possible?

Isn't it just the IIS default page that responds?

You are right that there is no general /owa redirect. But isn't IIS handling such a redirect?

I would assume this flow:

1. Client sends to http://webmail.example.com/ -> Apache receives and proxies -> IIS receives
2. IIS wants to redirect / to /owa and sends this back -> Apache receives and proxies -> Client receives redirect
3. Client now accesses http://webmail.example.com/owa -> Apache receives and upgrades to HTTPS and proxies -> IIS receives

Looking at the generated HTTP vhost again, you're right: / isn't proxied there either, so IIS never gets a chance to perform its redirect. This seems inconsistent with the documented global HTTP→HTTPS behavior. Please open a feature request; I think the Exchange HTTP template should probably have a catch-all HTTPS redirect as well.

If there is an issue feel free to open a feature request here:
https://github.com/opnsense/plugins/issues?q=is%3Aissue%20OPNWAF

[Zwiebelhacker]

Thanks for taking the time to look into this and for explaining the expected flow.

I agree that a catch-all HTTPS redirect in the Exchange HTTP template would be the most consistent behavior with the documented global HTTP→HTTPS option.

I'll open a feature request for this. Thanks for clarifying!

https://github.com/opnsense/plugins/issues/5645