Remote Access and Outlook Web Access on SBS 2003

I am absolutely exasperated with Microsoft regarding a lack of a decent
quick-fix Wizard for Remote Access on SBS 2003, not to mention the insistence
on "passport" names & passwords to access newsgroups and Knowledgebase
articles, which require new/changed passwords.

I have a client whose SBS 2003 server has 1 (yes, I know MS doesn't like it)
one NIC card, which is connected behind a D-Link DI-524 router (directly
wired, not wireless). I have updated its firmware to the latest version.
Though I have enabled open ports (in the router) for 443, 444, 1723, and 4125
to go to the server (locally at 192.168.0.2) from the router (locally at
192.168.0.1), and though I can connect to the router (at <external IP>:8080),
I have been entirely unable to connect to server for Outlook Web Access or
Remote Access. My local IP is 172.16.0.34, so duality of local subnets is
not the problem. The ISP is a fixed-IP T1 line, and the DNS and Gateway
entries are correct. I have run and re-run CEICW, without success, including
turning off and then turning on access.

I am not incapable of reading instructions, but this is trying my patience.

Sorry, I confused unnecessarily.

"My local IP" (of 172.16.0.34) is on my home office.

The D-Link is in another location, with its IP of 192.168.0.1, and the SBS
2003 server is on its subnet at 192.168.0.2.

What I meant was, when I connected from my "home office" to the external IP
of the server's office <66.xxx.xxx.xx>, that I could not connect to the
server, though I was able to connect to the D-Link router.

Thanks.

I will post the ipconfig within 12 hours.

In news:589C98CA-0334-43C9-92BE-EF112A292F3A@microsoft.com,
Greg Kirkpatrick <GregKirkpatrick@discussions.microsoft.com> typed:
> I am absolutely exasperated with Microsoft regarding a lack of a
> decent quick-fix Wizard for Remote Access on SBS 2003, not to mention
> the insistence on "passport" names & passwords to access newsgroups
> and Knowledgebase articles, which require new/changed passwords.
>
> I have a client whose SBS 2003 server has 1 (yes, I know MS doesn't
> like it) one NIC card,

I don't like 2 NICs in a domain controller, either, for what it's worth. But
I'm not sure your d-link is a real firewall - you might want to consider
upgrading this to something more robust.

> which is connected behind a D-Link DI-524
> router (directly wired, not wireless). I have updated its firmware
> to the latest version. Though I have enabled open ports (in the
> router) for 443, 444, 1723, and 4125 to go to the server (locally at
> 192.168.0.2) from the router (locally at 192.168.0.1), and though I
> can connect to the router (at <external IP>:8080), I have been
> entirely unable to connect to server for Outlook Web Access or Remote
> Access. My local IP is 172.16.0.34, so duality of local subnets is
> not the problem. The ISP is a fixed-IP T1 line, and the DNS and
> Gateway entries are correct. I have run and re-run CEICW, without
> success, including turning off and then turning on access.
>

Sounds like you have double NAT in place. both 192.168.0.0 and 172.16.0.0
are private/nonroutable networks. If your d-link is doing NAT, get your ISP
to disable NAT on their router.


> I am not incapable of reading instructions, but this is trying my
> patience.

Not really an SBS/Windows issue at all, actually...

Ok, I am going to make this CRYSTAL clear.

In my home office, located in Delray Beach, FL, my router is on local IP
172.16.0.1, and in my home office, located in Delray Beach, FL, my computer
is at local IP 172.16.0.34.

In my client's office, in Boca Raton, FL, (about 7 miles away), his router
is on local IP 192.16.0.1, and his SBS 2003 server is on local IP 192.16.0.2.

My client has a static IP (on a T1 line) at 66.xxx.xxx.xxx.

I can easily connect to my client's D-Link DI-524 router at
http://66.xxx.xxx.xxx:8080/

I cannot connect to my client's server, for OWA or RWW.

What I was saying, was, that my home office's local subnet was different
that the subnet for my client, so THAT was not the problem.

I have no reason to be annoyed with either my ISP or my client's.

I have EVERY reason to be annoyed with Microsoft.

As I am not at my client's location now, this is extrapolated from what I
remember:

Ethernet adapter Local Area Connection:

Connection-specific DNS Suffix . : unknown
Description . . . . . . . . . . . : unknown
Physical Address. . . . . . . . . : unknown
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : No
IP Address. . . . . . . . . . . . : 192.168.0.2
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . : 192.168.0.1
DHCP Server . . . . . . . . . . . : 192.168.0.1
DNS Servers . . . . . . . . . . . : 66.205.225.9
66.205.225.10
Lease Obtained. . . . . . . . . . : Sunday, February 05, 2006
11:43:31 PM
Lease Expires . . . . . . . . . . : Monday, February 06, 2006
12:43:31 AM

In news:02E9DCBA-57CA-433D-8F9E-FD8E966B071F@microsoft.com,
Greg Kirkpatrick <GregKirkpatrick@discussions.microsoft.com> typed:
> Ok, I am going to make this CRYSTAL clear.
>
> In my home office, located in Delray Beach, FL, my router is on local
> IP 172.16.0.1, and in my home office, located in Delray Beach, FL, my
> computer is at local IP 172.16.0.34.
>
> In my client's office, in Boca Raton, FL, (about 7 miles away), his
> router is on local IP 192.16.0.1, and his SBS 2003 server is on local
> IP 192.16.0.2.
>
> My client has a static IP (on a T1 line) at 66.xxx.xxx.xxx.
>
> I can easily connect to my client's D-Link DI-524 router at
> http://66.xxx.xxx.xxx:8080/
>
> I cannot connect to my client's server, for OWA or RWW.
>
> What I was saying, was, that my home office's local subnet was
> different that the subnet for my client, so THAT was not the problem.
>
> I have no reason to be annoyed with either my ISP or my client's.
>
> I have EVERY reason to be annoyed with Microsoft.

My stars, calm down, and play nice - we're all just volunteers in here.

By your own admission, you didn't post all the relevant
network info clearly at first, and I replied based on the information
given - and then you will see that I replied to my *own* post after seeing
your clarification.

If you can use RWW, OWA, internally, the problem is likely to do with your
firewall config. Don't use UPnP, if you tried that - configure the router
/port forwarding manually.

From the outside, see what you can telnet to. You have 1723 open; but if
you're allowing 4125, 443, 444, you should be able to try connecting
*without* VPN [1] via a telnet session, then through a browser, to see what
fails and when.



[1] PPTP VPN isn't worth the paper it's printed on, if you ask me.....

I can use OWA from within the client's office LAN. I didn't try RWW from
within the client's office LAN. I doubt the problem is due to D-Link, since
it is possible for me (even now) to access it via http://66.xxx.xxx.xxx:8080.

"Lanwench [MVP - Exchange]" wrote:

I say it's likely an issue with your dlink. From your LAN, can you use RWW?
OWA?

In news:02E419D1-4856-4F52-BB79-C19F9065F556@microsoft.com,
Greg Kirkpatrick <GregKirkpatrick@discussions.microsoft.com> typed:
> As I am not at my client's location now, this is extrapolated from
> what I remember:
>
> Ethernet adapter Local Area Connection:
>
> Connection-specific DNS Suffix . : unknown
> Description . . . . . . . . . . . : unknown
> Physical Address. . . . . . . . . : unknown
> Dhcp Enabled. . . . . . . . . . . : Yes
> Autoconfiguration Enabled . . . . : No
> IP Address. . . . . . . . . . . . : 192.168.0.2
> Subnet Mask . . . . . . . . . . . : 255.255.0.0
> Default Gateway . . . . . . . . . : 192.168.0.1
> DHCP Server . . . . . . . . . . . : 192.168.0.1
> DNS Servers . . . . . . . . . . . : 66.205.225.9
> 66.205.225.10
> Lease Obtained. . . . . . . . . . : Sunday, February 05, 2006
> 11:43:31 PM
> Lease Expires . . . . . . . . . . : Monday, February 06, 2006
> 12:43:31 AM

Presuming this is correct, I see several problems.

If that's your server, why is it getting an IP address via DHCP? It needs a
static address.

You ought to be running DHCP from your SBS box, in addition - not your
router/firewall.

Also, in AD, all clients and servers *must* point only at the internal DNS
server (in this case, SBS, AD-integrated)'s lan IP for DNS - *no* external
DNS servers at all. The forwarders you configure in the DNS server's
properties should take care of external queries.

I'm playing as nice as I can, given the stress my client is putting on me.
No offense intended. I thought I had explained myself well enough, the first
time; but I could see that more than one had interpreted my remarks
differently than I intended.

I am not using UPnP, and I have configured the DI-524 manually, to allow
traffic on ports 443, 444, 1723, and 4125 to be routed to the server
(192.168.0.2).

Telnet won't work to port 4125, as was mentioned in a previous newgroup
message. As for the other ports, none of them are responding, even though I
have NO trouble changing settings on the router itself
(http://66.xxx.xxx.xxx:8080).

[ComputerRick]

First, I agree with Lanwench about it being a configuration issue with your DLink. The reason I'm saying this, if you want to resolve your problem, is because you're so intent on blaming the MS OS.

IF it works in the office, and you're using a single NIC, IT IS NOT the server configuration.

Second, to effectively test your configuration on your DLink, go to the Advanced Tab, Click on the DMZ button and enter the server address.

My concern is that you entered the information in only 1 of the 2 required locations to make it work. The Advanced | Firewall section, where you need to be sure that it is allowed through, and the Advanced | Virtual Server section, which is actually the port forwarding.

Based on the information you've given in the forum, It's very unlikely that it is any issue related to the server at all. It's the DLink, and that is reinforced by the fact that you can access OWA on the local side, you can manage the DLink on the WAN side, but you can't cross the DLink to get internal.

Good Luck.

Rick it would be more helpful for this to be in the original thread as I
have no idea what the problem is of the OP you're referring to.

"ComputerRick" <ComputerRick.3agcjc@DoNotSpam.com> wrote in message
news:ComputerRick.3agcjc@DoNotSpam.com...
>
> *First, I agree with Lanwench about it being a configuration issue with
> your DLink*. The reason I'm saying this, if you want to resolve your
> problem, is because you're so intent on blaming the MS OS.
>
> IF it works in the office, and you're using a single NIC, IT IS NOT the
> server configuration.
>
> Second, to effectively test your configuration on your DLink, go to the
> Advanced Tab, Click on the DMZ button and enter the server address.
>
> MY CONCERN IS THAT YOU ENTERED THE INFORMATION IN ONLY 1 OF THE 2
> REQUIRED LOCATIONS TO MAKE IT WORK. The Advanced | Firewall section,
> where you need to be sure that it is allowed through, and the Advanced
> | Virtual Server section, which is actually the port forwarding.
>
> Based on the information you've given in the forum, It's very unlikely
> that it is any issue related to the server at all. It's the DLink, and
> that is reinforced by the fact that you can access OWA on the local
> side, you can manage the DLink on the WAN side, but you can't cross the
> DLink to get internal.
>
> Good Luck.
>
>
> --
> ComputerRick
> ------------------------------------------------------------------------
> ComputerRick's Profile: http://forums.techarena.in/members/50926.htm
> View this thread: Remote Access and Outlook Web Access on SBS 2003
>
> http://forums.techarena.in
>