If you want to publish your Web App to the internet, you ideally should not directly NAT port 443 (or you custom HTTPS port) to you internal server. Instead, there should be a Reverse Proxy in a DMZ that accepts requests and then routes them to the internal server. You need to configure a Reverse Proxy with nginx or IIS.

Here is how you can do it with IIS.

Install IIS Role in Server Manager (Add Roles and Features > Web Server (IIS)

Download and install URL Rewrite and Application Request Routing (ARR)

https://iis-umbraco.azurewebsites.net/downloads/microsoft/url-rewrite

https://iis-umbraco.azurewebsites.net/downloads/microsoft/application-request-routing

In IIS Manager, stop Default Website:

Create a new Website:

Make sure you configure your parameters. The host name should be the public DNS name.

Now open URL Rewrite and create a new rule.

Enter the ip of the internal server along with the port.

View Server Variables and add HTTP_HOST and HTTP_Authentication-Context-Policy as a variable.

Go back to rules and double click on the rule you just created.

Open server variables and add the application’s host name under HOST_NAME.

Add another variable with the name HTTP_Authentication-Context-Policy and value of internet

You should have variables.

Apply settings at the top right.

Next, select the server and open Configuration Editor:

Go to section System.Webserver/Proxy

Set preserveHostHeader to true and reverseRewriteHostInResponseHeaders to false

Apply changes at the top right.

Bonus: Increase timeout if bigger data chunks are sent to the client.

On the site, open Configuration Editor

Open Section system.web/Sessionstate

In stateNetworkTimeout increase value to 01:00 or higher.

Don’t forger to apply changes and restart IIS.

Exchange Zero days are very common these days and there is a freshly baked one today (30th September 2022 as of writing). If you want to know what how the vulnerabilities work, take a look at the reference at the bottom. As a sysadmin I care about securing my systems.

Here are a few steps to mitigate this zero day vulnerability:

In IIS Manager on the Exchange Server, select the Autodiscover virtual directory and open URL Rewrite and add a new rule.

Select Request Blocking

Enter the string

.*autodiscover\.json.*\@.*Powershell.*

Using should be changed to Regular Expression.

Change URL to REQUEST_URI and save the changes.

References:

https://msrc-blog.microsoft.com/2022/09/29/customer-guidance-for-reported-zero-day-vulnerabilities-in-microsoft-exchange-server/