
Explanation:
In a perimeter DMZ configuration to permit access to OWA from internet we just need to permit the http port in this case 80 and 448.
From the external firewall to our internal we needed to permit the others Reference:
Exchange 2000 resource Kit
Configuring Firewalls
Chapter 10 - Planning Outlook Web Access Servers
Firewall Integration
This section focuses on firewall planning. You will need to communicate with the relevant individuals or departments to ensure that you have planned for your firewall(s) to accommodate your FE/BE server topology.
Front End behind Firewall
As outlined earlier in this chapter, if OWA is being accessed from the Internet, your front-end server is likely to be behind a firewall. The services and ports that will need to be enabled are listed in Firewall Integration Table 1.
Table 1. Firewall Configuration: Front End Behind Firewall
Source Destination Service Protocol and Port
Internet / External Network Internal/Private Network HTTP TCP 80
HTTP TCP 443
IMAP4 TCP 143
IMAP4TLS TCP 993
Front-End on Perimeter Network
If you plan to deploy your front-end server on a perimeter network (as outlined earlier in this chapter), there must be two firewalls. The services and ports that must be enabled are listed in Firewall Integration Table 2.
Table 2. Front-End Server(s) in a Perimeter Network
Source Destination Service Protocol and Port
Internet / External Network Perimeter Network HTTP TCP 80
HTTP TCP 443
IMAP4 TCP 143
IMAP4TLS TCP 993
Perimeter Network Internal/Private Network DNS TCP, UDP 53
HTTP TCP 80
RPC EP Mapper TCP 135
KERBEROS TCP UDP 88
LDAP TCP 389
NETLOGON TCP 445
DS Access (GC) TCP 3268
TCP High Ports TCP 1024+
If your security policy does not permit one or more of these services through the firewall, it is possible to statically configure services such as DNS and RPC to reduce the number of ports. For more information on this subject, refer to the Microsoft white paper "The Exchange 2000 Front- End and Back-End Topology," at:http://www.microsoft.com/exchange/techinfo/E2KFrontBack.htm