Moving to Cloudflare proxy
-
@scottalanmiller said in Moving to Cloudflare proxy:
@Dashrender said in Moving to Cloudflare proxy:
Change the firewall to direct traffic directly to Exchange, but only allow traffic from CloudFlare (not entirely sure how to get the IPs for this lockdown)
Awesome - thanks..
-
@Dashrender said in Moving to Cloudflare proxy:
Use NSLOOKUP to find CF assigned IP Proxy for webmail.domain.com
Change local DNS to point webmail to previously found IPIdeally you don't want a local override, but to use a DNS entry that is external only. Off the top of my head, what if you gave a public hostname to the service, and an internal CNAME to point to that so that internal users do the same thing, but they are really hitting CF's round robin service just the same?
-
@scottalanmiller said in Moving to Cloudflare proxy:
@Dashrender said in Moving to Cloudflare proxy:
Use NSLOOKUP to find CF assigned IP Proxy for webmail.domain.com
Change local DNS to point webmail to previously found IPIdeally you don't want a local override, but to use a DNS entry that is external only. Off the top of my head, what if you gave a public hostname to the service, and an internal CNAME to point to that so that internal users do the same thing, but they are really hitting CF's round robin service just the same?
I don't follow.
I want users to use webmail.domain.com no matter where they are located. Please use that as a starting point and be specific on your thoughts.
Thanks -
But that still doesn't solve the SMTP issue - which if can't be solved, kills this whole discussion.
-
@Dashrender said in Moving to Cloudflare proxy:
@scottalanmiller said in Moving to Cloudflare proxy:
@Dashrender said in Moving to Cloudflare proxy:
Use NSLOOKUP to find CF assigned IP Proxy for webmail.domain.com
Change local DNS to point webmail to previously found IPIdeally you don't want a local override, but to use a DNS entry that is external only. Off the top of my head, what if you gave a public hostname to the service, and an internal CNAME to point to that so that internal users do the same thing, but they are really hitting CF's round robin service just the same?
I don't follow.
I want users to use webmail.domain.com no matter where they are located. Please use that as a starting point and be specific on your thoughts.
ThanksI believe this is where he was going.
setup webmail.domain.com on CF as you have.
setup wtf.domain.com on CF as a cname pointing to webmail.domain.comsetup a webmail.domain.com on your local DNS pointing to wtf.domain.com
But the problem is that as long as you use domain.com you need to point the internal DNS to a Cloudflare IP because of the entire split-dns disaster.
So I would also like @scottalanmiller to clarify.
-
@Dashrender said in Moving to Cloudflare proxy:
But that still doesn't solve the SMTP issue - which if can't be solved, kills this whole discussion.
One thing at a time. Conflating issues is a horrible common scenario from you.
While this is needed to get the entire package, don't short circuit the process.
-
@JaredBusch said in Moving to Cloudflare proxy:
@Dashrender said in Moving to Cloudflare proxy:
But that still doesn't solve the SMTP issue - which if can't be solved, kills this whole discussion.
One thing at a time. Conflating issues is a horrible common scenario from you.
While this is needed to get the entire package, don't short circuit the process.
Fine - new post coming.
-
-
@scottalanmiller still waiting on you to clarify what you meant.
-
@JaredBusch said in Moving to Cloudflare proxy:
@Dashrender said in Moving to Cloudflare proxy:
@scottalanmiller said in Moving to Cloudflare proxy:
@Dashrender said in Moving to Cloudflare proxy:
Use NSLOOKUP to find CF assigned IP Proxy for webmail.domain.com
Change local DNS to point webmail to previously found IPIdeally you don't want a local override, but to use a DNS entry that is external only. Off the top of my head, what if you gave a public hostname to the service, and an internal CNAME to point to that so that internal users do the same thing, but they are really hitting CF's round robin service just the same?
I don't follow.
I want users to use webmail.domain.com no matter where they are located. Please use that as a starting point and be specific on your thoughts.
ThanksI believe this is where he was going.
setup webmail.domain.com on CF as you have.
setup wtf.domain.com on CF as a cname pointing to webmail.domain.comsetup a webmail.domain.com on your local DNS pointing to wtf.domain.com
But the problem is that as long as you use domain.com you need to point the internal DNS to a Cloudflare IP because of the entire split-dns disaster.
So I would also like @scottalanmiller to clarify.
Like that, but more like...
webmail.domain.com on CF A Record
webmail.wtfdomain.com on LAN DNS CNAME pointing to webmail.domain.com
webmail.wtfdomain.com on Public DNS CNAME pointing to webmail.domain.com -
@scottalanmiller said in Moving to Cloudflare proxy:
@JaredBusch said in Moving to Cloudflare proxy:
@Dashrender said in Moving to Cloudflare proxy:
@scottalanmiller said in Moving to Cloudflare proxy:
@Dashrender said in Moving to Cloudflare proxy:
Use NSLOOKUP to find CF assigned IP Proxy for webmail.domain.com
Change local DNS to point webmail to previously found IPIdeally you don't want a local override, but to use a DNS entry that is external only. Off the top of my head, what if you gave a public hostname to the service, and an internal CNAME to point to that so that internal users do the same thing, but they are really hitting CF's round robin service just the same?
I don't follow.
I want users to use webmail.domain.com no matter where they are located. Please use that as a starting point and be specific on your thoughts.
ThanksI believe this is where he was going.
setup webmail.domain.com on CF as you have.
setup wtf.domain.com on CF as a cname pointing to webmail.domain.comsetup a webmail.domain.com on your local DNS pointing to wtf.domain.com
But the problem is that as long as you use domain.com you need to point the internal DNS to a Cloudflare IP because of the entire split-dns disaster.
So I would also like @scottalanmiller to clarify.
Like that, but more like...
webmail.domain.com on CF A Record
webmail.wtfdomain.com on LAN DNS CNAME pointing to webmail.domain.com
webmail.wtfdomain.com on Public DNS CNAME pointing to webmail.domain.comOk, a second domain. That I expect to work liek this.
-
Seriously you want me to buy another domain to fix this?
I'm frazzled this morning - so I might be missing something.
-
@Dashrender said in Moving to Cloudflare proxy:
Seriously you want me to buy another domain to fix this?
I'm frazzled this morning - so I might be missing something.
I would just use an A record on your local DNS pointing to WTF ever Cloudflare resolves your FQDN to.
But paying more attention to what @scottalanmiller said, he has that backwards on the second domain.
CF: A Record: webmail.domain.com pointing to your public IP, orange cloud on.
CF: CNAME: webmail.wtfdomain.com pointing to webmail.domain.com
Local DNS: CNAME: webmail.domain.com pointing to webmail.wtfdomain.com -
@Dashrender said in Moving to Cloudflare proxy:
Seriously you want me to buy another domain to fix this?
Yes, because someone screwed up with the original domain, so yes, you need to either fix that or do something to work around it. Mistakes have costs, this is a pretty trivial one.
