{"id":100488,"date":"2026-02-15T15:04:46","date_gmt":"2026-02-15T14:04:46","guid":{"rendered":"https:\/\/dyb.fr\/?p=100488"},"modified":"2026-02-15T15:04:47","modified_gmt":"2026-02-15T14:04:47","slug":"heberger-microsoft-exchange-derriere-une-seule-ip-publique-avec-haproxy-et-nginx-et-garder-ntlm","status":"publish","type":"post","link":"https:\/\/dyb.eu\/blog\/heberger-microsoft-exchange-derriere-une-seule-ip-publique-avec-haproxy-et-nginx-et-garder-ntlm\/","title":{"rendered":"H\u00e9berger Microsoft Exchange derri\u00e8re une seule IP publique avec HAProxy et Nginx (et garder NTLM)"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">Architecture hybride L4 \/ L7 compatible NTLM et ActiveSync<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">H\u00e9berger <strong>Microsoft Exchange 2019<\/strong> derri\u00e8re une seule IP publique peut rapidement devenir complexe lorsqu\u2019on utilise un reverse proxy comme <strong>Nginx Proxy Manager<\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Probl\u00e8me fr\u00e9quent :<br>Exchange utilise <strong>NTLM, ActiveSync, MAPI et des connexions persistantes<\/strong> qui ne supportent pas toujours correctement la terminaison SSL en Layer 7.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Dans cet article, nous d\u00e9taillons :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Pourquoi Nginx peut poser probl\u00e8me avec Exchange<\/li>\n\n\n\n<li>Pourquoi un reverse proxy Layer 4 est plus adapt\u00e9<\/li>\n\n\n\n<li>Comment combiner HAProxy et Nginx proprement<\/li>\n\n\n\n<li>Une configuration compl\u00e8te pr\u00eate \u00e0 d\u00e9ployer<\/li>\n\n\n\n<li>Un comparatif clair L4 vs L7<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Pourquoi Exchange ne supporte pas toujours un reverse proxy L7 ?<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft Exchange repose sur :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>NTLM (authentification stateful)<\/li>\n\n\n\n<li>Connexions TCP persistantes<\/li>\n\n\n\n<li>N\u00e9gociation d\u2019authentification multi-\u00e9tapes<\/li>\n\n\n\n<li>ActiveSync<\/li>\n\n\n\n<li>MAPI over HTTP<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Lorsque le reverse proxy termine le SSL (mode L7 classique), il peut :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Casser la n\u00e9gociation NTLM<\/li>\n\n\n\n<li>Interrompre les sessions Outlook<\/li>\n\n\n\n<li>G\u00e9n\u00e9rer des erreurs 401 r\u00e9p\u00e9t\u00e9es<\/li>\n\n\n\n<li>Provoquer des demandes de mot de passe en boucle<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\ud83d\udc49 Typiquement, les utilisateurs voient Outlook redemander leurs identifiants en permanence.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Solution retenue : HAProxy en Layer 4 (TCP Passthrough)<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Au lieu de terminer le SSL en frontal, nous utilisons :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>HAProxy en mode TCP<\/strong><\/li>\n\n\n\n<li>Lecture du SNI uniquement<\/li>\n\n\n\n<li>Redirection vers Exchange sans d\u00e9chiffrement<\/li>\n\n\n\n<li>Persistance par IP source<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Cela permet :<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u2714 Compatibilit\u00e9 totale NTLM<br>\u2714 Sessions ActiveSync stables<br>\u2714 Une seule IP publique<br>\u2714 Conservation de Nginx pour les autres applications<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Sch\u00e9ma d\u2019architecture<\/h1>\n\n\n<figure class=\"wp-block-post-featured-image\"><img loading=\"lazy\" decoding=\"async\" width=\"1536\" height=\"1024\" src=\"https:\/\/dyb.eu\/blog\/wp-content\/uploads\/2026\/02\/haproxy-exchange.png\" class=\"attachment-post-thumbnail size-post-thumbnail wp-post-image\" alt=\"\" style=\"object-fit:cover;\" srcset=\"https:\/\/dyb.eu\/blog\/wp-content\/uploads\/2026\/02\/haproxy-exchange.png 1536w, https:\/\/dyb.eu\/blog\/wp-content\/uploads\/2026\/02\/haproxy-exchange-1280x853.png 1280w, https:\/\/dyb.eu\/blog\/wp-content\/uploads\/2026\/02\/haproxy-exchange-980x653.png 980w, https:\/\/dyb.eu\/blog\/wp-content\/uploads\/2026\/02\/haproxy-exchange-480x320.png 480w\" sizes=\"(min-width: 0px) and (max-width: 480px) 480px, (min-width: 481px) and (max-width: 980px) 980px, (min-width: 981px) and (max-width: 1280px) 1280px, (min-width: 1281px) 1536px, 100vw\" \/><\/figure>\n\n\n<pre class=\"wp-block-code\"><code>                     INTERNET\n                         |\n                  IP Publique\n                         |\n                    HAProxy (L4)\n                TCP passthrough + SNI\n                         |\n       ---------------------------------------\n       |                                     |\nMicrosoft Exchange                    Nginx Proxy Manager\n192.168.10.2                           192.168.20.2\n<\/code><\/pre>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Flux d\u00e9taill\u00e9<\/h1>\n\n\n\n<h3 class=\"wp-block-heading\">Pour exchange.dyb.test<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Client Outlook\n     |\nTLS 443\n     |\nHAProxy (lecture SNI)\n     |\nTCP passthrough\n     |\nExchange 192.168.10.2\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">SSL est termin\u00e9 par Exchange directement.<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\">Pour les autres services web<\/h3>\n\n\n\n<pre class=\"wp-block-code\"><code>Navigateur Web\n     |\nTLS 443\n     |\nHAProxy\n     |\nNginx Proxy Manager\n     |\nApplications internes\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Nginx continue de g\u00e9rer :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Let's Encrypt<\/li>\n\n\n\n<li>Redirections HTTP \u2192 HTTPS<\/li>\n\n\n\n<li>Reverse proxy applicatif<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Configuration HAProxy compl\u00e8te<\/h1>\n\n\n\n<pre class=\"wp-block-code\"><code>global\n    log \/dev\/log local0\n    log \/dev\/log local1 notice\n    chroot \/var\/lib\/haproxy\n    stats socket \/run\/haproxy\/admin.sock mode 660 level admin\n    user haproxy\n    group haproxy\n    daemon\n    maxconn 50000\n\n    ca-base \/etc\/ssl\/certs\n    crt-base \/etc\/ssl\/private\n    ssl-default-bind-options ssl-min-ver TLSv1.2 no-tls-tickets\n\ndefaults\n    log global\n    mode tcp\n    option tcplog\n    option dontlognull\n    timeout connect 10s\n    timeout client 3600s\n    timeout server 3600s\n    timeout tunnel 3600s\n\nfrontend https_in\n    bind *:443\n    mode tcp\n\n    tcp-request inspect-delay 5s\n    tcp-request content accept if { req_ssl_hello_type 1 }\n\n    use_backend exchange_back if { req_ssl_sni -i exchange.dyb.test }\n    use_backend exchange_back if { req_ssl_sni -i autodiscover.dyb.test }\n\n    default_backend npm_https_back\n\nfrontend http_in\n    bind *:80\n    mode tcp\n    default_backend npm_http_back\n\nbackend exchange_back\n    mode tcp\n\n    stick-table type ip size 50k expire 30m\n    stick on src\n\n    server exchange01 192.168.10.2:443 check\n\nbackend npm_https_back\n    mode tcp\n    server npm01 192.168.20.2:443 check\n\nbackend npm_http_back\n    mode tcp\n    server npm01 192.168.20.2:80 check\n\nfrontend stats\n    bind *:8404\n    mode http\n    stats enable\n    stats uri \/stats\n    stats refresh 10s\n    stats auth admin:changeme\n<\/code><\/pre>\n\n\n\n<h1 class=\"wp-block-heading\">Comparatif Reverse Proxy Layer 4 vs Layer 7<\/h1>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><th>Crit\u00e8re<\/th><th>Layer 4 (TCP)<\/th><th>Layer 7 (HTTP)<\/th><\/tr><\/thead><tbody><tr><td>Niveau OSI<\/td><td>Transport<\/td><td>Application<\/td><\/tr><tr><td>Terminaison SSL<\/td><td>Non obligatoire<\/td><td>Oui<\/td><\/tr><tr><td>Lecture HTTP headers<\/td><td>Non<\/td><td>Oui<\/td><\/tr><tr><td>Compatible NTLM<\/td><td>Oui<\/td><td>Parfois instable<\/td><\/tr><tr><td>Compatible ActiveSync<\/td><td>Oui<\/td><td>Peut poser probl\u00e8me<\/td><\/tr><tr><td>WAF possible<\/td><td>Non<\/td><td>Oui<\/td><\/tr><tr><td>Performance<\/td><td>Tr\u00e8s \u00e9lev\u00e9e<\/td><td>\u00c9lev\u00e9e<\/td><\/tr><tr><td>Id\u00e9al pour Exchange<\/td><td>\u2714<\/td><td>\u26a0\ufe0f<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Quand choisir cette architecture ?<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Cette architecture est recommand\u00e9e si :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Vous disposez d\u2019une seule IP publique<\/li>\n\n\n\n<li>Vous h\u00e9bergez Exchange en interne<\/li>\n\n\n\n<li>Vous utilisez d\u00e9j\u00e0 Nginx ou NPM<\/li>\n\n\n\n<li>Vous souhaitez \u00e9viter les erreurs NTLM<\/li>\n\n\n\n<li>Vous voulez conserver Let's Encrypt automatique<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Avantages de l\u2019architecture hybride<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u2714 S\u00e9paration claire des r\u00f4les<br>\u2714 Haute compatibilit\u00e9 Exchange<br>\u2714 Scalabilit\u00e9<br>\u2714 Performance \u00e9lev\u00e9e<br>\u2714 Architecture maintenable<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">S\u00e9curit\u00e9 : bonnes pratiques compl\u00e9mentaires<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">Pour s\u00e9curiser davantage cette architecture :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Filtrage firewall strict<\/li>\n\n\n\n<li>IDS\/IPS (Suricata \/ Snort)<\/li>\n\n\n\n<li>Protection SMTP d\u00e9di\u00e9e<\/li>\n\n\n\n<li>S\u00e9paration DMZ<\/li>\n\n\n\n<li>Monitoring des logs HAProxy<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h1 class=\"wp-block-heading\">Conclusion<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">H\u00e9berger Microsoft Exchange derri\u00e8re une seule IP publique est parfaitement possible, \u00e0 condition d\u2019utiliser la bonne approche.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">La combinaison :<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">HAProxy en Layer 4 + Nginx en Layer 7<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\">offre un \u00e9quilibre optimal entre compatibilit\u00e9, s\u00e9curit\u00e9 et flexibilit\u00e9.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Chez DYB, nous mettons en place ce type d\u2019architecture pour garantir :<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Une disponibilit\u00e9 maximale<\/li>\n\n\n\n<li>Une compatibilit\u00e9 totale Outlook \/ ActiveSync<\/li>\n\n\n\n<li>Une infrastructure robuste et \u00e9volutive<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Comment h\u00e9berger Microsoft Exchange derri\u00e8re une seule IP publique sans casser NTLM ou ActiveSync ? D\u00e9couvrez une architecture hybride avec HAProxy en Layer 4 et Nginx en Layer 7 pour garantir stabilit\u00e9, performance et compatibilit\u00e9 Outlook.<\/p>\n","protected":false},"author":1,"featured_media":100490,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26,22,24],"tags":[21,50,23,28],"class_list":["post-100488","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-adminsys","category-cybersecurite","category-reseaux","tag-cybersecurite","tag-network","tag-pfsense","tag-windows"],"_links":{"self":[{"href":"https:\/\/dyb.eu\/blog\/wp-json\/wp\/v2\/posts\/100488","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dyb.eu\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dyb.eu\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dyb.eu\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dyb.eu\/blog\/wp-json\/wp\/v2\/comments?post=100488"}],"version-history":[{"count":2,"href":"https:\/\/dyb.eu\/blog\/wp-json\/wp\/v2\/posts\/100488\/revisions"}],"predecessor-version":[{"id":100491,"href":"https:\/\/dyb.eu\/blog\/wp-json\/wp\/v2\/posts\/100488\/revisions\/100491"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/dyb.eu\/blog\/wp-json\/wp\/v2\/media\/100490"}],"wp:attachment":[{"href":"https:\/\/dyb.eu\/blog\/wp-json\/wp\/v2\/media?parent=100488"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dyb.eu\/blog\/wp-json\/wp\/v2\/categories?post=100488"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dyb.eu\/blog\/wp-json\/wp\/v2\/tags?post=100488"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}