I have a growing demand for access to internal LAN services from the internet. Up until recently the only service provided via the web was access to email(Exchange-OWA). Now we have a vendor supplied web app that provides access to our main records system. I use a Sonicwall NSA 2400 at my edge with a single public IP address on the WAN interface. The primary LAN interface connects to our switch core. The secondary LAN interface connects to a simple 24 port switch and acts as a DMZ, though it hasn't been used(much) until now. All my servers are virtualized(VMware ESXi) and have the possibility to connect to either the primary LAN or the DMZ. Access to OWA was facilitated in the sonicwall by a NAT policy that allowed the port 443 traffic to be redirected to our mail server internally.
With the new webapp I attempted to set up a new NAT policy that used a non-standard port number to carry https traffic to the new server, rather than having the default 443 traffic get forwarded to the mail server. The vendor configured the server accordingly. What we found(obviously now) was that a long url with the non-standard port number has to be used to avoid a forwarding conflict with the mail server. So we started thinking about how to do redirection. Well, that is what brings me to the question of what is the best overall strategy for allowing different incoming requests to our public ip to be routed securely and reliably to the correct inside server/services. Should I continue relying solely on my firewall nat and port forwarding? Is a better plan to build a portal of some kind? We do anticipate have even more servers/services that need access from the internet using web browsers and other applications. Any good ideas?