I have done my due diligence and searched both here and Google for an answer to my conundrum, but I am coming up empty with my exact problem.
I will say first off, major props to the devs for this program. Amazing software that does what Micro-don’t. On to the issue…
I have a Reverse Proxy (FreeBSD 10.2 running HAProxy 1.6.4 from pkg repository) in my DMZ that listens for incoming traffic on 443. I initially ran using the SSL Passthrough method and everything worked great functionality wise. I, however, wanted to leverage some of the security features in HAProxy. So I changed my configs over to using HTTP mode and perform SSL Bridging instead. After many hours of fiddling with the configs I was finally able to get HTTPS working with SSL Bridging, so I thought. My ActiveSync and my EWS clients are working fine in this method and my Android RDP client connects successfully too, however that ugly beast NTLM is causing issues when it comes to the desktop version of the RDP client and using Outlook Anywhere external to the network.
I poured over the logs inside Remote Desktop Gateway (running on Server 2012 R2 up-to-date on patches) and quadruple checked my configs and ensuring I had the SSL Bridging mode in RD Gateway set and determined that the Android Remote Desktop client is authenticating using Kerberos over HTTP. Fancy that! But the stupid desktop RDP client uses NTLMV2 and fails connection every single time. The traffic makes it through the proxy, hits the RD Gateway server, and fails authentication throwing an Audit Failure for the user account. The same user account that was working under the TCP SSL Passthrough mode.
This gets weirder though…I decided to embark on a quest to figure this out and get SSL Bridging operating correctly. I ran across a config posted on the ALOHA documentation about the different types of HTTP and how the default is option http-keep-alive and such. The config showed a system operating in SSL Offloading mode with option http-keep-alive. I decided to give that a try. After a few updates to the config in HAProxy and an update for Remote Desktop Gateway to expect an incoming HTTP connection instead of HTTPS, lo and behold it worked! I successfully logged in with the same user and was brought to my remote desktop from a desktop RDP client.
Something hinky is definitely going on here. The software is doing what it is supposed to, but for some reason NTLMv2 refuses to work in SSL Bridge mode. I can only get this to work in SSL Offload mode. I checked Outlook Anywhere and it is having the same issue as RD Gateway. I see the traffic and the HTTPS requests logged in HAProxy, but no joy.
I have pasted a copy of my config here and I am more than happy to provide any logs to help track this issue down:
global
log /var/run/log local0 debug
#chroot /usr/jail/haproxy
stats socket /var/run/haproxy/admin.sock mode 660 level admin
stats timeout 30s
user haproxy
group haproxy
daemon
# Default SSL material locations
ca-base /path/to/cafiles
crt-base /path/to/certs
# Default ciphers to use on SSL-enabled listening sockets.
# For more information, see ciphers(1SSL).
#ssl-default-bind-ciphers kEECDH+aRSA+AES:kRSA+AES:+AES256:RC4-SHA:!kEDH:!LOW:!EXP:!MD5:!aNULL:!eNULL
#ssl-default-bind-options no-sslv3
#Secure SSL Cipher Settings
tune.ssl.default-dh-param 2048
ssl-default-bind-options no-sslv3 no-tls-tickets
ssl-default-bind-ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
ssl-default-server-options no-sslv3 no-tls-tickets
ssl-default-server-ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA
defaults
log /var/run/log local0 debug
mode http
option httplog
option dontlognull
#timeout connect 4s
#timeout client 300s
#timeout server 300s
#errorfile 400 /usr/local/etc/haproxy/errors/400.http
#errorfile 403 /usr/local/etc/haproxy/errors/403.http
#errorfile 408 /usr/local/etc/haproxy/errors/408.http
#errorfile 500 /usr/local/etc/haproxy/errors/500.http
#errorfile 502 /usr/local/etc/haproxy/errors/502.http
#errorfile 503 /usr/local/etc/haproxy/errors/503.http
#errorfile 504 /usr/local/etc/haproxy/errors/504.http
frontend ssl_relay
bind reverseIPaddress:443 ssl crt /path/to/cert/
option http-keep-alive
capture request header Host len 32
log global
option httplog
maxconn 300
use_backend ssl_mail if { ssl_fc_sni mailserver }
use_backend ssl_rd if { ssl_fc_sni rdserver }
use_backend ssl_chat if { ssl_fc_sni chatserver }
default_backend ssl_mail
backend ssl_mail
option http-keep-alive
log global
option httplog
server mail servername:443 ssl verify none
backend ssl_rd
option http-keep-alive
log global
option httplog
server rd servername:80 check
backend ssl_chat
option http-keep-alive
log global
option httplog
server chat servername:443 ssl verify none