Reverse Proxy for Microsoft Exchange Server 2019

[jmccreary]

The only thing not working on my Nginx Proxy Manager setup is my Exchange server, I can access the webmail portion just fine. The problem is with outlook desktop clients, no matter what I do they won’t sign in. I believe it has something to do with the way the autodiscover sub-domain proxy is setup, but I have no idea how to configure this in on Nginx Proxy Manager. I can’t seem to find any information online about how to configure it.

I did find this setup for Nginx, but I’m not sure how this would transfer over to Nginx Proxy Manager.

server {
if ($host = $mail.domain.tld) {
return 301 https://$host$request_uri;
} # managed by Certbot

    listen 80;
    listen [::]:80;

    server_name $mail.domain.tld;
    return 404; # managed by Certbot

    ssl_verify_client       off;

}
server {

    listen [::]:443 ssl http2 ipv6only=on; # managed by Certbot
    listen 443 ssl http2; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/$mail.domain.tld/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/$mail.domain.tld/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

    server_name $mail.domain.tld;

    ssl_verify_client       off;

    location /                              { proxy_pass https://$exchange_server; }
    location /owa                           { proxy_pass https://$exchange_server/owa; }
    location /exchange                      { proxy_pass https://$exchange_server/exchange; }
    location /ews                           { proxy_pass https://$exchange_server/ews; }
    location /mapi                          { proxy_pass https://$exchange_server/mapi; }
    location /rpc                           { proxy_pass https://$exchange_server/rpc; }
    location /oab                           { proxy_pass https://$exchange_server/oab; }
    location /autodiscover                  { proxy_pass https://$exchange_server/autodiscover; }
    location /Microsoft-Server-ActiveSync   { proxy_pass https://$exchange_server/Microsoft-Server-ActiveSync; }
    location /ecp                           { proxy_pass https://$exchange_server/ecp; }

    proxy_pass_request_headers on;
    proxy_pass_header Date;
    proxy_pass_header Server;

    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto https;
    more_set_input_headers 'Authorization: $http_authorization';
    proxy_set_header Accept-Encoding "";
    more_set_headers -s 401 'WWW-Authenticate: Basic realm="$mail.domain.tld"';

    proxy_read_timeout 3600;

    proxy_buffer_size 128k;
    proxy_buffers 4 256k;
    proxy_busy_buffers_size 256k;

    access_log /var/log/nginx/$mail.domain.tld-access.log;
    error_log /var/log/nginx/$mail.domain.tld-error.log;

}

any suggestions?? Thanks in advance

[EffKay-muc]

I found a very similar file in the container under /data/nginx/proxy_host/number.conf

But I found no way, to edit that file with nano in the container (used the consol in portainer)

The "funny" part is, the EWS access worked for me until I updated NPM

[EffKay-muc]

In fact, it works with 2.9.2

[stanthewizzard]

Not an answer to your question but in my case
haproxy for exchange and remote desktop
everything else goes to NPM
If you found a solution to make it work with NPM. I'm interested

[PrieserMax]

How did you setup haproxy and Nginx Proxy Manager?
From external it is only possible to forward the ports to one host. So how did you open 80/443? Do you have multiple WAN IPs?
Freetings
Max

[chjud]

I would love to know the same as Max. Is the Haproxy first or the NPM first, could you share your config?

[Chrishan68]

Hi
I have the same problem. Everything is working except my Outlook client. During profile setup it is asking for credentials again and again and then it stops. I need to cancel setup.
In custom locations I setup every folder, but I think I need to add something to Advanced - Custom Nginx Configuration. But what? Is there any explanation what I can add?

I tried

upstream mail {
server 192.168.168.168:443;
ntlm;
sticky learn create=$remote_addr lookup=$remote_addr
zone=client_sessions:10m timeout=3h;
}

but this takes my host offline

[g-karpov]

You need this https://github.com/gabihodoroaga/nginx-ntlm-module

[gyd1]

@jmccreary
Is this your complete configuration of using nginx as a reverse proxy for Microsoft Exchange Server 2019?

[GhostS13]

Hello,

Somebody solve this problem? I tried to solve it but nothing. I use NPM in docker on proxmox

[fargotto481]

Да. Включи Basic Authentication для API, EWS, MAPI, OAB в IIS и в виртуальных каталогах ECP в веб-морде.

Единственный минус - у тебя не будет снаружи работать NTLM, но это не существенный недостаток

[fargotto481]

Всё работает. Но NTLM работать не будет на 7 уровне OSI reverse proxy

[Du-lumos]

Hello, have you solved this problem? I have reverse proxy for Exchange, but some users always report that their Outlook will pop up a window asking them to enter a password. The problem is fixed every time they restart Outlook.I referenced the ntlm module for nginx: gabihodoroaga‘s nginx-ntlm-module

[Lukinno713]

Im using clear NGINX compiled by myself. I was moving from apache2 reverse proxy to nginx reverse proxy, so I was solving this issue as well.

As of now, I have confirmed by myself that configuration above provided by our fellow colleague is working perfectly.

I have used this options for nginx compilation (System is Ubuntu 22.04, nginx is being compiled from version 1.27.3.):

./configure
--prefix=/etc/nginx
--sbin-path=/usr/sbin/nginx
--modules-path=/usr/lib/nginx/modules
--conf-path=/etc/nginx/nginx.conf
--error-log-path=/var/log/nginx/error.log
--http-log-path=/var/log/nginx/access.log
--pid-path=/var/run/nginx.pid
--lock-path=/var/run/nginx.lock
--http-client-body-temp-path=/var/cache/nginx/client_temp
--http-proxy-temp-path=/var/cache/nginx/proxy_temp
--http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp
--http-scgi-temp-path=/var/cache/nginx/scgi_temp
--http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp
--user=nginx
--group=nginx
--with-compat
--with-debug
--with-file-aio
--with-threads
--with-pcre
--with-pcre-jit
--with-libatomic
--with-http_ssl_module
--with-http_v2_module
--with-http_v3_module
--with-http_realip_module
--with-http_stub_status_module
--with-http_gzip_static_module
--with-http_gunzip_module
--with-http_auth_request_module
--with-http_random_index_module
--with-http_secure_link_module
--with-http_degradation_module
--with-http_slice_module
--with-http_dav_module
--with-http_flv_module
--with-http_mp4_module
--with-http_addition_module
--with-http_sub_module
--with-http_image_filter_module=dynamic
--with-http_geoip_module=dynamic
--with-http_xslt_module=dynamic
--with-stream
--with-stream_ssl_module
--with-stream_ssl_preread_module
--with-stream_realip_module
--with-stream_geoip_module=dynamic
--with-openssl=/tmp/quictls
--with-openssl-opt="enable-tls1_3"
--with-cc-opt="-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC"
--with-ld-opt="-Wl,-Bsymbolic-functions -Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie"
--add-module=/tmp/nginx-ntlm-module
--add-module=/tmp/headers-more-nginx-module

For exchange on prem to work behind nginx reverse proxy, u must compile nginx with NTLM module ( --add-module=/tmp/nginx-ntlm-module ) and headers more module (--add-module=/tmp/headers-more-nginx-module) - headers more is required because of configuration colleague provided to us. By some tweaking with the configuration file, it might not be required, but if u want to just copy and go, this module is required.

[GhostS13]

Im using clear NGINX compiled by myself. I was moving from apache2 reverse proxy to nginx reverse proxy, so I was solving this issue as well.

As of now, I have confirmed by myself that configuration above provided by our fellow colleague is working perfectly.

I have used this options for nginx compilation (System is Ubuntu 22.04, nginx is being compiled from version 1.27.3.):

./configure --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --user=nginx --group=nginx --with-compat --with-debug --with-file-aio --with-threads --with-pcre --with-pcre-jit --with-libatomic --with-http_ssl_module --with-http_v2_module --with-http_v3_module --with-http_realip_module --with-http_stub_status_module --with-http_gzip_static_module --with-http_gunzip_module --with-http_auth_request_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_addition_module --with-http_sub_module --with-http_image_filter_module=dynamic --with-http_geoip_module=dynamic --with-http_xslt_module=dynamic --with-stream --with-stream_ssl_module --with-stream_ssl_preread_module --with-stream_realip_module --with-stream_geoip_module=dynamic --with-openssl=/tmp/quictls --with-openssl-opt="enable-tls1_3" --with-cc-opt="-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC" --with-ld-opt="-Wl,-Bsymbolic-functions -Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie" --add-module=/tmp/nginx-ntlm-module --add-module=/tmp/headers-more-nginx-module

For exchange on prem to work behind nginx reverse proxy, u must compile nginx with NTLM module ( --add-module=/tmp/nginx-ntlm-module ) and headers more module (--add-module=/tmp/headers-more-nginx-module) - headers more is required because of configuration colleague provided to us. By some tweaking with the configuration file, it might not be required, but if u want to just copy and go, this module is required.

Aha, This is the reason. I'm using Nginx Proxy Manager. Maybe you have clear VM with NGINX and NTLM and you share with me. Because i tried to make my own clear NGINX but I haven't enough knowledge for it. Maybe you have good manual. Any help will be great for me.

[Du-lumos]

Sorry, I've been so busy lately that I've been stuck on that question.

Compiling nginx is simple. You can refer to online resources or chatgpt. The ./configure method provided by the friend above is very comprehensive. After compiling nginx, start nginx and configure my configuration.

[Du-lumos]

我使用的是我自己编译的清晰的 NGINX。我正在从 apache2 反向代理迁移到 nginx 反向代理，所以我也在解决这个问题。

截至目前，我已经亲自确认，我们的同事提供的上述配置工作正常。

我已使用此选项进行 nginx 编译（系统是 Ubuntu 22.04，nginx 是从 1.27.3 版编译的）。

./configure --prefix=/etc/nginx --sbin-path=/usr/sbin/nginx --modules-path=/usr/lib/nginx/modules --conf-path=/etc/nginx/nginx.conf --error-log-path=/var/log/nginx/error.log --http-log-path=/var/log/nginx/access.log --pid-path=/var/run/nginx.pid --lock-path=/var/run/nginx.lock --http-client-body-temp-path=/var/cache/nginx/client_temp --http-proxy-temp-path=/var/cache/nginx/proxy_temp --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp --http-scgi-temp-path=/var/cache/nginx/scgi_temp --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp --user=nginx --group=nginx --with-compat --with-debug --with-file-aio --with-threads --with-pcre --with-pcre-jit --with-libatomic --with-http_ssl_module --with-http_v2_module --with-http_v3_module --with-http_realip_module --with-http_stub_status_module --with-http_gzip_static_module --with-http_gunzip_module --with-http_auth_request_module --with-http_random_index_module --with-http_secure_link_module --with-http_degradation_module --with-http_slice_module --with-http_dav_module --with-http_flv_module --with-http_mp4_module --with-http_addition_module --with-http_sub_module --with-http_image_filter_module=dynamic --with-http_geoip_module=dynamic --with-http_xslt_module=dynamic --with-stream --with-stream_ssl_module --with-stream_ssl_preread_module --with-stream_realip_module --with-stream_geoip_module=dynamic --with-openssl=/tmp/quictls --with-openssl-opt=“enable-tls1_3” --with-cc-opt=“-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wp，-D_FORTIFY_SOURCE=2 -fPIC” --with-ld-opt=“-Wl，-Bsymbolic-functions -Wl，-z，relro -Wl，-z，now -Wl,--as-needed -pie” --add-module=/tmp/nginx-ntlm-module --add-module=/tmp/headers-more-nginx-module

为了使本地交换在 nginx 反向代理后面工作，您必须使用 NTLM 模块 （ --add-module=/tmp/nginx-ntlm-module ） 和 headers more 模块 （--add-module=/tmp/headers-more-nginx-module） 编译 nginx - 由于配置同事提供了给我们，因此需要 headers more。通过对配置文件进行一些调整，可能不需要它，但如果您只想复制并移动，则需要此模块。

Hi, I'm using Nginx as a reverse proxy for Exchange, and I've confirmed that there's a problem with the NTLM module. It can cause Nginx to crash under high concurrency conditions. I've located the issue, but I haven't been able to resolve it yet, and I'm still working on refining the code.

[GhostS13]

Thanks a lot for your help and information. I will definitely try to install and create a virtual machine with NGINX now. If you have time and opportunity to make a ready virtual machine with installed module for exchange as an example, I will be very grateful to you.

[Lukinno713]

Here you have step by step guide how to compile nginx with NTLM + headers more + HTTP/3 QUIC moduls. As said before, I confirmed that this currently works, some issues might arise as our colleague commented. This guide is working on Ubuntu 22.04.

# Switch to root user
sudo su

# Update & upgrade packages
sudo apt update && sudo apt upgrade -y

# Create nginx system user (for security)
sudo adduser --system --no-create-home --shell /bin/false --group --disabled-login nginx

# Install build dependencies
sudo apt install build-essential libpcre3-dev libssl-dev zlib1g-dev libgd-dev \
  libgeoip-dev libxslt-dev cmake git wget curl gnupg libatomic-ops-dev \
  libxml2-dev libxslt1-dev libgd-dev libgeoip-dev -y

# Prepare working directory
cd /tmp

# Clone QUIC TLS OpenSSL repo
git clone https://github.com/quictls/openssl.git quictls
cd quictls

# Configure and build OpenSSL (TLS 1.3)
./Configure --prefix=/opt/quictls \
    --openssldir=/etc/ssl \
    --libdir=lib \
    enable-tls1_3 \
    shared \
    no-ssl3 \
    no-weak-ssl-ciphers

make -j$(nproc)
sudo make install

# Register new OpenSSL library
echo '/opt/quictls/lib' | sudo tee /etc/ld.so.conf.d/quictls.conf
sudo ldconfig

# Download latest nginx source
cd /tmp
wget https://nginx.org/download/nginx-1.27.3.tar.gz
tar -xzf nginx-1.27.3.tar.gz

# Clone modules for NTLM and "Headers More"
git clone https://github.com/gabihodoroaga/nginx-ntlm-module.git
git clone https://github.com/openresty/headers-more-nginx-module.git

# Configure nginx with all required modules and custom OpenSSL
cd nginx-1.27.3
./configure \
  --prefix=/etc/nginx \
  --sbin-path=/usr/sbin/nginx \
  --modules-path=/usr/lib/nginx/modules \
  --conf-path=/etc/nginx/nginx.conf \
  --error-log-path=/var/log/nginx/error.log \
  --http-log-path=/var/log/nginx/access.log \
  --pid-path=/var/run/nginx.pid \
  --lock-path=/var/run/nginx.lock \
  --http-client-body-temp-path=/var/cache/nginx/client_temp \
  --http-proxy-temp-path=/var/cache/nginx/proxy_temp \
  --http-fastcgi-temp-path=/var/cache/nginx/fastcgi_temp \
  --http-scgi-temp-path=/var/cache/nginx/scgi_temp \
  --http-uwsgi-temp-path=/var/cache/nginx/uwsgi_temp \
  --user=nginx \
  --group=nginx \
  --with-compat \
  --with-debug \
  --with-file-aio \
  --with-threads \
  --with-pcre \
  --with-pcre-jit \
  --with-libatomic \
  --with-http_ssl_module \
  --with-http_v2_module \
  --with-http_v3_module \
  --with-http_realip_module \
  --with-http_stub_status_module \
  --with-http_gzip_static_module \
  --with-http_gunzip_module \
  --with-http_auth_request_module \
  --with-http_random_index_module \
  --with-http_secure_link_module \
  --with-http_degradation_module \
  --with-http_slice_module \
  --with-http_dav_module \
  --with-http_flv_module \
  --with-http_mp4_module \
  --with-http_addition_module \
  --with-http_sub_module \
  --with-http_image_filter_module=dynamic \
  --with-http_geoip_module=dynamic \
  --with-http_xslt_module=dynamic \
  --with-stream \
  --with-stream_ssl_module \
  --with-stream_ssl_preread_module \
  --with-stream_realip_module \
  --with-stream_geoip_module=dynamic \
  --with-openssl=/tmp/quictls \
  --with-openssl-opt="enable-tls1_3" \
  --with-cc-opt="-g -O2 -fstack-protector-strong -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -fPIC" \
  --with-ld-opt="-Wl,-Bsymbolic-functions -Wl,-z,relro -Wl,-z,now -Wl,--as-needed -pie" \
  --add-module=/tmp/nginx-ntlm-module \
  --add-module=/tmp/headers-more-nginx-module

make -j$(nproc)
sudo make install

# Create required directories for cache, logs, web root
sudo mkdir -p /var/cache/nginx/{client_temp,proxy_temp,fastcgi_temp,scgi_temp,uwsgi_temp}
sudo mkdir -p /var/log/nginx
sudo mkdir -p /var/www/html
sudo mkdir -p /etc/nginx/{sites-available,sites-enabled,conf.d}

# Set permissions
sudo chown -R nginx:nginx /var/cache/nginx
sudo chown -R nginx:nginx /var/log/nginx
sudo chown -R nginx:nginx /var/www/html

# Create nginx systemd service unit
sudo tee /etc/systemd/system/nginx.service > /dev/null << 'EOF'
[Unit]
Description=The NGINX HTTP and reverse proxy server
Documentation=http://nginx.org/en/docs/
After=network-online.target remote-fs.target nss-lookup.target
Wants=network-online.target

[Service]
Type=forking
PIDFile=/var/run/nginx.pid
ExecStartPre=/usr/sbin/nginx -t
ExecStart=/usr/sbin/nginx
ExecReload=/usr/sbin/nginx -s reload
ExecStop=/bin/kill -s QUIT $MAINPID
TimeoutStopSec=5
KillMode=mixed
PrivateTmp=true

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl daemon-reload
sudo systemctl enable nginx

You have now succesfully compiled nginx with NTLM, headers more and HTTP/3 QUIC modules.

Now, lets create nginx basic config - /etc/nginx/nginx.conf:

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log warn;
pid /var/run/nginx.pid;

events {
    worker_connections 1024;
    use epoll;
    multi_accept on;
}

http {
    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                   '$status $body_bytes_sent "$http_referer" '
                   '"$http_user_agent" "$http_x_forwarded_for"';

    access_log /var/log/nginx/access.log main;
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    server_tokens off;

    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    # SSL Settings
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;

    # Gzip Settings
    gzip on;
    gzip_vary on;
    gzip_proxied any;
    gzip_comp_level 6;
    gzip_types
        text/plain
        text/css
        text/xml
        text/javascript
        application/json
        application/javascript
        application/xml+rss
        application/atom+xml
        image/svg+xml;

    include /etc/nginx/conf.d/*.conf;
    include /etc/nginx/sites-enabled/*;

    # Default server
    server {
        listen 80 default_server;
        listen [::]:80 default_server;
        server_name _;
        root /var/www/html;
        index index.html index.htm;

        location / {
            try_files $uri $uri/ =404;
        }

        location ~ /\.ht {
            deny all;
        }
    }
}

For our exchange reverse proxy, we need to add this part into nginx.conf (Add this into http part of nginx.conf}:

upstream exchange_backend_ntlm {
    ip_hash;
    server YOUR_EXCHANGE_SERVER_IP:443;
    keepalive 256;
    keepalive_timeout 3h;
    ntlm_timeout 300000;
    ntlm 300000;
}

upstream exchange_backend {
    ip_hash;
    server YOUR_EXCHANGE_SERVER_IP:443;
    keepalive 128;
    keepalive_timeout 10000s;
}

map $host $exchange_server {
    default mail.YOURDOMAIN.com;
}

upstream auth_backend {
    ip_hash;
    server YOUR_EXCHANGE_SERVER_IP:9090 max_fails=3 fail_timeout=10s;
}

And there goes final exchange server reverse proxy virtualhost configuration file, add this into /etc/nginx/sites-enabled/vhost_name:

server {
listen       443 ssl;
listen       443 quic;
server_name mail.yourdomain.com autodiscover.yourdomain.com;
ssl_session_cache shared:SSL:1m;
ssl_certificate /etc/nginx/certificates/quic.cert;
ssl_certificate_key /etc/nginx/certificates/quic.key;
ssl_session_timeout 5m;

ssl_early_data on;
add_header Alt-Svc 'h3=":443"; ma=7200'; # Pro HTTP/3 klienty;

proxy_connect_timeout 20s;
large_client_header_buffers 32 64k;
client_body_buffer_size 50M;
proxy_buffer_size 64k;
proxy_buffers  32 64k;
proxy_busy_buffers_size 1024k;
proxy_temp_file_write_size 2048k;


fastcgi_buffer_size 122880;
fastcgi_buffers 4 81920;
fastcgi_busy_buffers_size 163840;

proxy_request_buffering off;
tcp_nodelay on;
client_max_body_size 3G;
proxy_read_timeout 3h;
proxy_send_timeout 3h;
proxy_pass_header Date;
proxy_pass_header Server;
proxy_pass_header Authorization;

proxy_pass_request_headers on;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header Accept-Encoding "";
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Authorization $http_authorization;


proxy_set_header Connection "";
proxy_http_version 1.1;


location /ews/mrsproxy.svc {
        proxy_pass https://exchange_backend/ews/mrsproxy.svc;
        more_set_input_headers 'Authorization: $http_authorization';
        more_set_headers -s 401 'WWW-Authenticate: Basic realm="$exchange_server"';
    }

location = /auth {
        internal;
#        access_log logs/auth_request.log auth_request_log;
#        error_log logs/exchange-error.log debug;
        proxy_pass http://auth_backend/mp/service/exchange/auth$request_uri;

    proxy_connect_timeout 120s;
            proxy_send_timeout    80s;
            proxy_read_timeout    80s;
        proxy_set_header X-Cmd $arg_Cmd;
        proxy_set_header X-User $arg_User;
        proxy_set_header X-DeviceId $arg_DeviceId;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Original-URI $request_uri;
        proxy_set_header X-Original-Host $host;
    }

location /owa/auth/logon.aspx {
        proxy_pass https://exchange_backend/owa/auth/logon.aspx;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        more_set_input_headers 'Authorization: $http_authorization';
        more_set_headers -s 401 'WWW-Authenticate: Basic realm="$exchange_server"';
    }

location / {
    return 301 https://mail.yourdomain.com/owa;
}

location /owa {
    proxy_pass https://exchange_backend/owa;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        more_set_input_headers 'Authorization: $http_authorization';
        more_set_headers -s 401 'WWW-Authenticate: Basic realm="$exchange_server"';
}


location /Microsoft-Server-ActiveSync {
        auth_request /auth;
        auth_request_set $arg_Cmd $arg_Cmd;
        auth_request_set $arg_User $arg_User;
        auth_request_set $arg_DeviceId $arg_DeviceId;
        auth_request_set $auth_status $upstream_status;

    proxy_pass https://exchange_backend/Microsoft-Server-ActiveSync;
        proxy_connect_timeout 300s;
    proxy_read_timeout 300s;
    proxy_send_timeout 120s;
    proxy_buffer_size 64k;
    proxy_temp_file_write_size 256k;
    proxy_http_version 1.1;
    proxy_set_header Connection "";

    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header Accept-Encoding "";
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    #more_set_input_headers 'Authorization: $http_authorization';
        #more_set_headers -s 401 'WWW-Authenticate: Basic realm="$exchange_server"';
    }


location /Autodiscover {
        #auth_request /auth;
        #auth_request_set $auth_status $upstream_status;
    proxy_pass https://exchange_backend_ntlm;
    #proxy_set_header Connection "Keep-Alive";
    #proxy_set_header Accept-Encoding "";
    #more_set_input_headers 'Authorization: $http_authorization';
    #more_set_headers -s 401 'WWW-Authenticate: Basic realm="$exchange_server"';
    }

location /AutoDiscover {
        #auth_request /auth;
        #auth_request_set $auth_status $upstream_status;
        proxy_pass https://exchange_backend_ntlm;
    #proxy_set_header Connection "Keep-Alive";
    #proxy_set_header Accept-Encoding "";
    #more_set_input_headers 'Authorization: $http_authorization';
    #more_set_headers -s 401 'WWW-Authenticate: Basic realm="$exchange_server"';


        }

location /autodiscover {
        #auth_request /auth;
        #auth_request_set $auth_status $upstream_status;
    proxy_pass https://exchange_backend_ntlm;
    #proxy_set_header Connection "Keep-Alive";
    #proxy_set_header Accept-Encoding "";
    #more_set_input_headers 'Authorization: $http_authorization';
    #more_set_headers -s 401 'WWW-Authenticate: Basic realm="$exchange_server"';

}

location /mapi/nspi {
        #proxy_pass https://exchange_backend_ntlm;
        proxy_pass https://exchange_backend_ntlm;
        proxy_set_header  Host            $host;
        proxy_set_header  X-Real-IP       $remote_addr;
        proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_connect_timeout 300s;
        #proxy_read_timeout 120s;
    proxy_read_timeout 300s;
        proxy_send_timeout 300s;

    proxy_request_buffering off;
    #proxy_buffer_size 64k;
    #proxy_buffers 32 64k;
    #proxy_temp_file_write_size 1024k;
        keepalive_timeout 3h;

    proxy_http_version 1.1;
    proxy_set_header Connection "";
    #proxy_set_header Connection "Keep-Alive";

    #more_set_input_headers 'Authorization: $http_authorization';
    #proxy_set_header Accept-Encoding "";
    #more_set_headers -s 401 'WWW-Authenticate: Basic realm="$exchange_server"';
    }

location /mapi {
    auth_request /auth;
    auth_request_set $auth_status $upstream_status;
    proxy_pass https://exchange_backend_ntlm;
    #proxy_pass https://exchange_backend;
        proxy_set_header  Host            $host;
    proxy_set_header  X-Real-IP       $remote_addr;
    proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_connect_timeout 300s;
    #proxy_read_timeout 120s;
    proxy_read_timeout 300s;
    proxy_send_timeout 300s;
    #proxy_buffer_size 64k;
    #proxy_buffers 32 64k;
    #proxy_temp_file_write_size 1024k;
    keepalive_timeout 3h;
    proxy_request_buffering off;

    proxy_http_version 1.1;
    proxy_set_header Connection "";
    #more_set_input_headers 'Authorization: $http_authorization';
    #proxy_set_header Accept-Encoding "";
    #more_set_headers -s 401 'WWW-Authenticate: Basic realm="$exchange_server"';

}


location ~* ^/rpc {
    auth_request /auth;
    auth_request_set $auth_status $upstream_status;
    proxy_connect_timeout 600s;
    proxy_read_timeout 120s;
    proxy_send_timeout 120s;
    #proxy_buffer_size 68k;
    #proxy_buffer_size 4 64k;
    proxy_temp_file_write_size 256k;
    proxy_http_version 1.1;
    proxy_set_header connection "";
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header Accept-Encoding "";
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_pass https://exchange_backend_ntlm;
        }
location ~* ^/oab {
    proxy_pass https://exchange_backend_ntlm;
        #proxy_pass https://exchange_backend;
    #proxy_set_header Accept-Encoding "";
    #more_set_input_headers 'Authorization: $http_authorization';
    #more_set_headers -s 401 'WWW-Authenticate: Basic realm="$exchange_server"';

    }



location /ews {
        #auth_request /auth;
        #auth_request_set $auth_status $upstream_status;
    proxy_pass https://exchange_backend_ntlm;
    #proxy_pass https://exchange_backend;

    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header Accept-Encoding "";
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    proxy_connect_timeout 300s;
    proxy_read_timeout 300s;
    proxy_send_timeout 300s;
    #proxy_buffer_size 64k;
    #proxy_temp_file_write_size 256k;

    proxy_request_buffering off;
    proxy_http_version 1.1;
    proxy_set_header Connection "";
    #more_set_input_headers 'Authorization: $http_authorization';
    #more_set_headers -s 401 'WWW-Authenticate: Basic realm="$exchange_server"';

}

location /EWS {
        #auth_request /auth;
        #auth_request_set $auth_status $upstream_status;
    proxy_pass https://exchange_backend_ntlm;
    #proxy_pass https://exchange_backend;
        proxy_set_header  Host            $host;
        proxy_set_header  X-Real-IP       $remote_addr;
        proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_connect_timeout 300s;
    proxy_read_timeout 300s;
    proxy_send_timeout 300s;
    proxy_buffer_size 64k;
    proxy_temp_file_write_size 256k;

    proxy_request_buffering off;
    proxy_http_version 1.1;
    proxy_set_header Connection "";
    #more_set_input_headers 'Authorization: $http_authorization';
    #proxy_set_header Accept-Encoding "";
    #more_set_headers -s 401 'WWW-Authenticate: Basic realm="$exchange_server"';

}

proxy_ssl_verify off;

#error_log /var/log/nginx/exchange-error.log;
#access_log /var/log/nginx/exchange-access.log auth_log;


}

Please note 1 thing:

at the beginning of server config for exchange revese proxy, there is "listen 443 quic;", if this is your first virtual host, it must be "listen 443 quic reuseport;" otherwise it will be failing for you. Just google it or remove line "listen 443 quic" if you dont know anything about QUIC and dont want to use it. I recommend to google it, as QUIC gives u a lot of benefits.

Now simply restart nginx and your exchange have to work behind this reverse proxy.

As u have noticed, I have added also HTTP/3 QUIC module, its newest, fastest protocol of HTTP utilizing UDP. When accessing web parts of exchange, like OWA, u might notice better resposivnes, better loading times, etc.. This wont be a thing when you will access exchange via outlook, as outlook utilize only TLSv1.2 with HTTP/1.1.

[GhostS13]

Big Big Big Thanks for you really helps me. I really appreciate it. Big respect. I will try to do it now