Recommended Posts

Hello,

 

I've been asked to help set up a server with an external IP address so that users in another location can access it. I'm not entirely sure how to go about this. I've been given the external IP address that their Internet provider supplied. Should I install another switch before the internal network switch in order to have the server on the "outside". I've not done much router configuration and am not sure if there is a way to route these users to this server if it is behind their current router. Since it would have a different address would this even be possible? Any advice would be greatly appreciated.

Link to comment
https://www.neowin.net/forum/topic/1220903-server-with-an-external-ip/
Share on other sites

Normally, you should assign the static IP to the router/firewall and use port forwarding for the services the external users need.

 

You can assign the IP directly to the server and then put the server in the router's DMZ as well.

 

Or like you said, deploy a switch and then assign the statics to the router and server. This will basically completely separate the two networks, but leaves the server fully out 'in the wild'.

keep in mind exposing a server that is on your network to the public internet for inbound traffic is risk. Normally servers that allow inbound traffic from the internet would be in a dmz (isolated from your normal network) Where there would be a firewall between this dmz and the local network.

You could mitigate risk by only allowing the IP address from this remote location to talk to your server.

What exactly are they going to access on this server? Http, ftp, what?

A switch would not isolate anything to be honest, what hardware are you working with? What is your router that connects you to the internet?

What type of server is this?  Is this a web server?  Is this a file server?  If it is a file server you are better off setting up a vpn for access as it could open up a can of worms that you would not want open to the outside world.  If you have a corporate firewall you can make specific rules as to what outside IPs have access to this, but it still is highly not recommended to do so. 

This will be just a standard server running Server 2012 Essentials. They have a program that they want everyone to be able to get to. Basically this program is a medical type scheduling program. They enter notes about patients into the database. I'm guessing the setup I originally suggested is definitely not the way to go. They have cable for internet service and just a small cisco router connected to that for the local network. I wasn't sure if I could utilize the external IP address within the local network and have the router access it some way? Thanks for all of the input!

This will be just a standard server running Server 2012 Essentials. They have a program that they want everyone to be able to get to. Basically this program is a medical type scheduling program. They enter notes about patients into the database. I'm guessing the setup I originally suggested is definitely not the way to go. They have cable for internet service and just a small cisco router connected to that for the local network. I wasn't sure if I could utilize the external IP address within the local network and have the router access it some way? Thanks for all of the input!

Then you would have to open port 3389 and forward that port to the hosting server.. Which is horrible to expose to the internet. I would just keep the server local, and add a VPN, then they can use remote desktop to access the app..  What model is the Cisco Router? Also, does your company use any Citrix or VMware? There might be a better and safer way to do this.. 

You can do the same as citrix with a microsoft server with remote app (there are licensing fees on top of the microsoft server license to enable this).  This will allow you to publish the app on a website through secure ports, similar to citrix xenapp server.  the citrix protocol is nicer and has more features and has an associated cost with these nicer and more features option on top of a windows server, which you need the license mentioned before on top of the citrix licensing to be properly licensed and working...unless in recent years they have changed their license model.

Hello,

 

I've been asked to help set up a server with an external IP address so that users in another location can access it. I'm not entirely sure how to go about this. I've been given the external IP address that their Internet provider supplied. Should I install another switch before the internal network switch in order to have the server on the "outside". I've not done much router configuration and am not sure if there is a way to route these users to this server if it is behind their current router. Since it would have a different address would this even be possible? Any advice would be greatly appreciated.

Any updates on this? I was actually curious to see where this was going?

This will be just a standard server running Server 2012 Essentials. They have a program that they want everyone to be able to get to. Basically this program is a medical type scheduling program. They enter notes about patients into the database. I'm guessing the setup I originally suggested is definitely not the way to go. They have cable for internet service and just a small cisco router connected to that for the local network. I wasn't sure if I could utilize the external IP address within the local network and have the router access it some way? Thanks for all of the input!

Is there a free interface on the small router? Or if not, you could make an argument to buy a cheap one. Plug it in there and depending if there's any protocol running on the links between offices/ISP then you can advertise the server out of it.

 

Always stay simple. Depending on how much the router is utilised, adding port-forwarding or DMZ's through NAT can add quite a lot of load on those small things.   

I'm thinking a VPN will be the way to go. Thanks for all of your input! Setting up the VPN would the server have an internal IP address and then just forward the correct ports to that address?

Personally, I don't think its the right way to go. It's over complicating something thats simple. Even putting it on a DMZ would be better than a VPN.

I'm thinking a VPN will be the way to go. Thanks for all of your input! Setting up the VPN would the server have an internal IP address and then just forward the correct ports to that address?

Yes.  No need to open ports being that the network or computers are trusted on the network level, as if they were on site. 

Personally, I don't think its the right way to go. It's over complicating something thats simple. Even putting it on a DMZ would be better than a VPN.

Please explain to me how putting a file server in a DMZ would be "better" than a VPN.  The whole security thing becomes an issue, esp if the other site has a dynamic address or if the existing site has a basic router that has no way to create access control lists.  There is more headache and capable of a large security breech by putting a server with extremely sensitive data directly on the internet, how are you securing said server?  How are you protecting the data or contents of the server?  This isn't a remote access or citrix server, it is a file server/db server that would have direct access from the internet with no safety measures in place. He wants to share an application on that server that has access to medical records and such.  putting that server in a dmz and giving direct access would be a large security no no.  If anything vpn, then remote desktop to it.  VPN in many cases is secured by a few things, not only your user and password but also a PSK or a certificate that could be private for more security which you would have to manually install.  I wouldn't want my records running across a server that is insecure. 

Yes.  No need to open ports being that the network or computers are trusted on the network level, as if they were on site. 

But adding plenty of overhead on packets and load onto the box is the way to go?

Please explain to me how putting a file server in a DMZ would be "better" than a VPN.  The whole security thing becomes an issue, esp if the other site has a dynamic address or if the existing site has a basic router that has no way to create access control lists.  There is more headache and capable of a large security breech by putting a server with extremely sensitive data directly on the internet, how are you securing said server?  How are you protecting the data or contents of the server?  This isn't a remote access or citrix server, it is a file server/db server that would have direct access from the internet with no safety measures in place. 

Plug it directly into the router, only allow traffic in-bound on the port in question through IP Tables with stateful firewalling if security is that much of a concern. In addition, only allow the company IP address ranges. Simples. 

IPs can't be spoofed easily.  Oh wait they are easy to trick.

 

limits of stateful packet inspection

http://linux-ip.net/html/pf-shortcomings.html

 

ip spoofing

https://sandilands.info/sgordon/address-spoofing-with-iptables-in-linux

 

Best thing to do would be to not open yourself up to attack and secure it with other more secure means.

IPs can't be spoofed easily.  Oh wait they are easy to trick.

 

limits of stateful packet inspection

http://linux-ip.net/html/pf-shortcomings.html

 

ip spoofing

https://sandilands.info/sgordon/address-spoofing-with-iptables-in-linux

 

Best thing to do would be to not open yourself up to attack and secure it with other more secure means.

Anyone can pull up a URL with some blabber about spoofing with security worries.

 

If there's multiple offices running over a Layer 3 VPN link as part of their office WAN, enjoy trying to spoof a 10.0.0.0 from over the internet. If it's in their requirements to have external public access from outside their offices, only allowing the traffic on that port will stop any worry. Any security issues past there lie with the software and rather the network implementation.

10.0.0.0 is a private address and secured with a vpn, yea that isn't exactly putting the server in a dmz and giving them direct access through outside internet connection via an outside IP now is it?

 

My recommendation was to put in behind a vpn, you said to put it in a dmz and give direct access to it.  what you have just wrote is just confirming what I said in the first place, nothing to do with putting the server in a dmz and giving direct access to that server through the internet without any further security measures.

10.0.0.0 is a private address and secured with a vpn, yea that isn't exactly putting the server in a dmz and giving them direct access through outside internet connection via an outside IP now is it?

 

My recommendation was to put in behind a vpn, you said to put it in a dmz and give direct access to it.  what you have just wrote is just confirming what I said in the first place, nothing to do with putting the server in a dmz and giving direct access to that server through the internet without any further security measures.

There's no issue with having a DMZ which only accepts traffic on that one port. VPN is over complicating something and putting extra load on the network for something which simply doesn't need to be there. 

I would never ever put a server on the net with direct file access...I have been burned too many times, you can think you are protected all you want....until the day you get burned, cost your company a ton of money, or better yet jail time. 

 

What is the best way to secure it so that you 1. don't lose your job, 2. don't lose the company money, 3. don't go to jail.  If any of these sound great to you, by all means put it out there with no other security than a dmz and a access rule...walls haven't been broken before and they won't now right? 

 

If anything I would employ a system that also could do IPS in addition to SPI in your scenario.  I would seriously be considering Xenapp or Remote App with your scenerio...I'd be damned if I give a user direct access to a server.

I would never ever put a server on the net with direct file access...I have been burned too many times, you can think you are protected all you want....until the day you get burned, cost your company a ton of money, or better yet jail time. 

 

What is the best way to secure it so that you 1. don't lose your job, 2. don't lose the company money, 3. don't go to jail.  If any of these sound great to you, by all means put it out there with no other security than a dmz and a access rule...walls haven't been broken before and they won't now right? 

 

If anything I would employ a system that also could do IPS in addition to SPI in your scenario.  I would seriously be considering Xenapp or Remote App with your scenerio...I'd be damned if I give a user direct access to a server.

I work for an ISP in the UK and was responsible for the testing environments which replicated and scrubbed over 700GB of live databases. I face these scenarios a lot day to day. I recently did a night shift to re-work all our encryption techniques and VPNs based on the security audit of 3rd party contractors.

 

In the OPs scenario, he has a small cisco router with unspecified amount of traffic flowing through it. If the server is accessed a lot, the VPN aspect of it could really add a lot of load onto the box and with the aspect of the VPN, it'll add a lot of overhead with added latency. With the details he specified I'd definitely recommend either plugging it in directly to the router with IP table restrictions or a DMZ which only forwards on one port. With that, you can restrict on to one listening port. If there's any flaw in the software which grants access into the server then the software needs to be looked at. That could happen on a VPN with intent, and of course it can happen with a public facing server. Without the VPN, it's less hassle, less load and easier for the users internally to access the server.

 

Don't want to argue about this, I just personally feel like its the best solution. There's obviously a lot of variables which could change that though.

There's no issue with having a DMZ which only accepts traffic on that one port. VPN is over complicating something and putting extra load on the network for something which simply doesn't need to be there. 

 

Seriously??? And your publishing what data? lol  :laugh:

This topic is now closed to further replies.
  • Posts

    • Google Pixel 11 series: Here's what to expect by Hamid Ganji Google Pixel 10 series In recent years, Google has successfully turned its Pixel devices into worthy contenders in the smartphone market. The search giant is now preparing to launch the Pixel 11 series in just a few months, and many Pixel fans are likely wondering what Google has in store for them this year. The next lineup of Google smartphones includes four devices: the Pixel 11, Pixel 11 Pro, Pixel 11 Pro XL, and Pixel 11 Pro Fold. This year, we don’t expect Google to bring revolutionary upgrades to its handsets, and the Pixel 11 series is likely to receive modest hardware improvements alongside a slew of AI-powered features. Here are the rumored specifications of the Google Pixel 11 series ahead of its official debut: When will the new Pixel phones be unveiled? The last two generations of Google Pixel phones (Pixel 9 series and Pixel 10 series) were launched in August, unlike the previous three generations that debuted in October. With that in mind, we expect Google to unveil the Pixel 11 series sometime in August 2026. The exact launch date has yet to be confirmed. Google Pixel 11 CAD renders - Image via AndroidHeadlines How much will the Pixel 11 series cost? Predicting the final price of upcoming smartphones has become increasingly difficult. As you may know, RAM and memory prices are rising sharply, leading to significant increases in the cost of consumer electronics. Recently, Apple CEO Tim Cook said that price increases for some future Apple products are unavoidable, suggesting that the iPhone 18 series could become more expensive. Google has remained tight-lipped about any potential price increases for the Pixel 11 series. If the company manages to maintain last year’s pricing structure, here’s what the lineup could cost: Pixel 11: $799 Pixel 11 Pro: $999 Pixel 11 Pro XL: $1,199 Pixel 11 Pro Fold: $1,799 Given current market conditions, it may be difficult for Google to avoid raising prices unless it adopts cost-saving measures, such as equipping the base model with 8GB of RAM. Google Pixel 11 series anticipated specs: We expect the Google Pixel 11 series to debut with a new Tensor G6 processor as well as an upgraded camera system. The overall design, however, is expected to remain largely unchanged across the lineup. Specifications Pixel 11 Pixel 11 Pro Pixel 11 Pro XL Pixel 11 Pro Fold Display 6.3-inch LTPO AMOLED / 120Hz refresh rate / up to 3100 nits of brightness 6.3-inch Super Actua LTPO OLED, 120Hz refresh rate, up to 3600 nits of brightness 6.8-inch Super Actua LTPO OLED, 120Hz refresh rate, up to 3600 nits of brightness 8-inch inner screen and 6.4-inch outer display, 120Hz refresh rate, up to 3600 nits of brightness RAM & Processor Tensor G6 / 8-12GB of RAM Tensor G6 / 12-16GB of RAM Tensor G6 / 12-16GB of RAM Tensor G6 / 16GB of RAM Storage options 128GB or 256GB 256GB, 512GB, 1TB 256GB, 512GB, 1TB 256GB, 512GB, 1TB Camera 50MP main sensor, 13MP ultra-wide, 10.8MP 5x telephoto, 10.5MP front camera 50MP main camera, 48MP ultra-wide, 48MP telephoto with 5x optical zoom, 42MP selfie camera 50MP main camera, 48MP ultra-wide, 48MP telephoto with 5x optical zoom, 42MP selfie camera 50MP main camera, 10.5MP ultra-wide camera, 10.8MP telephoto camera, 10MP front camera, 10MP inner camera Battery 4,840 mAh 4,707 mAh 5,000 mAh 4,658 mAh Software Android 17 Android 17 Android 17 Android 17 The Pixel 11 series won’t be a major departure from its predecessor, with Google instead focusing on subtle improvements and AI additions such as Gemini Intelligence. However, a patent filed by Google suggests the company is working on a removable battery for its smartphones, and we could see this feature make its way to the Pixel 11 Pro Fold. Given that nearly all smartphones today lack removable batteries, such a feature would be a welcome addition to future Pixel devices. That said, it may not arrive with this year’s lineup after all, and the final decision is yet to be made by Google. The Pixel 11 series could also face an uphill battle in the market. In the Android segment, Samsung is performing well with the Galaxy S26 series, while the Galaxy Z Fold 8 lineup is also expected to launch next month. On the other hand, Apple is preparing to unveil the iPhone 18 Pro and iPhone 18 Pro Max in September alongside its first foldable iPhone.
    • At least AMD is still taking Windows 10 seriously (after the oops) before it consumer extended support ends. @WaltC - Memories, 2x Voodoo in SLI with a Riva TNT with an Aureal A3D soundcard.
    • So size is the ONLY selling point????? People have been plugging in PC's to TV's in living rooms for 20+ years. I would take a bigger box for more peformance. Also lot and lots of SFF/Mini ITX build guides out there.
    • My point is, if you buying this instead of a console for TV purposes, that you need to understand that you will not be able to play the most popular MP games with Steam OS. Now if you are not into those games, and into some of the perputual alpha/beta games on Steam then this is an option. I would argue a gaming PC would be the better route, more expensive but take the 1k -1.4k you are about to spend on this thing and build a better one. Because it is running Linux you can overide its 1080p settings. However The Verge complained about its 1080p cap and how you would have to get around it at the CLI, so someone buying this instead of a PS5 or Xbox might have a challege on their hands.
    • A review of Synology's BeeCamera software for the BeeStation Plus by Christopher White Synology is leaning into the BeeStation and the BeeStation Plus, and it's easy to understand why. While power users will want something more customizable, the BeeStation and its more powerful sibling, the BeeStation Plus, are great for those who want a device they can simply plug in, click a few buttons, and have it work as their own personal cloud. Until recently, the device was mostly used for the storage of files, photos, and videos, and with the Plus model, you could install and stream media through Plex. Synology recently released a new free application for the BeeStation Plus called BeeCamera, which is basically a stripped-down version of Surveillance Station. First, let's get the confusing naming out of the way. While you might initially think that BeeCamera is a physical device, perhaps a camera that Synology created specifically for the BeeStation Plus, that would be incorrect. BeeCamera is simply the name for the application that runs on the NAS and on your mobile device. I think the marketing team missed the mark here, but it does fit the other naming on the device, like BeePhotos and BeeFiles, I guess. Camera Support As of right now, only Synology-branded cameras are supported, which many will see as a callback to the drive locking the company implemented and then backtracked on. That said, while I 100% disagree on drive locking, I agree that camera locking for a device made to simply plug and play is the right decision. The whole point of the BeeStation line is simplicity. There are currently three camera model lines available, a wireless device for indoor use, and two PoE models for external use. CC400W (Wi-Fi): Plug it into power using the included power adapter, and connect it to your wireless network. This camera is rated only for indoor use and is the one I was provided to review the BeeCamera. $198.36, in line with the Unifi G6 Compact. BC510 (PoE): A bullet-style camera. Connect it to an Ethernet cable that is providing Power over Ethernet (PoE). This camera is rated for both indoor and outdoor use. $240. TC510 (PoE): A dome-style camera. Connect it to an Ethernet cable that is providing Power over Ethernet (PoE). This camera is rated for both indoor and outdoor use. $240. Although this isn't a review of the actual Synology camera, I did want to note that a positive for the Synology CC400W is that it uses a magnetic base. This means you can mount it on any magnetic surface, which is pretty handy. However, a downside to the camera is that it's powered by a built-in USB cable that's about six and a half feet (two meters) long. This means that the cable will probably be either too long or too short, but more importantly, if the cable is damaged at all, you'll likely need to buy an entirely new camera because there doesn't appear to be a way to replace it, unlike many competitors, like the Unifi G6 Instant. Hopefully, this is something Synology addresses in a future revision of the hardware. The BeeStation Plus supports up to four cameras. Setup The setup of BeeCamera is, like everything in the BeeStation family, very straightforward. Simply make sure you're on at least version 1.5 of the BeeStation OS, and BeeCamera is automatically installed on the device. BeeCamera Setup Screenshots Setting up the CC400W was just as easy. Plug it in, open up the BeeCamera app, and follow the on-screen steps to add the camera. During this process, you'll configure the camera name and how many days of retention you want to keep. The system will also automatically update the firmware for you. The whole thing took only a couple of minutes, excluding the time it took for the camera to update the firmware. Once the camera is connected to the BeeStation Plus, you can manage the various camera settings within the app, although there aren't many to choose from. You're able to configure whether the microphone will record audio (some privacy laws may preclude you from recording it), select what codec to use (H.264 or H.265), configure the color and exposure of the camera, and determine what data you want to overlay onto the video. Finally, you can set up AI detections so that BeeCamera will alert you if it sees certain things. These are all of the common detections you would expect in a camera system, such as people, pets, and vehicles. Under people and vehicles, you can also add extra monitoring for lingering and congestion detection, although pets are currently in "Lab" and therefore have no extra features yet. Recording in 4K using H.265 for 30 days will take roughly 300 GB of storage, which is very reasonable for most regular households, as the BeeStation Plus has 8TB of native storage. If you want to set up detection zones, you can. These are areas that BeeCamera will look at for the various detections, and are helpful if, for example, there's a tree in your frame and you don't want to be notified each time the wind makes the branches move around in the frame. Finally, you can also schedule when the camera should and should not be recording, which is a very useful feature. For example, you may want to record only at night when you're sleeping, but not during the day when you're up and about the house, so you can easily shut the camera off between 8 am and 10 pm. Each hour of each day can be configured to record continuously, only upon a detection event, or disabled completely. You can't fine-tune to record at a specific time, though, only hourly blocks on the hour. Daily Use The best part of BeeCamera is that it's easy and just works. If you only care about being notified when things happen, the mobile app sends those notifications and lets you click the button to bring up the video and see what's going on. For example, when I went out of town and had the camera pointed at the cat tower in our hallway, it was nice to be able to drop in and check that my furry friends were doing okay without me. Initiating the remote connection to the BeeStation Plus through the app is very responsive, but this will heavily depend on your ISP. In my case, using Xfinity, I'm able to go from starting the app to seeing live video in roughly three seconds, which is about the same amount of time it takes to connect to my Unifi UNVR system that costs much more. If you want to see footage from a specific day and time, you can do so using the calendar icon. You can also scroll through the timeline, looking for detections that are labeled in blue (vs. the normal gray when there's nothing of interest). There are buttons that let you go to the last/next detection on the timeline, which is helpful if you missed the notification on your mobile device. That's where the ease of use stops, though. While you can download clips that are flagged by detection, there's apparently no way to select generic time frames you're interested in, and the only place to download is to your phone. In addition, sharing a video shares the actual video, not just a link back to your BeeStation Plus. While that's good from a security and privacy perspective, it's a little awkward for sharing large videos. Limitations While the ease of implementation is great, there are some things that are lacking from BeeCamera. The most obvious is that there is no way to view the footage on the desktop. You can log in to the BeeStation Plus to see how much storage BeeCamera is using, but unlike BeePhotos and BeeFiles, there is no BeeCamera on the web console to manage or view footage. This means you'll be viewing all of your security footage on your mobile device, which is pretty limiting. In addition, there's no way to download the video to your PC without first using your phone as the intermediary. The one exception to this is that you can use BeeFiles to see the raw MP4 files. They're saved in 5-minute increments, and it's just raw data with no detection information or any other way to identify what any of them are. The lack of a way to interact with BeeCamera on the desktop also makes configuration of the cameras more difficult. For example, trying to set up detection zones using a tiny screen and your finger to draw boxes is more cumbersome than it needs to be. This reinforces the idea that BeeCamera is not made for power users. It's also missing some of the more advanced functionality of Surveillance Station. For example, I couldn't find a way to say, "Alert me if the thing in this zone is no longer there." Another major deficiency with BeeCamera, and a feature I suspect may come out in the future, is that while it can detect generic people, there is no specific facial recognition yet. This is an interesting omission, given the fact that other Synology tools can detect specific individuals, and competitors such as Unifi Protect also do it. This is probably a software limitation, so we will have to wait and see if this feature is added in the future. Conclusion If you need a security guard to monitor surveillance cameras to make sure your property is secure, then BeeCamera is not the solution for you. That said, you probably wouldn't be using a BeeStation Plus as the brains behind the system either. BeeCamera (and BeeStation in general) is clearly aimed at households that want to avoid sending personal data to Google and Amazon, and now want to add some cameras to keep an eye on their home and their pets while they're away. BeeCamera excels at doing this. The target market isn't interested in creating cases, tying multiple views together in a single pane of glass, or the like, and for the intended use case, the system works great. Where it starts to fall apart a bit is with more advanced features. Not being able to use a desktop app is a major compromise in my opinion, and having to do all of the configuration on a mobile device is annoying, but not impossible. If you don't want to have a full-fledged NAS device in your home, but still want control over your data (or maybe want an easy way to backup your data for World Backup Day), and want to add a couple of cameras to keep an eye on your house and your pets, this is a great, cheap, and easy way to go, and I suspect more functionality will come over time. If Synology releases a desktop app or at least a way to configure cameras and view footage on a desktop browser, this would be a near-perfect solution for a general home user. As an Amazon Associate, we earn from qualifying purchases.
  • Recent Achievements

    • One Month Later
      timbobit earned a badge
      One Month Later
    • One Month Later
      nates earned a badge
      One Month Later
    • Week One Done
      Almohandis earned a badge
      Week One Done
    • Rookie
      dorf went up a rank
      Rookie
    • First Post
      mike_rumble earned a badge
      First Post
  • Popular Contributors

    1. 1
      +primortal
      476
    2. 2
      +Edouard
      172
    3. 3
      PsYcHoKiLLa
      104
    4. 4
      Michael Scrip
      88
    5. 5
      Steven P.
      70
  • Tell a friend

    Love Neowin? Tell a friend!