| reply to ZC_217
Re: [IA] Dedicated IP from Mediacom? Ah, no I may have been a bit unclear...
Currently, I'm connecting to VPN in Chicago then to server. That works great.
If that VPN fails though, I've no graceful way to connect to the server. That's where the whitelisted dedicated IP from mediacom would come in. I can just connect directly from my home. |
|
 ZC_217
join:2010-02-07
Des Moines, IA
 ·Mediacom
| said by Sajan Parikh:Ah, no I may have been a bit unclear...
Currently, I'm connecting to VPN in Chicago then to server. That works great.
If that VPN fails though, I've no graceful way to connect to the server. That's where the whitelisted dedicated IP from mediacom would come in. I can just connect directly from my home.
Ah, ok. You are trying to set the firewall your server is behind to allow a second connection in to access the server in the event of the VPN failing.
Just a thought, can your firewall at your server location be set up to accept software VPN client connections? It would allow you a second path in, would be more secure than just a firewall rule allowing a dedicated IP in and then it wouldn't matter what IP you'd get from your ISP. Allows access from anywhere while still being secure. |
|
|
|
1 edit | That would essentially be me keeping a port open, wouldn't it?
The only problem with that is that it would accept the connection from any IP address and the security would rely on the authentication.
Which is perfectly fine and may end up what we do. However, I was much rather looking to dropping the packet completely if it wasn't from the handful of IPs (our VPNs + Dedicated Mediacom IP) that I would whitelist.
Please correct me briefly and point me in the right direction if I misunderstood. It's 8AM and I haven't slept. :P. |
|
ZC_217
join:2010-02-07
Des Moines, IA Reviews:
·Mediacom
| You wouldn't really be leaving a port open per se. It would respond to connections from any IP address, but you can use internal security authentication. I understand not wanting your firewall to respond to anything from untrusted sources but if you have good internal security policies you should be ok.
The way we use our software VPNs is in order to authenticate with the VPN and establish connectivity is to log into the VPN Client with internal Radius logins that must comply with IT Security policies. So you still have to have the right credentials for the firewall to even respond with anything other than requesting login.
Not knowing what kind of business it is, I don't know what level security is required, but I can't see allowing software VPNs opening your firewall up to anymore issues. If you don't have the right credentials it then simply drops the traffic. And you still have access to your servers no matter what your IP is. |
|
