US Cable Support > Mediacom > [IA] Dedicated IP from Mediacom?

[IA] Dedicated IP from Mediacom?

I know they offer statics for business accounts for a fee. If they do it for Res accounts I'm sure there will be a monthly fee for it.

reply to Sajan Parikh
Unfortunately we do not offer static IP addresses for residential accounts.

I don't understand that after all, it is just a "number" put into the system to get you online. Charge people $15 more if you want. After all, If business and residential go over the same coax, with the same equipment and have everything the same except a higher fee and better tech response time for business customer and the static otherwise there is no difference.
(Yes I know about the SLA's for fiber etc but I presume the OP is talking about ordinary cable internet)

reply to MediacomChad
Is that because Mediacom doesn't want people setting up servers?

The OP could just use dyndns.org.

reply to Sajan Parikh
The reason I wanted a dedicated IP was..

I run a company and have many servers around the country and have firewalls set of course.

I've locked all of these servers down so only one IP address can access them. This is the IP address of a VPN I've set up in Chicago.

However this has become a SPOF, and while I'm setting up other VPNs and whitelisting those IPs as well...I thought I'd look into getting a static IP for my home so that I can whitelist that as well.

I certainly wouldn't mind paying extra.

I've had this same issue with a couple computers I remote access at work. What I ended up doing was setting up a dyndns hostname for my home connection, then had a cronjob (scheduled task) to check the hostname's IP and update iptables (the firewall rules). It was a PITA to set up, and I do agree that it would be helpful to just be able to get a static IP. As demonstrated here, it's useful for more than just TOS-violating servers.

reply to lhollow
lhollows is probably on to something that they just don't want people getting a residential connection but setting up mail servers and such on that type of connection.

I use DNSExit.com with the IP Updater. It can updated DNS records with your dynamic IP.

On a side note, I've had the same dynamic IP for at least a year. As long as your CPE device is on all the time, you can usually keep your IP.

reply to Sajan Parikh
Keep in mind, I'm not looking for an A record to stay updated with my current IP.

I'm looking for my outbound connections to be from the same IP.

These are two different things. So services like DynDNS and DNSExit are not applicable.

The cron jpatton is talking about may work, but with the amount of servers and iptable rules that are on each...make me weary of doing it that way.
--------------------------------------

I've had the same dynamic IP for a while as well. However that's certainly not something I can rely on.

reply to Sajan Parikh

Ah, no I may have been a bit unclear...

Currently, I'm connecting to VPN in Chicago then to server. That works great.

If that VPN fails though, I've no graceful way to connect to the server. That's where the whitelisted dedicated IP from mediacom would come in. I can just connect directly from my home.

That would essentially be me keeping a port open, wouldn't it?

The only problem with that is that it would accept the connection from any IP address and the security would rely on the authentication.

Which is perfectly fine and may end up what we do. However, I was much rather looking to dropping the packet completely if it wasn't from the handful of IPs (our VPNs + Dedicated Mediacom IP) that I would whitelist.

Please correct me briefly and point me in the right direction if I misunderstood. It's 8AM and I haven't slept. :P.

You wouldn't really be leaving a port open per se. It would respond to connections from any IP address, but you can use internal security authentication. I understand not wanting your firewall to respond to anything from untrusted sources but if you have good internal security policies you should be ok.

The way we use our software VPNs is in order to authenticate with the VPN and establish connectivity is to log into the VPN Client with internal Radius logins that must comply with IT Security policies. So you still have to have the right credentials for the firewall to even respond with anything other than requesting login.

Not knowing what kind of business it is, I don't know what level security is required, but I can't see allowing software VPNs opening your firewall up to anymore issues. If you don't have the right credentials it then simply drops the traffic. And you still have access to your servers no matter what your IP is.

reply to Sajan Parikh
Security as you've described is extremely insecure. Source IP can be spoofed extremely easy and then all your iptables rules are completely null and void. Why not just set up SSH keys like everyone else since the end of the 20th century and be done with it? There is no way to break a 2048 bit SSH key and you can configure SSH to only allow your key to connect.

It's not an either/or proposition. We of course use SSH Keys, but again that is for the authentication. I was looking for a way to drop the packet completely if it was from an uknown source...before SSH keys would even come into play.

Also, access to this server isn't simply by SSH. So the other software that we're connecting to on the server doesn't use SSH authentication, which is why this is being done on the firewall.

However, I think I'm going to just keep doing it the way I have been. Rather than getting a static IP from Mediacom, I'll just setup other VPNs in other geographic locations. That should give me the same redundancy.

Plus other people that work for me around the world all have static IPs that are whitelisted...so I shouldn't ever get into a situation where I'm completely locked out of my system.

If I do...I guess I'd just need to drive out to each datacenter or call their remote hands.
----------------------------------------

I should be fine, would still have preferred a static IP from mediacom for $6-8/mo though.

reply to Sajan Parikh
I should note that I do have plans to throw a hardware firewall in the future, where these static IPs would be useful.

reply to Sajan Parikh
Obviously you don't know this but you can tunnel anything through SSH so you put one SSH server in the DMZ connect to that and then tunnel to everything you want to administer. No static IP addresses required, secure enough for PCI, and SOX audits. Problem solved, nuff said.

lol, that's how I have it setup now. The point of this thread is for what happens if that SSH server goes down.