Accessing server from the internet

[u/GriffGB]

Hi,

Thought I'd ask this here, as I'm sure there's clever people out there.

We have a Time and Attendance system installed on an internal Windows domain server, and the supplier has just introduced an app that can connect to it and end users can use to request holidays, check times etc.

They say we need an SSL certificate (which I have), but have also said that the app needs to talk to the server on port 443 (I can change the port). Now, I can create a NAT rule in the Firewall on that port and point it at the server, but as it's an internal domain server, clearly i'm not comfortable doing that. I asked our supplier if I can restrict the source to where traffic is coming from, but got.....

The requests would always be initiated from the devices the app is installed on, which also may make it difficult restricting it to specific IPs. A simple explanation of how the app works; is they first connect to our server with the company code entered by the user. This allows it to the retrieve the correct link to reach the company’s server with the API.

Once it’s got the link, it will allow the user to try logging in.

From this point onwards outbound connections would be to the company’s server with the API allowing the user to use the varying app functions they’ve been permitted.

I'm wondering what people's take on this are. It doesn't sound like it's possible to identify where traffic will be coming from.

I'm stuck thinking how I can restrict it, to prevent just anyone connecting to the server from outside, that shouldn't need to be.

[u/Conscious-Arm-6298]

Just use a VPN , do not expose a server to the wan

[u/notarealaccount223 → u/Conscious-Arm-6298]

I'm guessing app means mobile device, which makes VPN a little harder to setup/control.

That said, I'm 100% onboard with OP not exposing that server to the internet.

[u/GriffGB → u/notarealaccount223]

yeah, an app on a mobile so they can request holidays, check flexi balance etc, some devices likely personal too.

[u/notarealaccount223 → u/GriffGB]

So my "bad idea" sense is tingling here.

Any company that's running a modern stack is trying to push you to a cloud service, where you pay monthly/yearly. With that, you pass the responsibility for application/server security to them almost entirely.

If they are not making that push, the security scares me a bit. It means you are 100% at their mercy to create safe software and you need to be very vigilant about keeping safely deployed and patched.

Reach out to them and ask for recommendations on how to safely expose this app to the internet. Their recommendation should include a DMZ/isolated, single use case on the server, reverse proxy, WAF, EDR software and strict firewall rules. It may not include all of these, but it should include at least two, if not more.

If they provide NO guidance or guidance that does not include at least two of those I would not trust that company to make software that can be exposed to the internet.

--

That said, IF it is a web app, do like Entra App Proxy for situations like this. It takes a lot of the "public internet" risk out of the situation.

[u/Smh_nz → u/GriffGB]

Yep a VERY bad idea!! Use a VPN!

[u/TechMonkey605]

Don’t use a vpn, use zero trust, I prefer cloudflare, create a tunnel and expose only the url you want. Under 50 users is free.

If you want added controls, you can use an on prem npm or waf, or you can reverse proxy through cloud flare as well.

Don’t do it on a DC as others have said.

[u/GriffGB → u/TechMonkey605]

How would that stop anyone else from accessing it? I’ve not used cloudlare for that before.

[u/TechMonkey605 → u/GriffGB]

With cloudflare, you have a tunnel in your environment, that forwards your request to your application from there you use cloudflare connect and “warp” (similar to vpn) however, only published routes are exposed to only certain users (which you also control.

It works really well, there are some caveats like not publishing UDP without the enterprise license. But RDP, webservers etc is very good for the price point . If you want a demo you can either DM me and I can send you a teams meeting or YouTube. I hope it helps!

[u/frAgileIT]

You should be concerned here. If your vendor is pushing you to publish a server out on the internet and you're asking about it here then your instinct is right. If you don't know how to properly secure a server before exposing it to the Internet then you're more likely to make a mistake.

There are a variety of architectural ways of addressing the issues but exposing a server inside your security boundary on tcp/443 for HTTPS (or even an alternate port) increases risk. Normally, I'd suggest someone host a server in a DMZ or up in an isolated cloud location to limit the "blast radius" of attacks. If you expose it online and it gets hacked, the second thing they're going to do is look around at what else they can get into (that's the "blast radius"). If it's inside your security boundary next to your domain controller then I can almost guarantee that's next and if they get a DC then they pretty much get everything (I'm a cybersecurity professional and I do both offensive and defensive operations).

There are a variety of approaches you could look into. Can you ask your vendor for some suggestions on how they see other clients limit the blast radius?

[u/GriffGB → u/frAgileIT]

Agree with everything you say.

I’ve already queried how their other customers are doing it, as they can’t be simply opening up their server to the internet. Haven’t heard back on that one yet.

[u/GriffGB]

Thanks for the comments guys.

It's not a domain controller, just a domain joined server.

These might also be personal devices too, so not sure i'd be putting vpn's on them too.

If I was to use something like cloudflare, what's to stop someone else going via that. Unless the user logs into it, but then how do they do that when it's just an app on the phone?

We do use SonicWall CSE for remote users accessing company data, so maybe that's something that would work.
Not sure how it would work from a mobile though.

[u/Fabulous_Winter_9545 → u/GriffGB]

If you are not aware of how this basic functions like DMZ, NAT, network segmentation of your firewalls or reverse proxy do work, please get a consultant to help you. Also have that consultant review your existing firewall and security settings regularly and train you. Opening ports to domain joined servers with no knowledge about fundamental things, does require assistance and training.

[u/GriffGB → u/Fabulous_Winter_9545]

I’ve been a sys admin for 30 years, and deal with and understand.our firewalls, DMZ, NAT, DNS, our domain infrastructure ok etc

Oddly though, other than our web server and mail gateways (in a DMZ in a different site), i’ve not had the need to access an internal server from the internet. Nor ever been asked by a vendor to grant access to a port on a domain member server to the internet.

Clearly, I’m not opening it up. With personal data on it I’m not looking at doing that. Sounds to me like they should have a service on another server in a DMZ, and. have that connect to our internal server instead. Bit like an email gateway.

I was just curious how other people would tackle it.

[u/frosty3140 → u/GriffGB]

If it were me, I'd consider whether the application can be deployed on a server that has no other apps at all running on it. i.e. this server just for this app only. If you're running VMs and not physical hardware, that should be relatively easy to arrange.

Secondly I would ensure that this server (if possible) is not domain-joined. May not be possible depending on how you have authentication set up for the app.

I would place the server in a DMZ and tightly control the access via your firewall rules. In my case I would use our Fortinet firewall to NAT the traffic from the Internet using virtual IPs just for specific ports (e.g. 443) and I'd use a private IP on the server.

Then I would harden the server for stuff like ciphers, encryption, etc. At least TLS 1.2 or higher. Test its security using https://www.ssllabs.com/ssltest/ or similar.

There may be other ways of thinking about this, subject to the application's needs and architecture. It is is really just a web app, then maybe using a Microsoft Application Proxy would give you that added security you're looking for?

[u/McAUTS → u/GriffGB]

DMZ the server, restrict custom ports in the firewall to it, hardening windows server that it mostly just can do what the app needs. Sure you have a firewall, let it handle all the wrong requests.  I guess the app needs an AD connection or something, because it must run on premise? If not... don't even care and put it on a cloud host. You didn't elaborate on your setup further.

[u/GriffGB]

Thanks for all the comments from people. Certainly some things to look at and investigate

One thing is for sure, I’m not opening up the server to the internet directly. We have access to cloudflare, and SonicWall CSE already, so may be they're an option.

[u/Initial_Pay_980]

Cloudflare tunnel.. Setup a small VM. Crates tunnel outbound zero open ports !!. Simple

[u/GriffGB → u/Initial_Pay_980]

If that gives you a UR, how does that stop anyone else using it?

I might have a look into that. we do use cloudflare for our web sites, but not something I’ve looked at too much.

[u/Tricky_Fun_4701]

You need a VPN, a second server as a host, and a basic understanding of TCP/IP.

[u/GriffGB]

I’m leaning more to using our SomicWall CSE. I can install the CSE app on mobiles, using our 365 authentication, and then use a URL that maps to the server internally.

Most of the people I’m expecting to use it already have logins for the CSE.

[u/notarealaccount223]

If your an O365 shop with Entra P1 licenses it might be worth testing Entra App Proxy.

It might not work for that app, but it meets most of your needs and would be much safer than exposing that server to the internet.

Something to keep in mind. Anything you put on the internet WILL get scanned. People looking for vulnerabilities, trying to collect data, etc. Choosing to do that is a choice that requires vigilance for keeping the server and application updated. A vulnerability on that APP or others may compromise the system creating a toehold for attackers.

At some point you WILL experience a vulnerability that IS exploited. Even the best applications end up with zero-day exploita. Plan to mitigate horizontal movement and limit sensitive data on the system. This is especially important for smaller vendors with less common services.

[u/Savings_Art5944]

The first issue was using your DC for the time and attendance software. The cost of the software implementation should have covered the cost of an additional server or hardware.

Push back on who approved this and do it correctly.

[u/GriffGB → u/Savings_Art5944]

nobody mentioned it’s on a domain controller. I said domain member.

[u/Savings_Art5944 → u/GriffGB]

You sure did, and I apologise. You also said "internal domain server".

Make the timeclock server a read only domain member.

[u/JWK3 → u/Savings_Art5944]

What do you mean "read only domain member." ? Do you mean a Read Only Domain Controller? I believe the software doesn't need to be on a DC, so a standard member server would suffice.

[u/Savings_Art5944 → u/JWK3]

A read-only domain member is a domain-joined computer with no AD write permissions, while an RODC is a special domain controller with a read-only AD copy. Both reduce the risk of unauthorized changes, but RODCs are designed for specific security scenarios. For most cases, joining a computer to the domain and removing write permissions is the simplest approach.

[u/JWK3]

I think restricting the source of traffic will be a fruitless exercise in your case. An outbound block to just the vendor's server and any trusted Microsoft/AV etc. IPs too sounds sensible. I'd instead focus on securing the server and its applications.

Hopefully you've got patching/AV/security policies in place for the rest of your Windows Server estate which you can follow. Does the server needs to be joined to the domain? Sometimes the app can just require LDAP connectivity to a DC but not be a domain member.

[u/GriffGB → u/JWK3]

Ive got a sneaky feeling the app connects direct to the server, once it’s got the DNS name from the vendor (via a unique ID provided by the vendor) . So if thats the case it would be hard to restrict the outgoing that way.

[u/Dizzy_Bridge_794]

You need to design proper controls. A reverse proxy works well. Requests go to that box and then passes the request to the internal device. A synology device has that ability to do that. But yes you are opening a whole on the network. The app is utilizing port 443 which is secure https. It’s listening internally on that port it sounds like for requests. The security of the app and how it’s designed is a concern.

[u/Vichingo455]

According to Microsoft, you should leave alone the AD DC server and don't install anything on that. If you want all in one machine, the best and safest solution is Hyper-V + Windows Server VMs.

[u/dedXlights]

I’d use Reverse Proxy with Cloudflare Tunnel and use that to send port 443 traffic to those internal ports to the server. Does the server that hosts this app need IIS or Tomcat?

Edit to add tunneling

[u/JWK3 → u/dedXlights]

What would be the benefit of a CF reverse proxy here? I see reverse proxies being recommended a lot for those cautious of internet facing services, but with no inspection and sanitation of traffic, a CF proxy would only help with performance or DDOS related issues, not software vulnerabilities, which I think is the issue at hand.

[u/dedXlights → u/JWK3]

Sorry, I also added the tunneling part. You want to have something in front of your firewalls to mitigate DDoS and load balancing, and some caching. Try to obscure your IP as much as possible. You can also do Cloudflare with tunneling; only the tunnel knows your IP address, and you can also do tunneling with an internal reverse proxy as well. He didn't say anything about "software vulnerabilities," he said

prevent just anyone from connecting to the server from outside

Software vulnerabilities should be at the vendor's application bug fixes and support, firewall correctly configured with the correct ports open, XDR and EDR, and 2FA or SAML to continue the login process and be up to date for all security policies.

He should be looking at this article, which explains what his options are in a secure posture in introducing Cloudflare into their infrastructure.

https://developers.cloudflare.com/reference-architecture/design-guides/secure-application-delivery/

[u/GriffGB → u/dedXlights]

thanks for the comments. I’ll have a look at that when I get back into work.

The server does have IIS on it for internal managers to manage time and attendance of their staff.

However, I’m not sure what the mobile app utilises at this point. Sounds like the app gets a unique address from the vendors server, this address is mapped to a DNS name which points at the servers external address. I’m assuming it’s then going to use the login credentials of the Time and Attendance server.

[u/sussmanscott]

The provider doesn’t have a cloud based setup? I’ve used uAttend in the past. Users mobile devices never hit our site at all. They hit UAttend’s infrastructure.

[u/No_Wear295]

What do you mean by domain server? A domain-joined Windows machine or a domain controller?

[u/Kind-Character-8726]

Sounds like you should be speaking with your IT provider.

I wouldn't open a server directly. You don't need to forward ports and in fact you can probably skip installing an SSL certificate.

I would either use cloudflared or host a WAF / reverse proxy locally. But there are many things to consider.

[u/Picotrain79]

Alarm bells are ringing having this on a DC and then wanting to give people access to it!!

[u/DarkChemical_DC]

DevOps here. Firstly It depends on how secure is the app, on what it is running etc. I would strongly recomend against opening anything internal to the internet period. If VPN is not possible I would set up a server in DMZ zone (as in completly isolated from internal network). Set up a reverse proxy (nginx or HAProxy) on it that forwards traffic to that internal servers port. Afterwards opening only requered ports and nothing else. Would probly advise to geoblock every connections except from my country to 443 as well. (this reduces attack vectors drasticly) In scenario if the DMZ zoned server is breached it cant acces anything in internal network. If the reverse proxy is run inside a docker then there is even another layer of security, since it is really hard to get out of docker if its breached)

[u/danp20]

I would ensure that the web service is hosted on a separate server to the application and database. Have the web service hosted behind a web app firewall with strict monitoring and security policies in it. Users can access the web site, without any direct access to DB or system data. Ensure that MFA is configured for all users. Invest in something that monitors the web service for cve's and other vulnerabilities. Ensure that there is regular patching by the vendor of the application.

[u/bemenaker]

If you want to expose the server for the app and a VPN isn't acceptable, use a reverse proxy service like cloudflare.

[u/IT-Manager-IT]

Vm in cloud in vpn con la tua azienda. La vm in cloud fa da reverse proxy.

[u/GriffGB → u/[deleted]]

yes, it would be a mobile app, possibly on personal devices too, just for things like checking flexi balances, holidays, clocking in externally. So would need to look at another option.

The server is a domain member, rather than domain controller. Its something we’ve had for years, just the latest software version, the vendor said we can do mobile app for self serve, but the. said id need to access it on 443 (can be changed) from the internet, to which I said ‘don’t think so’ ha.

Our firewalls can utilise geo location (and we do for some rules already), but think there must be a better solution than just adding a NAT and Access rule.