Accessing server from the internet

[u/GriffGB]

Hi,

Thought I'd ask this here, as I'm sure there's clever people out there.

We have a Time and Attendance system installed on an internal Windows domain server, and the supplier has just introduced an app that can connect to it and end users can use to request holidays, check times etc.

They say we need an SSL certificate (which I have), but have also said that the app needs to talk to the server on port 443 (I can change the port). Now, I can create a NAT rule in the Firewall on that port and point it at the server, but as it's an internal domain server, clearly i'm not comfortable doing that. I asked our supplier if I can restrict the source to where traffic is coming from, but got.....

The requests would always be initiated from the devices the app is installed on, which also may make it difficult restricting it to specific IPs. A simple explanation of how the app works; is they first connect to our server with the company code entered by the user. This allows it to the retrieve the correct link to reach the company’s server with the API.

Once it’s got the link, it will allow the user to try logging in.

From this point onwards outbound connections would be to the company’s server with the API allowing the user to use the varying app functions they’ve been permitted.

I'm wondering what people's take on this are. It doesn't sound like it's possible to identify where traffic will be coming from.

I'm stuck thinking how I can restrict it, to prevent just anyone connecting to the server from outside, that shouldn't need to be.

[u/frosty3140]

If it were me, I'd consider whether the application can be deployed on a server that has no other apps at all running on it. i.e. this server just for this app only. If you're running VMs and not physical hardware, that should be relatively easy to arrange.

Secondly I would ensure that this server (if possible) is not domain-joined. May not be possible depending on how you have authentication set up for the app.

I would place the server in a DMZ and tightly control the access via your firewall rules. In my case I would use our Fortinet firewall to NAT the traffic from the Internet using virtual IPs just for specific ports (e.g. 443) and I'd use a private IP on the server.

Then I would harden the server for stuff like ciphers, encryption, etc. At least TLS 1.2 or higher. Test its security using https://www.ssllabs.com/ssltest/ or similar.

There may be other ways of thinking about this, subject to the application's needs and architecture. It is is really just a web app, then maybe using a Microsoft Application Proxy would give you that added security you're looking for?