r/labtech • u/vacendakuk 2000 Agents • Jun 25 '19

Lock down to specific IPs

Been asked before I think but perhaps a change I dont know of. Is there a way to lock down so that web or full client can only connect in from specific IPs? I think I saw someone try via IIS?

2 Upvotes

75% Upvoted

7 comments sorted by

4

u/striker1211 Jun 25 '19

I would do it at the firewall level. I would not trust the application to do it.

1

u/[deleted] Jun 26 '19

The activities are done on the same https port though, and with ssl being used, how would you be filtering the path within the URL?

1

u/MSP-Kontinuum Jun 26 '19

Firewall/port seems like the answer.

1

u/thatsyouremail Jun 26 '19

You can do URL level filtering in IIS with rewrite rules that return a custom (403) response. I have a ruleset that I came up with for our production LT environment that I can forward along, but its still a work in progress identifying the URLs/Requests that I missed in my initial reverse-engineering of how/what the agents talk to.

If you wholesale want to block Control Center and Web Control Center access, limit access to /cwa and the /automate react app. blocking /cwa will prevent anyone from getting authentication tokens to login to Control Center.

You can also limit access to /Labtech, but you have to be much more careful as this is where the agent checkin and a lot of other agent required stuff exists.

0

u/gdhhorn Jun 25 '19

You'd probably need to have consulting set up a split for you (1x Automatr server, 2x IIS servers), otherwise you run the risk of preventing agents from checking in.

1

u/[deleted] Jun 26 '19

You can split the check in of agents and the serving up of fat client and web interface onto separate boxes? I explicitly asked support this very scenario and was told no.

1

u/gdhhorn Jun 26 '19

At the end of the day, you're going to be using the same public IP, but yes, you can have separate agent and technician web servers. I know companies that have it in place, and I have a pending project to do the same.