1

I am newbie in the networking issues. I got a question for which I don’t know how to solve. I have my internal network that has a fixed IP (only accessed by VPN) and I have a server where I put some virtual machines for personal development work. However, an external client needed access to one of the virtual machines to test what has been developed. How can I resolve this issue so as not to give access to a VPN client?

They talked me into making a port forward in my firewall. This solves the problem?

I'll give an example: My fixed IP is 14.0.0.1 and the VM is 192.168.1.1.

How does someone get external access to the virtual machine without problems?

Improve this question
4
  • 1
    What are they testing? Is it a web site?
    – joeqwerty
    May 7, 2014 at 15:40
  • They talked me into making a port forward in my firewall. This solves the problem? -- We don't know (because you don't tell us what they're trying to test). You apparently did it though, so does it solve the problem? Why did you do something without understanding if it would solve the problem?
    – voretaq7
    May 7, 2014 at 15:43
  • @joeqwerty website or applications
    – PookPook
    May 7, 2014 at 16:18
  • @voretaq7 I did not, I'm just questioning whether it is possible
    – PookPook
    May 7, 2014 at 16:19

2 Answers 2

Reset to default
2

One method, if they needed direct access to the VM to be able to see the full desktop, would be to use the Port Forward/NAT that you already mentioned. You could use it in conjunction with Remote Desktop. The scenario would look like this:

  1. Get the public IP that the person testing this from the outside will be coming from (let's say 1.1.1.1 for our example). You will have to ask them to give you this.
  2. Open port 3389 from the WAN (outside) to your LAN (inside) for ONLY the IP they provide you. That way you aren't opening up this computer for the entire Internet.
  3. Create a NAT policy, or a port forward as they've instructed you to do already. The policy will basically say/do this

Source: Their public IP (1.1.1.1)

Translated Source: Original (meaning still 1.1.1.1)

Destination: Your public IP (14.0.0.1)

Translated Destination (this is where you use the internal IP; 192.168.1.1)

Service: 3389 (Remote Desktop)

Translated Service: Original

  1. Make sure you allow Remote Desktop connections to this VM (Start > Right Click Computer > Properties > Remote Settings > Allow from any... > Select Users > Add only this external user to the access list) (Note: Create a user and give the username/password to this person so they will be able to access this VM. Don't make them an admin on this VM unless you ABSOLUTELY have to.)

  2. They open Remote Desktop on their end and type in 14.0.0.1 for the computer to connect to and if you've setup your policy and other settings right from the steps above then it will forward them to a logon screen of your VM.

I have experience with many firewalls, so if you need help with a specific brand/model let me know and I can give more specific instructions.

Improve this answer
9
  • It seems to be a good solution I'll try to apply it. Currently, I have a physical firewall Fortigate 60C. I forgot to say that the machine I want to connect is Oracle Linux. Amending some of what was written above?
    – PookPook
    May 7, 2014 at 16:51
  • Sorry for double post. I'm using Virtual Box and when you say "Make sure you allow Remote Desktop connections to this VM (Start> Right Click Computer> Properties> Remote Settings> Allow from any ...> Select Users> Add only this external user to the access list) (Note:.. Create a user and give the username / password to this person so They Will be able to access this VM Do not Make Them an admin on this VM unless you ABSOLUTELY have to "Just let me choose "Null / Guest / External" and does not ask for an account.
    – PookPook
    May 7, 2014 at 17:12
  • Ok. My firwewall port forwarding/NAT policy would still apply even if you don't use Windows/Remote Desktop. You can change the 3389 port/service to another one that would allow them access. I've worked with Fortigate's and they are very easy to use. Let me know if I can help more, thanks.
    – Brad Bouchard
    May 7, 2014 at 17:14
  • Virtual box may have different settings for allowed users, so make sure you research the exact security level before you allow anyone a permission.
    – Brad Bouchard
    May 7, 2014 at 17:16
  • Thanks. Just a question, I need to configure something in my OS to also allow for remote access?
    – PookPook
    May 7, 2014 at 17:25
0

The virtual machine would have to have a public IP for them to connect directly, otherwise you'd have to let them VPN into your network. Other solution would be to share desktop and give them control via 3rd party tools like Glance or something.

Improve this answer
1
  • I think through share desktop is not possible because only is access to the external IP. Correct? Cannot connect inside the VM because we are not connected by VPN. If I'm wrong let me know.
    – PookPook
    May 7, 2014 at 16:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .