Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am sure this is server admin 101, but I am unsure of the answer and would love some help.

I am a software developer I have built an application for a client and am currently hosting it successfully on SliceHost. We are now coming out of Beta and the client wants to have the application within their firewall, but they do not want to deal with headache of hosting and maintaining the server.

Is there a way I can recommend that we put our server at SliceHost within their Firewall? Is that an easy thing to do?

Their specific requirements are:

  1. For my application to authenticate against their Active Directory, and
  2. Only allow access to the application from within their network

If that is not possible, what should I recommend to my client?

share|improve this question
Not sure what they are asking you. Do they want the service to access internal resources, you may want a VPN. Do they want be in complete control of the hardware? If they want to host it inside their network but not deal with it, they may be expecting you to offer to contract to support the box for them. – Zoredache Jun 1 '10 at 19:02

No. If they want it "within" their firewall, that means that it's in their network, at their location, and they own and control the server - unless they are willing to pay to contract that server's management to a third-party.

Unless they mean something different by "within their firewall" - perhaps a fuller explanation of what they want might engender more suggestions?

Edit - with your new info, then the answer is maybe.

  1. For my application to authenticate against there ActiveDirectory,

Yes, if SliceHost offers a site-to-site VPN option, then you can connect that to their firewall (assuming it can be an endpoint) and the hosted app can connect to their AD. You could also use LDAPS and expose the LDAPS port of a DC to the internet.

  1. Only allow access to the application from within there network

Yes, if Slicehost offers site-to-site VPN as above, then make the server only allow connections from the VPN. Or, if you know the source IP(s) for the customer office won't change, see if SliceHost can restrict the host to allow connections from only those IPS.

share|improve this answer
This is the way to go based on their requirements. Establish a VPN between the slicehost server and their internal network. You can then either direct all traffic from the slicehost machine through the VPN, or keep the external data connections but route the AD traffic through the VPN. – Chris Thorpe Jun 1 '10 at 22:11

I think the first thing to do is clarify what exactly "within their firewall" means.

Can you place a physical server on their network, inside their firewall, and manage it remotely (with the correct changes to said firewall to allow this)? Of course, perfectly normal way of doing things.

Other than that, I suppose you can create a VPN so your server, hosted wherever, tunnels through the VPN so it appears "logically" inside their firewall even though it isn't physically so. I'd ask what they hoped to achieve with this approach though if this is the sort of thing they're talking about because it's not really a straightforward way of doing things.

Without wishing to be rude, I have a few things that I classify as "If you have to ask, then you probably shouldn't" within IT and fiddling around with VPN and firewall settings is one (or is it two?) of them, so if this is what they're after you need to be very careful about what you do next. I'd certainly be uncomfortable with a server administered by a partner organisation but hosted at a random (to me) 3rd party being connected to my LAN via a VPN... so many potential sources of outages and security issues.

share|improve this answer
No offense taken, I will certainly not be doing this server/security setup -- we totally will engage an expert when the time comes. I just want to be able to offer an intelligent proposal. Thanks, I updated my question with more specific requirements – Jonathan Jun 1 '10 at 19:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.