Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a hosted dedicated server, that I would like to run Hyper-V on including TMG as an edge to secure the environment. But because this is a hosted server, I have a few questions that I hope you can help me answer.

The server needs to run a TMG, domain controller, web-server and a sql-server - 4 guests. It has one NIC connected to the internet. I had something like this in mind (modified from TechNet): Network architecture

If I choose to go with this solution, how can I manage my server remotely? The problem is that the parent is not connected directly to the internet. This is also a good thing from a security perspective, which is important, but if I can't manage my server...

How do you normally solve this problem?

share|improve this question
    
It's an interesting conundrum - do you have more info on the hosting? Is it a commodity server you're renting or your own box you've collocated? –  ITHedgeHog Aug 1 '11 at 15:16
    
You can see a similar server right here: Hetzner –  Tommy Jakobsen Aug 1 '11 at 15:31

2 Answers 2

up vote 3 down vote accepted

Given your hardware there are only two ways I can see to achieve what you're trying to achieve with the single machine (Unless your host offers some kind of com port remote access to the physical server?).

The first is to enable the host machine (On a separate IP) to have an IP Address even though you are binding the NIC in Hyper-V Manager. This connection would then need to be connected directly on to the internet - this would need to be secured with a separate firewall.

Whilst it would be possible to route it back through TMG I would not advise doing this at all with a virtual TMG instance nor with a remote TMG server - what do you do when you set a rule wrong and it locks you out).

You could then use this IP to access your host machine directly - depending on your own connectivity you could lock it down to only responding to requests from certain IP ranges (IE your office static address).

The second option would be too request another physical NIC from your host, and have it assigned an IP address as above.

Both options require you obtaining an extra IP Address from your host which will incur extra cost.

share|improve this answer
    
When you say host, you mean the parent on the hypervisor, right? If I order a second NIC for management, it would have to be exposed on the internet. Doesn't that leave me vulnerable to attacks? –  Tommy Jakobsen Aug 1 '11 at 16:31
    
Yes, by host I mean the parent partition. Yes you would be open to the internet, unless you lock down the firewall further. For example if you have a static IP at work you could make the management NIC only respond to requests from your static IP. –  ITHedgeHog Aug 1 '11 at 18:49

A "slight" modification to what is already in place is to:

  • Obtain an additional routable IP address (total 2)
  • Set the "Virtual Network" NIC to "bridge" mode with a routable IP
  • Assign the other routable IP to the physical host NIC
  • Enable VPN access to the physical host and lock down all other unneeded ports

The VPN arrangement (you choose the level of security to suit your needs - PPTP, IPSec, etc.) will allow you to access the physical server to administer it and the hypervisor, while the existing virtualized environment functions as configured (diagrammed).

share|improve this answer
    
What is the prefered way to enable VPN access? I do not have much experience with this. Can I do it directly on the parent using software? A hardware solution is not possible. –  Tommy Jakobsen Aug 2 '11 at 7:13
    
If you are deploying Hyper-V, then there is a good chance you have the rest of Windows as well. The simplest way is to create an "incoming" VPN configuration along where the NIC definition is - it's something like "Network and Dial-up Connections" (they change the naming from version-to-version). –  user48838 Aug 2 '11 at 7:37
    
Sounds easy. Do you know if Hyper-V Server has this functionality? –  Tommy Jakobsen Aug 2 '11 at 8:32
    
Are you running Hyper-V core or is it actually Windows 2008R2? If it is actually Windows 2008R2, then you should be able to right-click and "create new connection" by the existing NIC connection. –  user48838 Aug 2 '11 at 12:32
    
No, Hyper-V Server :) –  Tommy Jakobsen Aug 2 '11 at 15:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.