Our production server hosts a small web system that runs on Apache and MySQL.
Today SSH and mysql access is open to all ips and only password protected. So we've decided that we need to improve security.
I'm thinking that we restrict SSH and mysql access to our server, so that only connections from our office is accepted.
We have a dynamic IP at our office today so we have to get a static one I think.
Sometimes however we need to access our server when we're out on the road. So I'm thinking that we get a stationary computer for the office that would be our DHCP server and SSH tunnel. So that we can connect to it and send all our traffic through it, so we get our office's IP.
Is this a good solution? Anything else I should do?