0

I need to access my corporate server (which is restricted) from my home. Corporate Admin is asking for Gateway IP of my home network so that they can whitelist my Home network. Basically, All my devices connected to my home Router should able to access my corporate server. enter image description here

So, I am thinking of two methods

  1. Should I Give my "Router's Public IP (60.XX.XX.20)"?- But If I give this, Restarting my router is changing the Public IP. So no use of giving this IP.

  2. Should I give gateway to my "Router's Public IP (60.XX.XX.1)"? - This, I am assuming that the gateway of the "Router's Public IP" that is 60.XX.XX.1 will expose all the rage of IP following that.

Please give your suggestions.

1
  • "Should I give gateway to my "Router's Public IP (60.XX.XX.1)"?" - What is this exactly?
    – DocRoot
    Feb 14, 2020 at 15:53

3 Answers 3

3

Should I Give my "Router's Public IP (60.XX.XX.20)"?- But If I give this, Restarting my router is changing the Public IP. So no use of giving this IP.

Yes. When and if your router ip address changes give your IT group the new ip address.

Should I give gateway to my "Router's Public IP (60.XX.XX.1)"? - This, I am assuming that the gateway of the "Router's Public IP" that is 60.XX.XX.1 will expose all the rage of IP following that.

No. Your traffic is not going to come from your router's gateway ip address, it's going to come from your router's ip address. The source ip address of the traffic is your router's ip address.

3
  • +1 as this answers OP question but they should be aware that a VPN would be much easier and secure for all involved once setup. Then if your public IP changes it won't matter. The 'Corp Admin' should setup a VPN server. You can also use the VPN client (your side) from anywhere (any public IP) depending on setup.
    – B. Shea
    Feb 14, 2020 at 15:14
  • Whitelist and VPN are not exclusive options. Although, doing both increases complexity. Feb 14, 2020 at 15:38
  • I agree with both comments, although I was answering the OP's specific question. I wasn't surmising, supposing, assuming, presuming or extrapolating, etc., etc. which seems to be our tendency. "Let me answer the question I think you should ask instead of the one you actually did ask."
    – joeqwerty
    Feb 14, 2020 at 22:53
3

You're actually forgetting about a third option: a VPN.

Instead of giving your router's public IP which changes when you restart the router, you could use a VPN service with a static IP or host your own VPN service on a server with a static IP.

That way you don't have to inform IT every time your IP changes.

1
  • 1
    +1 as this is the best way into most private nets. Most routers have some sort of VPN server built in or that can be installed. USE THAT. Don't worry about any other methods/whitelists or answers.Tell the ADMIN that. ;-)
    – B. Shea
    Feb 14, 2020 at 15:04
1

Providing the network as one IP of the home edge router assumes NAT is being used. This will not be true for IPv6, where each device is uniquely addressed. In which case you would want to provide the prefix of your net, possibly size /56.

It is unclear from your diagram what 60.XX.XX.1 is.

  • Don't obfuscate IP address, use real ones, or the documentation ones from RFCs.
  • It is not required at that gateways end in a .1 digit, that is just for the convenience of humans.

I interpreted this as 60.XX.XX.20 being the one public IP, behind which is RFC 1918 space behind a NAT.

Changing IP assignments from your ISP will break this whitelist. Especially for IPv4, with address exhaustion decreasing the chance you can hold on to an address. And it must be removed when you change ISPs. Ask what the change procedure is, if there is some kind of dynamic DNS style automation.

Consider what security in place. Hardened services with encrypted transport, may be fine to provide directly over the Internet. Like https web sites. Softer targets probably need to be behind some VPN or proxy.

Not the answer you're looking for? Browse other questions tagged .