1

We have a webserver which is hosted outside our office.

The firewall of the server limits the access (ssh, sftp, etc) by ip; only the public static ips of our office can access it.

Our problem is that the responsible person has to come to the office to work in case of emergency. We would like to find a solution to allow him to work without the location constraint.

Unfortunately our VDSL router (Zyxel P-870HN-51b) has not VPN capabilities.

We were simply thinking about buying a firewall (ZyXEL ZyWALL USG 40) and have it setup in our office so the remote employee would "get" a whitelisted public ip.

Is it a safe solution? Or would you advice something totally different?

migrated from security.stackexchange.com Apr 21 '15 at 11:24

This question came from our site for information security professionals.

  • 1
    Stand up a VPN server with a static IP somewhere (AWS, etc.)? Does your hosting provider have a solution? – schroeder Apr 20 '15 at 22:22
  • Unfortunately their solutions are way too expensive. :( – Toto Apr 20 '15 at 22:33
1

You're website's security is partially dependent on your office's network security. You're talking about adding a means of making a remote connection into your office's network. Adding the VPN will provide a new attack vector (hacking the VPN logon or VPN device) so you'll be weakening your existing security.

That said, what you're proposing is a fairly standard configuration and functionality that VPNs are intended to provide. So take care with the VPN configuration and you should be OK.

  • Looks like adding a two-factor authentication to the VPN would add a security layer. Hope we can find an affordable solution... – Toto Apr 20 '15 at 23:55
  • If you want to go the VPN route, try Duo Security 2FA duosecurity.com – Marc Woodyard Apr 21 '15 at 0:24
  • This page has a collection of 2FA services. I've used Toopher, Google Authenticator, and DuoSecurity and been relatively happy with them. – Neil Smithline Apr 21 '15 at 15:14
0

Have you tried Dome9? http://dome9.com

They provide on-demand access from your local IP address, or you can send a invitation to a remote employee.

Dome9’s Secure Access Lease Invitations use patent-pending security automation to invite only those you authorize to securely access your cloud servers.

Instead of relying solely on usernames and passwords, which are often shared or lost, Dome9 lets you lockdown your cloud servers and with just a few clicks, generate one-time secure access invitations for authorized third parties.

Secure Access Lease InvitationInvite your developers, consultants, and other trusted users to securely access your servers, on-demand, without exposing your cloud to brute force attacks and exploits – even if their credentials are compromised!

http://www.dome9.com/overview/secure-access-invitations

I've been using them for the past year. Haven't had any complaints.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.