3

I want to provide remote work solution to devs on my team.

While each developer runs its stack for the web applications (server & tools), the DB and many other applications (like sharepoint, the project forge) are hosted on virtual machines inside our corporate network, closed to external access. In order to work, any developer needs to have access to the local corporate network (domains?).

Our physical machine have access to Internet (like I am doing right now asking this question).

Can I install some sort of rebound, of tunnel endpoint, on one physical machine (Entry Machine) in my team that would then dispatch the received traffic as its own ?

I thought about the following setup:

  • remote machine with team member working at home : modify the host file to redirect all corporate domain calls to Entry Machine IP.
  • some kind of tunneled connection to let traffic in from Internet to EntryMachine (security on incoming traffic is mandatory here, right ?)
  • dispatching the traffic to the corporate network as if it was coming from a local machine.

Could it work ? With which tools ?

Existing solutions :

  • Our support has proposed a VPN solution (I think) that allow managers to have access to mails and directories but this is 15% of a developper needs.

  • There is also a remote desktop control solution through a VPN but developping on a remote machine has such a low quality of life that it defeats remote working pros.

They are not open to discussion about more solutions (for now).

Sorry if it's the dumbest question ever, I am not knowledgeable enough to find the answer myself.

I really want to give remote work possibility to my team ; thanks for any pointers.

5
  • 4
    You can certainly do anything you need to do with a VPN. Nov 9, 2018 at 16:16
  • Good news, but how ?! For what I understand about VPN, the user installs a client to connect to the provider and reaching Internet from the provider systems, is it correct ? I fail to see how I apply this to my usecase
    – Poutrathor
    Nov 9, 2018 at 16:35
  • A VPN is used to reach any remote network. It may be the Internet, or your own internal network, or both. The difference is in how you set up the VPN. Nov 9, 2018 at 16:40
  • If you use Windows, it already has VPN functionality builtin to the product (both server and client). Most firewalls, which you probably have, also have VPN functionality. They do everything you need, except the most important thing, which is your manager needs to discuss this with your IT support.
    – Greg Askew
    Nov 9, 2018 at 16:53
  • can you check my comment to ankur22's response ? I don't understand how the Internet to EntryMachine would work with a vpn. Is it what you are referencing @greg askew ?
    – Poutrathor
    Nov 9, 2018 at 17:10

4 Answers 4

7

You say "I want to provide remote work solution to devs on my team" but it seems that network-management is NOT under your direct control, as well as you are UNABLE to directly expose "your" services to the Internet (in other words: you cannot have YOUR VM directly exposed on the Internet). From the other side, your personal-computers/workstations DO have full Internet access.

If the above is correct (if not, please "comment"), your scenario is quite complex and a detailed discussion surely require much more space than what's taken by this answer. Anyway, as you seem to be interested in "pointers" ("...thanks for any pointers..."), here follow my suggestions.


" I want to provide remote work solution to devs on my team "

VPN, definitely, IS the way to go. Full-stop.

Anyway, you said: "Our support has proposed a VPN solution (I think) that allow managers to have access to mails and directories but this is 15% of a developper needs"

I can clearly see a sort of "protocol mismatch" between you (the "developer guy") and network-admins (the "network-guy"): you (both) are not speaking the same language, and simply don't understand each other. This is an easy thing to fix:

  1. write down a DETAILED list (VMs name, IP addresses, TCP/UDP ports) of all the services that your staff need to reach for their development activity and for all of them clearly state if it's "mandatory" (MUST), "desirable" (CAN) or "useful" (NOT STRICTLY NECESSARY). Please, take your time to fill such a list, doing your best in avoiding sort of: "I need full access to everything", as this is the best way to not solve the protocol-mismatch I mentioned above;

  2. do your best in properly understanding what's offered by the existing VPN services. As a starter, you might kindly ask for details. Please note that what you describe as: "VPN solution (I think) that allow managers to have access to mails and directories" is definitely not enough and show a sub-optimal understanding of the existing service (this is, again, a significant problem as for the aforementioned: "protocol mismatch" problem). As starting points:

    • are you and/or your staff members entitled to be assigned a VPN-access to company network? if no, why?
    • if yes, which servers/services (IP addressed and ports) can be reached when connected via VPN?
    • should your "MUST" & "CAN" servers be missing, which is the proper way to ask for the addition of new servers/services to be added to the VPN-enabled network?

Once the above two points have been solved...

  1. do your best in describing to network-admins that modern software-development practices DO require access to services that need to be shared among the team (issue/tracker; build-servers; test-servers; CI/CD platforms; etc.), enhancing the concept that those services should be tightly binded to the development team and, as such, decoupled from any other company network/services. Obviously I'm assuming that your developers do NOT act, directly, on "production systems" and that you already have in place a proper development chain, whose first stage are made exactly by the mentioned development servers/services (as such, completely decoupled from "production"). The final "goal" is to have such systems "confined" inside a proper/dedicated network-segment so that such network could be granted VPN reachability.

If during the various discussions you'll be told about any kind of "security policy" that effectively "prevent" the required modification of VPN-service/policy:

  1. keep in mind that "ICT security" is a key-component in almost every business. Anyway, its application is not a general "yes" or "no": depending on the company, on the business and on lots of other factors, "ICT security" can be applied (by network and system admins) along a "soft"<=>"hard" scale, with lots of points in-between. So, if posed in front of a "red-flag" raised for generic security concerns:

    • try to convince the other parts that you're requiring remote-access to systems that should be considered "owned by DEVs", and not affecting PROD, in any way. So, if they are "shared", they need to be splitted, regardless of the access (aka: if there's a security concern, than it applies ALSO when accessed locally, within the company). So this could be the proper timeframe to redefine networking and security boundaries;

    • DISCLAIMER: THE FOLLOWING IS A VERY RISKY/DIFFICULT ARGUMENT, TOUCHING SEVERAL KEY-ISSUE OF COMPANY POLICY. PLEASE: TREAT IT ACCORDINGLY!! if all the previous discussions failed, you could discuss about problems caused by unlimited Internet access already provided to DEV-team workstations: basically, from a technical point of view (let me insist on the TECHNICAL point of view), every developer can already use "remote-connection" software on his/her own PC, to reach such PC remotely (just search "Remote Access Software" on your preferred search engine). Actually, if you really have an unlimited Internet access, you could even host YOUR VPN-server OUTSIDE the company network, and build a whole "VPN-network" hosted 100% OUTSIDE the company, with an endpoint hosted on one of your workstations. I'm not going to get down to this path.... as I really think it's NOT needed. But you need to know that: 1) with an unlimited Internet connection, it can be done; 2) I bet that this is 100% NON-COMPLIANT with company policy so, again, you should avoid it.

I'm going to stop here. As I said, those are only "hints" to help you reaching the goal to negotiate a proper access to the existing VPN-service

7
  • 1
    Excellent analysis on the situation. :) +1 Nov 11, 2018 at 6:38
  • thank you for breaking down the issue so clearly. It's very helpful to see the issue from the other side. Now, I understand better what the other server fault user tell me. I will try to break down my answers as best as I can in comments : - yup that's correct - right, I have not give my best effort toward the network guys
    – Poutrathor
    Nov 11, 2018 at 17:39
  • - so we agree that giving remote access to peoples and computers that are nowadays physically inside the corporate network does not change security ? It's either already bad and need to be fixed or it's currently safe and giving remote access to the same network area changes nothing.
    – Poutrathor
    Nov 11, 2018 at 17:43
  • 1
    "we agree that giving remote access to peoples and computers that are nowadays physically inside the corporate network does not change security?" => not strictly. Providing FULL, UNRESTRICTED and UNMONITORED Internet access to internal users, is definitely risky. But granting them an additional "access" via remote VPN, surely increase the problems, as there will be a new challenge to deal with: ensuring that remote accesses comes exactly from legitimate users and computers, and not from third-parties who successfully got/steal VPN password/certificates/token etc. Nov 11, 2018 at 22:27
  • 1
    "taking remote control of local computer can be done, but as I said, current solution is clunky": you're limiting yourself, by thinking only to common "Remote Access software". Technically speaking (again: technically), with less than 5 USD per month you can create a whole OpenVPN infrastructure centered on an external VPS, and configured so to "route" all the VPN traffic through an INTERNAL machine and, from it, allaround the INTERNAL network. So, NO remote desktop: we're talking about FULL network access. Again: I bet this is 100% not-compliant with company policy. Nov 11, 2018 at 22:35
3

You can't have the VPN server on your "EntryMachine" inside the firewall/NAT. Instead, you should use the firewall/router/UTM as your VPN server.

Also, if you don't control the firewall or if you are not allowed to use VPN connections to the company network, you should not try to circumvent it. That could be possible by establish some kind of connection from the "EntryMachine" to a third machine having a public IP. Creating such a backdoor would probably be against the company policy. Definitely it would make the internal network more vulnerable as it bypasses all the firewall and intrusion prevention controls.

2

At work we've used Openvpn to create a private vpn network so we can work from home but connect to the office network. Everyone could either have their own vpn profile, or you can create a generic profile that requires personal credentials (IPA credentials for example).

In this scenario you would need an openvpn server that is installed in your office, which has access to both the internet and the office network, but you'd lock access to that server so that incoming/outgoing connections (apart from the openvpn connection port) are blocked. You should probably leave port 22 open to the server for connections coming from within the office network.

If you setup you're own DNS server in your office, then you wouldn't need to modify your hosts file. You'll just have to modify your network settings to point to the DNS server in your office.

I think a site-to-site IPsec tunnel might be overkill for what you're asking to do. They're usually used to connect two networks together.

Hope this helps a little.

1
  • thanks ! My issue is that my machines in the corporate network have access to the Internet through the corporate proxy, firewall, etc. So how could the distant user connect to an openvpn installed on a local corporate machine ? that's where I get lost and was thinking about some sort of tunnel (?)
    – Poutrathor
    Nov 9, 2018 at 17:02
2

Either bring the network to the users with some kind of VPN, or bring the users to the network with some kind of virtual desktop / remote desktop. Whatever you do, this extending your network edge should be designed and approved as part of your security posture.

Define with users the minimum applications to make remote access useful. A developer can work with a git repository offline, but if they need to interact with the issues tracker, test servers, email, and phone, that requires connectivity.

Question your assumptions about what a VPN experience is like. In a Microsoft environment, Direct Access is fairly invisible to the user and works over whatever Internet connection they have.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .