How can I make my Windows Server accessible from another Windows PC over the internet safely, without using VPN?

Question

First, some backrgound context as follows: I have a Windows Server 2008 running for my company. It contains an ERP, which is accessible by other computers/clients on LAN. During the client setup, the only thing the client softare needs is, access to the shared folders on the Server. After the setup, the software on the clients just uses these shared folders for its communication with the ERP on the server. I believe the ERP server-client communications are unsecure, but I guess it's fine since it is only used within the LAN.

Now, I would like do the exact same thing as above, but for a client that is on the internet, hundreds of miles away. That is, the client needs to access the shared folders, just like the clients on LAN. Additionally, is there any way to make it secure, without using a VPN (because the VPNs in this area are usually not allowed by the local regulations)?

I thought of port-forwarding, but I realized I don't know exactly which ports windows uses for sharing folders, and quite possibly, the port-forwarding option might be insecure.

Thank you for taking the time to read & helping me out!

Answer 1

Given what you're saying, you unfortunately don't.

If the client communications are not properly secured (and based on ERP software I've seen, this is almost certainly the case), then you need security at another layer to keep thing secure (and even if they are secured, you should have another layer present before people can access it so that it's harder to attack).

You might be able to get things working with IPSec. It's a serious pain in the arse to set up compared to stuff like OpenVPN, but it's also not as widely or reliably blocked.

Alternatively, if the client software truly only needs access to the shared folders (I doubt that this is the case, it's much more likely that it also needs some form of IPC with the main system), you may be able to get it working by forwarding port 445 (the port for TCP-based SMB connections) externally. However to do this securely, you will need a newer version of Windows Server that properly supports SMB encryption (the first edition that did was Windows Server 2012).