2

.NET Developer here, out of my comfort zone on this one.

My software company is going remote, where employees can work from home, Starbucks, a Regus office, Spain, anywhere really. One of our clients requires IP Whitelisting to access their servers, so I am wondering how we can avoid having to send them new IPs to whitelist daily.

We are not looking to advertise this business move to our clients, so ideally, I'd like to find a solution that requires little or no effort from our clients.

Anybody here who has been in a similar situation, how have you solved this dilemma?

Thanks.

4

I'm not sure if this is really an information security question per se or more of one about general networking; but here goes:

If you have a number of dynamic IPs connecting to a client that requires whitelisting, this will lead to constantly having to ping the client to update the ACLs to allow IPs as they change. While on modern residential connections this happens infrequently, it's enough to be a disruption.

The way most companies deal with this is to establish either a bastion host or a VPN.

The Bastion Host

A bastion host is a secure, hardened server that is connected to by authorized users. Its role is to allow these users to remote into it, and then "bounce" from it to connect to other, secure servers. Of course, the bastion host would have a static IP (it could be a cloud server, for example).

Now, this is useful for SSH, Remote Desktop or similar connections, but when needing more robust network connectivity a VPN is often the right solution.

The full or split tunnel VPN

A full tunnel VPN is a VPN connection that makes all traffic from the VPN client go over the VPN. Thus, all remote hosts/websites see traffic coming from the VPN concentrator's IP, and not that of the end user.

You can establish a full tunnel VPN at your site and have users connect to it. Then, they can connect as normal to the client's server. The client's server can only whitelist your VPN's public IP address, and thus any user connected to the full-tunnel VPN will be whitelisted and able to establish connectivity.

This system does have drawbacks in that it may cause slow connections on the end user's side, and slow down the VPN concentrator's internet connection. You can also configure the VPN to be "split tunnel", and only send certain traffic over it. In this case, you can specify that traffic to the client's servers IP addresses or range go over the VPN, while other general internet traffic go over the normal internet connection without traversing the VPN. This will conserve bandwidth on the VPN side and lead to faster internet connectivity for users connected to the VPN.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.