Best Practices - Securing your Windows Server 2016 VM on Vultr
-
@bigbear said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@Dashrender said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@bigbear said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
Have had some issues with it banning the servers external WAN address when behind NAT instead of the remote IP Address. Have been sifting through code but its not an active project, just a one time port.
Using the VULTR firewall to restrict all inbound traffic and to allow RDP sessions based on our office WAN IP has stopped the issues. However, I am still trying to decide how that helps my roaming users.
Outside of VPN or DirectAccess I am not sure what other secure access methods there could be. Looking for ideas.
FYI, Direct Access (DA) is a VPN solution.
Yes but that's not how MS markets it. Its a magical "always-on" connection. That does seem to be part of RRAS.... lol
MS says what it does and the description is EXACTLY a VPN. It's as VPN as VPN gets. No different than Pertino or ZeroTier.
-
@scottalanmiller said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@bigbear said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@Dashrender said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@bigbear said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
Have had some issues with it banning the servers external WAN address when behind NAT instead of the remote IP Address. Have been sifting through code but its not an active project, just a one time port.
Using the VULTR firewall to restrict all inbound traffic and to allow RDP sessions based on our office WAN IP has stopped the issues. However, I am still trying to decide how that helps my roaming users.
Outside of VPN or DirectAccess I am not sure what other secure access methods there could be. Looking for ideas.
FYI, Direct Access (DA) is a VPN solution.
Yes but that's not how MS markets it. Its a magical "always-on" connection. That does seem to be part of RRAS.... lol
MS says what it does and the description is EXACTLY a VPN. It's as VPN as VPN gets. No different than Pertino or ZeroTier.
This was my point. There's no reason to list it separately from a VPN, because it is a VPN.
-
@Dashrender said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@scottalanmiller said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@bigbear said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@Dashrender said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@bigbear said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
Have had some issues with it banning the servers external WAN address when behind NAT instead of the remote IP Address. Have been sifting through code but its not an active project, just a one time port.
Using the VULTR firewall to restrict all inbound traffic and to allow RDP sessions based on our office WAN IP has stopped the issues. However, I am still trying to decide how that helps my roaming users.
Outside of VPN or DirectAccess I am not sure what other secure access methods there could be. Looking for ideas.
FYI, Direct Access (DA) is a VPN solution.
Yes but that's not how MS markets it. Its a magical "always-on" connection. That does seem to be part of RRAS.... lol
MS says what it does and the description is EXACTLY a VPN. It's as VPN as VPN gets. No different than Pertino or ZeroTier.
This was my point. There's no reason to list it separately from a VPN, because it is a VPN.
Exactly. It's the middle of the VPN field.
-
@bigbear said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
Or do I create a Vultr firewall and restrict login attempts to particular IP address ranges?
This.
-
Or you could use the Vultr firewall to block everything and use something like ZeroTier as the VPN component.
-
@dafyre said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
Or you could use the Vultr firewall to block everything and use something like ZeroTier as the VPN component.
Yup, any VPN will work, but ZT has a lot of cool flexibility.
-
With ZT, you can use the AD on the RDS server to provide AD to the end points as well.
-
@scottalanmiller said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@dafyre said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
Or you could use the Vultr firewall to block everything and use something like ZeroTier as the VPN component.
Yup, any VPN will work, but ZT has a lot of cool flexibility.
Sure, but brings long DNS issues, that Pertino had to solve with an AD client "fix."
-
@Dashrender said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@scottalanmiller said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@dafyre said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
Or you could use the Vultr firewall to block everything and use something like ZeroTier as the VPN component.
Yup, any VPN will work, but ZT has a lot of cool flexibility.
Sure, but brings long DNS issues, that Pertino had to solve with an AD client "fix."
If it's juts one server, you don't need the DNS bits.
Just point everybody at the IP address.Edit: Or use a HOSTS file.
-
@dafyre said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@Dashrender said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@scottalanmiller said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@dafyre said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
Or you could use the Vultr firewall to block everything and use something like ZeroTier as the VPN component.
Yup, any VPN will work, but ZT has a lot of cool flexibility.
Sure, but brings long DNS issues, that Pertino had to solve with an AD client "fix."
If it's juts one server, you don't need the DNS bits.
Just point everybody at the IP address.Edit: Or use a HOSTS file.
With AD, you'll need DNS to find specific record types. It's true that a hosts file might solve most of the issues though.
-
In regards to ZT it might work, reminds me a lot of Himachi.
Since the remote client wouldn't be part of the domain DNS wouldn't be a concern. It would be less exposure to risk than RDPGuard (which I am still gonna try first).
-
ZT is really nice.
-
@scottalanmiller said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
ZT is really nice.
And did we mention free for up to 100 devices?
-
@dafyre said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@scottalanmiller said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
ZT is really nice.
And did we mention free for up to 100 devices?
On the hosted version, and free unlimited if you host yourself (which isn't cost effective as the cost of a VM is as high as the cost of the service.)
-
@scottalanmiller said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@dafyre said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@scottalanmiller said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
ZT is really nice.
And did we mention free for up to 100 devices?
On the hosted version, and free unlimited if you host yourself (which isn't cost effective as the cost of a VM is as high as the cost of the service.)
Price went up to $29 / month if you're hitting > 100 devices (unless you are grandfathered in on their $4 / month payments). But their web interface and management tools make it worth it to me. Managing a controller is a bit of a hassle without their web front end.
-
@dafyre said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@scottalanmiller said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@dafyre said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@scottalanmiller said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
ZT is really nice.
And did we mention free for up to 100 devices?
On the hosted version, and free unlimited if you host yourself (which isn't cost effective as the cost of a VM is as high as the cost of the service.)
Price went up to $29 / month if you're hitting > 100 devices (unless you are grandfathered in on their $4 / month payments). But their web interface and management tools make it worth it to me. Managing a controller is a bit of a hassle without their web front end.
A hassle compared to the web front end? hard to believe, that thing is a huge hassle.
-
@scottalanmiller said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@dafyre said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@scottalanmiller said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@dafyre said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@scottalanmiller said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
ZT is really nice.
And did we mention free for up to 100 devices?
On the hosted version, and free unlimited if you host yourself (which isn't cost effective as the cost of a VM is as high as the cost of the service.)
Price went up to $29 / month if you're hitting > 100 devices (unless you are grandfathered in on their $4 / month payments). But their web interface and management tools make it worth it to me. Managing a controller is a bit of a hassle without their web front end.
A hassle compared to the web front end? hard to believe, that thing is a huge hassle.
Really? I find it rather easy, although they keep changing stuff, lol.
-
@dafyre said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@scottalanmiller said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@dafyre said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@scottalanmiller said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@dafyre said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@scottalanmiller said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
ZT is really nice.
And did we mention free for up to 100 devices?
On the hosted version, and free unlimited if you host yourself (which isn't cost effective as the cost of a VM is as high as the cost of the service.)
Price went up to $29 / month if you're hitting > 100 devices (unless you are grandfathered in on their $4 / month payments). But their web interface and management tools make it worth it to me. Managing a controller is a bit of a hassle without their web front end.
A hassle compared to the web front end? hard to believe, that thing is a huge hassle.
Really? I find it rather easy, although they keep changing stuff, lol.
A good CLI would be dramatically easier.
-
@scottalanmiller said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@dafyre said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@scottalanmiller said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@dafyre said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@scottalanmiller said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@dafyre said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@scottalanmiller said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
ZT is really nice.
And did we mention free for up to 100 devices?
On the hosted version, and free unlimited if you host yourself (which isn't cost effective as the cost of a VM is as high as the cost of the service.)
Price went up to $29 / month if you're hitting > 100 devices (unless you are grandfathered in on their $4 / month payments). But their web interface and management tools make it worth it to me. Managing a controller is a bit of a hassle without their web front end.
A hassle compared to the web front end? hard to believe, that thing is a huge hassle.
Really? I find it rather easy, although they keep changing stuff, lol.
A good CLI would be dramatically easier.
+100000000!
-
@dafyre said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@scottalanmiller said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@dafyre said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@scottalanmiller said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@dafyre said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@scottalanmiller said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@dafyre said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
@scottalanmiller said in Best Practices - Securing your Windows Server 2016 VM on Vultr:
ZT is really nice.
And did we mention free for up to 100 devices?
On the hosted version, and free unlimited if you host yourself (which isn't cost effective as the cost of a VM is as high as the cost of the service.)
Price went up to $29 / month if you're hitting > 100 devices (unless you are grandfathered in on their $4 / month payments). But their web interface and management tools make it worth it to me. Managing a controller is a bit of a hassle without their web front end.
A hassle compared to the web front end? hard to believe, that thing is a huge hassle.
Really? I find it rather easy, although they keep changing stuff, lol.
A good CLI would be dramatically easier.
+100000000!
If the build your own controller doesn't have one, might be easy to make.
