I use ngrok (https://ngrok.com/) at work to be able to access my computer from home (We also have a VPN but I get errors) using :
ngrok tcp 3389
It works perfectly, but I was wondering how secure it is. Do I risk compromising the security of the company?
There are at least 2 aspects of security here:
encryption of the traffic running over the ngrok TCP tunnel.
authenticating access to the ngrok TCP tunnel.
For encryption, a ngrok TCP tunnel forwards raw TCP and does not encrypt your application's packets. One way to encrypt your traffic is to have your RDP server and client negotiate an encrypted connection (for example over TLS).
For authentication, ngrok provides IP Whitelisting for ngrok TCP tunnels.
Related
I have a server that has a web server on it. I have setup wireguard vpn between me and server.
Do I need to serve my web server with https for security or wireguard is enough?
You should be fine as long as your web server is listening on the Wireguard interface only (i.e. it is bound to the IP address of the Wireguard interface) so that it is not reachable from outside the VPN. You do not technically need to wrap everything in another encryption layer such as HTTPS, as the only way to establish a connection to the web server is through the VPN, which already provides encryption and authentication.
Beware though that VPN + HTTP does not offer exactly the same security features that VPN + HTTPS does, there are some subtleties. For example, in case your private VPN key is leaked, it could be used to perform a Man-In-The-Middle attack on your connection, whereas using VPN + HTTPS a potential attacker would also need to break through HTTPS, which means either getting privileged access to your machine (since a new private key is generated by your browser on each TLS handshake) or a way to forge a valid CA-signed certificate for your web server's domain (generally not possible). Whether or not you care about this additional layer of security is up to you really.
I setup an EC2 instance (Amazon Linux AMI) to host a Docker API (Flask application with Python). The application is running on port 5000. Using my local PC (which is remote), I am able to hit the API with a browser (i.e., http://ipaddress:5000/), and get the "Hello, World!" response. The issue is that when I do the same thing on another computer (my work computer), I get a connection refused error.
In the security group for the instance, these are my inbound rule settings (I know this isn't secure, it's just a Hello World example):
HTTP (TCP): Port 80, allow 0.0.0.0/0, ::/0
SSH (TCP): Port 22, allow 0.0.0.0/0
Custom TCP Rule (TCP): Port 5000, 0.0.0.0/0, ::/0
The question: Why is the firewall blocking one remote computer and not the other?
The problem: Corporate firewalls will often set outbound rules that limit which ports you can access from websites outside of your organization.
The solution: Since Port 80 is a common port used for web servers, corporate firewalls (generally) don't block outbound traffic to these ports. Therefore, I was able to fix this problem by deploying the AWS API on Port 80. Then, I was able to connect to the API from within my corporate network.
I am not a system administrator or network administrator thus I having hard time trying to figure it out a work around to support IPv6 on an Azure Service Fabric Cluster without using the Load Balancer.
From here: IPv6 support for Azure other than the load balancer thing
I have checked that IPv6 is only supported by that lb appliances but the entry point of my current cluster is an application gateway.
Is there a recommended work around for adding Ipv6 support for using a Azure App Gateway
Is there a recommended work around for adding Ipv6 support for using a Azure App Gateway
There is no nice way to do that, only work-arounds.
Anyway, you can do the following:
instanciate an Azure back-end server,
configure this server to establish an IPv6 over IPv4 tunnel to an IPv6 public tunnel broker,
install a reverse-proxy on your back-end server, listening to an IP address chosen inside the IPv6 prefix offered by your tunnel broker,
configure this reverse-proxy to translate the accepted IPv6 https connections into outgoing http or https IPv4 requests to your Azure app gateway (the connection stays inside the Azure network, so you may accept not to encrypt it, using http instead of https).
But this will not be very efficient because:
1- this is your back-end server that will terminate and decrypt ssl connections;
2- IPv6 packets from/to your servers in Azure will go through your tunnel broker and Azure, you will not have direct connections between the clients and Azure.
To find a free IPv6 tunnel broker, see for instance Hurricane Electric.
Can we ignore SSL verification for local network. My case is-
I have two applications deployed in a system. These two applications cannot communicate through internet, due to some security constraints. the two applications can communicate using their private IPs. But the certificate issued by CA is valid only for the public IP (accessible from internet), so when they tries to do a HTTP connection, it throws a Subject Alternative Name invalid exception.
I cannot use alternate certificate.
Please suggest if we can configure Java / JREs of the applications to ignore SSL validation?
Please suggest any alternate solution, if any.
It sounds to me like you might just be better off using HTTP on the local network.
If you need transport layer security on your LAN, you can probably use a VPN or SSH tunnel instead. And it sounds to me like you don't really need this, as you're OK with ignoring SSL handshake errors, which makes using SSL in the first place kind of moot.
You can set up your servers to listen on two ports, one for external requests over HTTPS, and one for internal requests on HTTP.
You can either set up your firewalls so that HTTP is only available from LAN IPs, or alternatively only listen on localhost and use a VPN or SSH tunnel to the target server and do the requests via the tunnel.
Is there a way to have endpoints which allow protocols other than TCP or UPD. For example Protocol 50 / ESP - the protocol for native IPsec. I would like to be able to hit the "outside" edge of one of my public ip addresses with this protocol.
At this time only the TCP and UDP protocols are supported for Microsoft Azure virtual networks. You can however create a point to site endpoint using VPN; this requires you to download an agent on your client machines. Check this page for more information.