security and setup

[beany1]

Hi all,

 

Just finished setting up HAP and can access externally, basically just to see what it's like etc. Now I really want to keep it, as its great! So, having never really adventured into web accessible servers I thought I better check a few things! I did a search for hap security but everything was very specific, so hopefully this inst a repost.

 

I've setup a hyper v client Win Server 2012 R2, with firewall and antivirus, this is on the same network as other stuff. Had our ISP port forward 443 to the IP address of the server - security wise is this ok? or does the server need to be setup on some separate network somehow? With port forward does that mean the only in and out traffic is to and from the HAP server?

 

Is there any other pointers anyone has in regards to this?

[beany1]

Over 100 views and no comments! Would be nice to know if your setups are the same? Or if I'm being really stupid!

 

From what I gather as its port forward to a specific IP then traffic can only access that specific server on the specific port? and that as long as the server is up to date with AV and software firewall that the risks are minimal?

[Boredguy]

You don't have to have your HAP server on another network (as that would sort of defeat the purpose and make configuration a bit more complex). As long as you have ports 80 and 443 forwarded and followed the setup instructions you are fine.

 

Your ISP will only send traffic over port 80 and 443 to the designated IP address of your HAP server (which for us is our main webserver)

From there HAP will use NTFS to provide the security to your "user drives" just as if a user was on a PC on the network.

[beany1]

Thanks @Boredguy, I kinda assumed that, but with the amount of data now accessible externally I was a bit worried!

[nickbro]

You don't need port 80, just 443, you need to make sure it's HTTPS not http.

 

HAP+ is basically like another computer on the network, only as secure as your setup is. I'd recommend following some of the guides to lock your server down, but that shouldn't really be needed as IIS is fairly secure by default.