remote workers during COVID19 need help please

[xicor]

Hi All

 

I need to give my staff a static IP to enable them access to Office 365, our office 365 is setup to only allow access from specific IP's, so far I've tried to use a VPN using "Perimeter 81" but it seems the laptops I have for staff although new they are struggling and also with the VON usage and their slow home internet its becoming almost impossible to use, so I need something like a smart DNS provider that masks the home IP's of my staff, is there anything that does that ? by using a smart DNS their internet speed will not be effected and I can whitelist a single IP on O365 but I can't find anything useful online most of the smart DNS I'm finding is for personal use and most of them are for people wanting to use netflix etc

 

I can't use my own vpn as I neither have the bandwidth onsite nor will it solve the slow connection issues, any advise is much appreciated.

[MartinRouterKing]

Turn off the allow access from certain IP’s? Easiest option.

[xicor]

I can't do that, we were recently under an attack just before the COVID-19 and so it was decided to restrict access only from authorized IP's

 

 

Turn off the allow access from certain IP’s? Easiest option.

[mavhc]

Can't you just also add their single IP address?

[highsky]

If you in education environment why don't you assign them the faculty office 365 licences, named or group based?

From the azure portal

[xicor]

they are working from home and their ISP changes the IP regularly its not practical to update the exclusion list regularly

 

 

Can't you just also add their single IP address?

[xicor]

this wont solve the issue, we also need to make sure they are using school laptops not their personal ones, I was thinking of a combination of intune and azure conditional access but that's too expensive as it requires both an intune license and azure premium which isn't part of the faculty license, its not even part of the A3 license

 

 

If you in education environment why don't you assign them the faculty office 365 licences, named or group based?

From the azure portal

[synaesthesia]

What was the attack vector? In these circumstances, frankly I think it's a no-brainer to allow access across the board and relax those restrictions. Beef up security otherwise - better password policies, account lockout etc. Otherwise maybe get them to install VPN software to remote into school beforehand using whatever VPN capability your ISP/router provides. There's only so much you can do.

[ricki]

I can't do that, we were recently under an attack just before the COVID-19 and so it was decided to restrict access only from authorized IP's

I think you can set access to office from specific county's only. It's not a permanent solution but may be a get round Richard

[mavhc]

I'd use duckdns to provide fqdn for each computer. If you want to make sure they're only using school laptops however you need certificate based VPN

 

Luckily VPN is built into Windows, so don't need to install extra stuff

[SimonHooker]

Using a VPN is really the simplest option. I recently set up an AWS EC2 instance with OpenVPN installed via https://github.com/angristan/openvpn-install with an Elastic IP to provide a static IP for staff access while working remotely without being tied to the office IP / connection. The limiting factor becomes the member of staffs broadband connection, and the cost is relatively low depending how large an instance you go for. It does require a small client to be installed, however it works and is fast enough. I've even had a decent enough connection to play games when I forget to disconnect it. Also works on any device, be it Windows, OSX, Android, iPhone etc

 

Of course it doesn't need to be an AWS instance - any server will do - but by hosting it on an external/cloud provider you remove the bottleneck you may have if it's hosted on-premise somewhere.

Edited March 31, 2020 by SimonHooker