Topic: Server (only) mode

[dexter]

Hello everybody!

I have some restrictions from my ISP, so I CAN NOT USE SME as Server & Gateway, becouse of some rules etc.

My connection looks like:

Inet (Cable) <> Cisco 1710 router with IOS <> Cisco Catalyst 2950 switch with WLANs and DMZ.

My question is:

It is safe to run SME in ServerOnly mode, connected directly to the Inet ???

Tx,

[mbachmann]

Depends on how you define "safe". Better to use an extra firewall before the server.

[Boris]

Cisco 17xx routers have firewall option. Is it used?
Will your SME server be used as Internet server or its conflicting with ISP rules?

[dexter]

Tx, Guys!

Yes, Cisco has IP plus SW installed and it is enabled. All I allow are ports: 80, 25, 110, 22 (from known IPs), 143 , 433 for now. For samba I must add ports 137-139 for my C-class only.


Yes, my SME will be used as Internet server (no conflicts with ISP) There is only one rule. NO NAT on server...

I am looking forward for all comments.

[Boris]

I would strongly advise you against opening smb ports through the firewall. Keep windows sharing on the local LAN only. If you need file access, consider VPN.

80, 25, 110, 22 (from known IPs), 143 , 433 (you meant 443 https:?) you can leave forwarded from Internet. Relatively safe if pay attention to what is in your "local networks"

[dexter]

Yes of course Boris, I mean https (lapsus). Yes It is safer NOT to open samba ports on Cisco Router, but I must enable access for this ports through for LAN only. Router and swith is manageable and if i close smb ports I can not access SME from my LAN neither. So I am going to allow smb from my C-class only. What do you think?

[Boris]

I am not clear on your configuration then. Is your Cisco router not your main Internet gateway? If it is and LAN is on the same subnet as SME, you don't need to open SMB ports on the Ethernet interface of the router, just rest of the ports (80, 25 etc..)for inbound access from Internet.

[dexter]

Yes, you are wright. I am also confused. The same problem was with SSH. If I DO NOT open ports (set filter) in Cisco, I can not access my SME frm my LAN neither. This is strange, but I can not manage this router my myself, so I don't know exactly how it is configured. Tx, till monday when I am going to set some new config. I will make a report on forum.