mobile client outside private lan

[raypetter]

Hi

I'd rather not put the netxms server in DMZ for security reasons, but I would love to use the mobile client outside our private network.

Any input on how to achieve this would be greatly appreciated.

[Jmp_3f8h]

@raypetter said in mobile client outside private lan:

Hi

I'd rather not put the netxms server in DMZ for security reasons, but I would love to use the mobile client outside our private network.

Any input on how to achieve this would be greatly appreciated.

The mobile client uses port TCP 4701 to connect to the server. To get access you should NAT that port from the public IP address to the server in your internal network.
To have it working properly "inside" and "outside", instead of putting the IP address (Connection|Server in the settings of the mobile console) you should use a FQDN resolved properly via DNS: from external network it has to resolve to the public IP and from internal network it has to resolve to the private IP. This is the way I use it. Hope it helps.

Best regards,
Marco

[Jmp_3f8h]

@jmp_3f8h said in mobile client outside private lan:

To have it working properly "inside" and "outside", instead of putting the IP address (Connection|Server in the settings of the mobile console) you should use a FQDN resolved properly via DNS: from external network it has to resolve to the public IP and from internal network it has to resolve to the private IP.

This part should not be necessary if you don't have restriction in accessing your public IP address from inside you private net.

Best regards,
Marco

[victor]

Hi!

If your company security policy prohibits traffic forwarding from outside directly to internal network, we have experimental client proxy, which can be placed in DMZ. You can try to build it from latest sources by giving --with-client-proxy  option to configure.

Best regards,
Victor

[possamai]

I'm using a VPN connection on my phone whenever I want to use the mobile app.

[raypetter]

Thanks for all the answers. I'll try out the experimental proxy first, and NAT as a last resort.

[raypetter]

A follow up for others who face the same problem. I used rinetd to bind port 4701 from dmz to the internal netxms server.

Works like a charm.

Thanks again.