Opening ports for syncronization

[rphips]

Good day

I don't know if this question belongs here but here goes.

I have a program that needs to syncronize over the web. The problem is the routers on the customers end.

The program will syncronize when the router is unpluged(bypassed) but the customers believe doing this is a security risk.

What I need is the ability to open a port on the router(unknowns) and do the syncronization then close the port.

Is there anyway of doing this securly.

bob

 

[pansophic]

If the router is unplugged, how are you getting to the net? Or do you mean that the filter rules are turned off?

The customer is absolutely right that bypassing filtering rules is a seurity risk, but the question is always, how much of one?

What ports do you use for communication? If you run your server on a standard port, it shouldn't be any problem to implement a rule that allows their machines on any ephemeral port (assuming that you use dynamic port allocation on that end) to connect to your machine on that port.

But some companies just have so many of these niche "pin hole" requests, that they are concerned with their filtering rules getting too large (they really do slow a router).

Depending on the situation, you may want to use a static port that is already allowed through their filters, like 80 or 443, but that can cause another set of problems when you are using a "well known" port for a non-standard purpose.

If you are using ephemeral ports on both ends, you are generally just SOL. That really is just way too dangerous to allow any source port to any destination port.

I am also assuming that you are having the program on their end connect to your server periodically, not having your server contact them autonomously. I would be really hard pressed to ever allow a vendor to connect into my network. I am much more comfortable when my machine initiates the contact. Not that it is really all that different, it is just more common to block everything incoming except what is destined for a DMZ. And then filter outbound requests as needed.


pansophic

 

[Xemus]

rphips,
what program is it? Almost every program runs on different ports and knowing which program it is will help to ID the port you need.

http://www.closedsocket.com

 

[rphips]

Hello Just back from christmas break
Thanks for answering me guys

Its a new program and how it is used - salesman connect up via modem, DSL, or High speed Internet (which ever) and syncronize thier data. the problem is it doesn't work unless we disconnect the routers. Can anybody explain how the live updates manage this.

bob