OS X Server setup, WAN/LAN advice

[initialsBB]

Hello all. Sorry for the long post but I want to make sure I'm clear.

I'm setting up a proof of concept of sorts for an architect's small business. I want to set up some OS X Server services (contacts, calendars, wiki, FTP,...) with FileMaker Server and a CAD solution running on top. This will allow the architect's small office to be mobile, sharing and collaborating on projects.

At the moment I have a Mac Mini running OS X Server and a domain name up and running. I have a dynamic IP address from my ISP - swapping to a static solution would both cost more and reduce my available bandwidth. For the purposes of testing I can live with this as I have the Mini tweeting me it's WAN IP when I send it an email in case I'm not at home so I can edit my domain zone file. I'm still learning some python to edit a script to automatically update the zone file, but for the moment it's OK.

My biggest problem is that the cable modem/router provided by the ISP has very limited capabilities. The main problem being that it cannot forward enough ports to the Mac Mini to make all services available at once. For the last few months we have been testing either FileMaker Server or the CAD server, but not both for example.

For the moment there is no budget at all so I want to do this all from my home so that we can test everything for a few months or a year with this architect.

Here comes the part where I ask for advice. I'm going to be trying it out on my weekends anyway, but basically I'm learning all this stuff as I go along so any help and sharing of past experiences would be greatly appreciated.

In order to make the Mac Mini available to as many services as possible, I now want to switch my modem-router into bridge mode and connect the Mac Mini server directly to the internet. Using the thunderbolt ethernet adapter, I then want to share the internet connection to the rest of my LAN (a few macs, Apple TV, etc).

So the plan is:
WAN -> modem bridge -> Mac Mini Server + NAT/DHCP/IceFloor -> ethernet Switch -> LAN + Airport

I have been told this can be quite risky security wise, but I've discovered an app called IceFloor that seems to help (basically taking over the role of the router's limited firewall). I have of course searched many posts here and forums elsewhere. There is a lot of info out there but it's often just fragments. My biggest concern is the NAT part for my LAN as I've seen many people say it doesn't work, but as usual nobody complains when it does work!

Thanks for any advice, help and/or links.

 

[monkeybagel]

Hello all. Sorry for the long post but I want to make sure I'm clear.

I'm setting up a proof of concept of sorts for an architect's small business. I want to set up some OS X Server services (contacts, calendars, wiki, FTP,...) with FileMaker Server and a CAD solution running on top. This will allow the architect's small office to be mobile, sharing and collaborating on projects.

At the moment I have a Mac Mini running OS X Server and a domain name up and running. I have a dynamic IP address from my ISP - swapping to a static solution would both cost more and reduce my available bandwidth. For the purposes of testing I can live with this as I have the Mini tweeting me it's WAN IP when I send it an email in case I'm not at home so I can edit my domain zone file. I'm still learning some python to edit a script to automatically update the zone file, but for the moment it's OK.

My biggest problem is that the cable modem/router provided by the ISP has very limited capabilities. The main problem being that it cannot forward enough ports to the Mac Mini to make all services available at once. For the last few months we have been testing either FileMaker Server or the CAD server, but not both for example.

For the moment there is no budget at all so I want to do this all from my home so that we can test everything for a few months or a year with this architect.

Here comes the part where I ask for advice. I'm going to be trying it out on my weekends anyway, but basically I'm learning all this stuff as I go along so any help and sharing of past experiences would be greatly appreciated.

In order to make the Mac Mini available to as many services as possible, I now want to switch my modem-router into bridge mode and connect the Mac Mini server directly to the internet. Using the thunderbolt ethernet adapter, I then want to share the internet connection to the rest of my LAN (a few macs, Apple TV, etc).

So the plan is:
WAN -> modem bridge -> Mac Mini Server + NAT/DHCP/IceFloor -> ethernet Switch -> LAN + Airport

I have been told this can be quite risky security wise, but I've discovered an app called IceFloor that seems to help (basically taking over the role of the router's limited firewall). I have of course searched many posts here and forums elsewhere. There is a lot of info out there but it's often just fragments. My biggest concern is the NAT part for my LAN as I've seen many people say it doesn't work, but as usual nobody complains when it does work!

Thanks for any advice, help and/or links.

That would work, but it is certainly not ideal. As long as you enable the OS X firewall you would theoretically be as safe as a hardware firewall. With either a hardware firewall or the OS X firewall, the services could be exploited the same if there were vulnerabilities found in these services. There are virtually no cases to connect a computer directly to the untrusted network except ones that are serving exclusively as a firewall (Microsoft Forefront TMG, m0n0wall, roll your own linux with IP tables, etc.).

The ideal configuration would be to purchase a hardware firewall and place between them. A proper edge device should not have any difficulty forwarding services to the internal server.

 

[initialsBB]

Thanks for pointers and references. There is no real value to the data on the server during this test, so as long as I restrict the service ports to what I need then I just have to trust each software to do it's job.

Just a couple of questions to chase up on what you said:
Will my LAN be fairly protected when using NAT through the Mac Mini server (as I understand it is when using a standard modem-router)?
And what do you mean by "edge device"?

 

[freejazz-man]

I don't think combining your core services and your firewall/gateway into one device is an intelligent choice in this scenario. The solution to the lacking router is another router, not overly centralizing ALL of your services. Furthermore, you are going to find the firewall options for this to be incredibly lacking in OSX, unless you plan on getting dirty with editing the pF or ipfw configs.

Also - why don't you just use dynamic DNS to access your services instead of manually changing your zone files?

What he means by edge device is a system that sits between your network ingress and egress points - something that is almost always a router.

 

[mire3212]

Your idea is something that can be done with OS X Server, but I warn you that NAT may not work very well in 10.7+ installations.

As mentioned previously, it would be MUCH MUCH better to simply go buy a cheapo ethernet router that has a basic firewall. This provides better protection, guaranteed NAT services (you can still run DHCP from the OS X Server) and prevents the server from being exposed directly on the internet.

Given that you have no budget, again, OS X Server CAN be made into a NAT gate but test it cautiously and slowly as lots changed between 10.6 to 10.7+.

Yes, your internal LAN would be fine and protected as if you had any other router/firewall, provided no one can compromise the server externally and make it malicious (i.e. remote SSH access with Root/Administrator privileges)