6

I am planning to setup a small server for my office that my staff and I can access from anywhere from time to time. It will mostly contain documents and media files.

From what I researched, I'm assuming I need a NAS device and a VPN. I was also told that I may need a static public IP address. I've also read that I could use a remote desktop software like TeamViewer or Windows Remote Desktop but I'd rather access the files from a Windows explorer type interface where I can drag, cut and copy files and make new folders etc. Some of my staff aren't that computer savvy so the explorer interface is preferred.

I have an old PC that I plan to use for this setup - with new HDDs of course. It runs Windows 7 with AMD Athlon 64 X2 Dual Core 5000+ and 4 GB memory.

Before I venture into this, I have several questions which I listed below.

  1. Do I need a static public IP address? In what scenario would I need to have one?
  2. Is there any way to set it up so I could access the server files directly from Windows explorer? Perhaps an alternative would be via web browser?
  3. I have read about RAID for data backups. Is RAID 1 good enough for my scenario? Software RAID or hardware RAID?

Thank you for your time.

5
  • 2
    The first thing that came to mind when you said Windows explorer type interface where I can drag, cut and copy files and make new folders was Dropbox ! If it's only for storing media and files (depending on how big the files, Google Drive might not be a good option), it might do the trick
    – M.K
    Sep 29, 2022 at 8:11
  • 11
    Windows 7 is out of support, i.e., it won't get security updates. Do not connect a PC with an out-of-support operating system to the Internet, not as a client and especially not as a server. In today's world, the two most important features for any service available on the Internet are (a) proper backups and (b) regular, monitored security updates, and your current plan includes neither of them. Sorry to be blunt, but unless you intend to become a semi-professional system administrator in the next months, you should just purchase this service from a cloud provider instead.
    – Heinzi
    Sep 29, 2022 at 9:41
  • 6
    "I have read about RAID for data backups" You read incorrectly. RAID is not a backup solution. It is a reliability/performance solution. Plan to have proper backups. (For example: if one of your users mistakenly deletes a file RAID won't do anything for you. Also if you use the same types of disks from the same "batch" you may get unlucky and end up using 2 disks from a defective/suboptimal batch that will fail close to eachother in a RAID array).
    – GACy20
    Sep 29, 2022 at 12:55
  • 3
    Nothing personal, but I think that this might be a case where if you need to ask, you shouldn't be doing it. It's just too easy to make a mistake in protecting your private data from intruders. I can only agree with Keltari's answer here.
    – Berend
    Sep 29, 2022 at 13:27
  • 1
    In addition to Windows 7 being extraordinarily unsafe for this use, there's also a possible EULA violation in here if you have too many people using the system at once - "You may allow up to 20 other devices to access software installed on the licensed computer to use only File Services, Print Services, Internet Information Services and Internet Connection Sharing and Telephony Services." (From the Windows 7 Professional EULA.) Quick solution to both problems - install Ubuntu Server (or Lubuntu or Xubuntu if you need a GUI) and then set up things from there.
    – ArrayBolt3
    Sep 30, 2022 at 4:09

4 Answers 4

19

While the previous answers are fine, I am throwing in a cloud storage service as a possibility. Something like DropBox, Google Drive, OneDrive, etc might be a better choice, depending on your needs. Since its a cloud service, you need no hardware, no OS, its backed up and redundant. Heck you dont even need a client on the user's PC (then can access via the web). These services have the ability to control and monitor access, set up groups, etc. It can be accessed anywhere, anytime. Just some food for thought.

2
  • And, even if they did need remote access, there are still services that allow this in a robust and securable fashion, such as LogMeIn (now GoTo).
    – Gus
    Sep 29, 2022 at 13:48
  • 1
    This is the answer. Buying or building or running a physical server is a very strange and inefficient thing to do in 2022. Sep 30, 2022 at 4:50
8

Good job researching this!

Do I need a static public IP address? In what scenario would I need to have one?

It depends.

Static public IP address makes the server reachable from anywhere in the world. "Reachable" here means anyone (including malicious actors) can talk to the server. Whether the server wants to talk to them too is up to the specific protocol to handle. This means that you need to strongly authenticate your users for each of the services you run separately and each of them is a potential attack vector. This is not ideal obviously, and that's where the VPN comes in.

The VPN is supposed to be the only publicly available service on that server and take care of authentication. It will let your users connect as if they were a part of server's local network. Then all other services should be made available in that local network only. This results in users being able to use them only when they are connected to the same network physically (via Ethernet, WiFi) or through the VPN.

But there's an alternative: Zerotier, which I'm not affiliated with, but I love it.

Zerotier will essentially emulate a LAN on computers that aren't really in a LAN, but can access the Internet. It takes care of (securely) punching holes through firewalls, NATs etc. and makes things just work. You could connect your users and your server into a single Zerotier network.

Advantages of the Zerotier approach:

  • No need for a public IP
  • The server isn't exposed to the whole Internet and all evil that lives within it
  • Compromising the server doesn't put entire physical LAN at risk
  • Authentication is built-in, you don't need a VPN

Disadvantages:

  • Zerotier can have problems with double NATs (CG-NAT included) and punching through some firewalls
  • Compromising the server puts all your users at risk (entire virtual LAN)
  • Devices that don't support Zerotier (IoT? Printers?) won't be able to access the server

I'm not sure how secure Zerotier is compared to VPNs, so do your homework. In theory you could run VPN over Zerotier for additional security, but don't expect performance (or user experience) to be great.

Is there any way to set it up so I could access the server files directly from Windows explorer? Perhaps an alternative would be via web browser?

Yes, using WebDAV. The server will appear as an additional drive in the Computer view of the file explorer. Many browser-based interfaces are available too. Just to name one popular choice: Nextcloud.

I have read about RAID for data backups.

RAID is not a backup. Here's a list of things RAID protects you from:

  1. Server downtime when one disk dies and you have to buy a new one, swap it and restore data from a real backup.

And here's a list of things that it doesn't protect you from:

  1. Users accidentally deleting important files.
  2. Ransomware encrypting your server.
  3. Power spike or PSU failure frying all the drives.
  4. Someone accidentally pouring a glass of water on the server.
  5. Configuration mistake causing data loss.
  6. Another drive failing when RAID is rebuilding after a drive swap, causing loss of the entire array.
  7. Theft.

RAID only gives you uptime. You need a real backup strategy in addition to that.

Is RAID 1 good enough for my scenario? Software RAID or hardware RAID?

Don't bother with hardware RAID - or with Windows. If you want to go custom, TrueNAS is an excellent choice. It uses ZFS which is basically a filesystem with built-in RAID support. Combining these two gives it superior data integrity checking abilities that aren't possible with hardware RAIDs or filesystems stacked on top of traditional software RAID.

We don't know much about your scenario, really. Some experts believe that with multi-terabyte drives going less redundant than RAID1 is asking for trouble. The more drives you have, the more likely failures when rebuilding the array.


My advice: if you want to do this properly and not spend months becoming an expert server administrator, buy an off-the-shelf NAS. I'm a fan of the Synology hardware and their OS, but QNAP is also a good choice based on what I've heard. I've tried switching to a custom NAS once and after half a year of tinkering I ended up buying a more powerful Synology unit.

2
  • 1
    Zerotier is a VPN in every sense, even if it doesn't have a central gateway server the way "traditional" VPNs do. It's possible to route other subnets through it, e.g. the office NAS running Zerotier can act as a gateway to the office network (most likely the bigger problem will be configuring the office gateway with the opposite static route). Sep 28, 2022 at 12:26
  • I was going to recommend zerotier, until I saw you already had. So +1 Sep 29, 2022 at 23:55
4

From what I researched, I'm assuming I need a NAS device and a VPN. I was also told that I may need a static public IP address.

A NAS is just an appliance that acts as a file server. Functionally, it's not different from the office file-server that you're going to build – i.e. your old PC is going to be the NAS.

Having an office VPN server is a good idea, especially for Windows RDP and File Sharing services. (Many routers support hosting VPNs, as it's exactly the kind of network service that a router deals in... but at the same time, cheap home/office routers tend to be quite bad at it – usually a Linux server running OpenVPN does a better job.)

What you'll also need is to make sure that the office's Internet connection has a decent upload speed. Residential and small-business connections often have an asymmetric plan that's not suitable for hosting, with fast download (to the office) but minimal upload (from the office). For example, if your server is behind a 50/5 Mbps connection, all your remote employees will struggle trying to pull their files through that 5 Mbps.

I have an old PC that I plan to use for this setup - with new HDDs of course. It runs Windows 7 with AMD Athlon 64 X2 Dual Core 5000+ and 4 GB memory.

This hardware might work, but I would wipe Windows 7 from it first, rather than directly using it as a server – both because Win7 is a bit too old, and because "client" editions of Windows (even Pro) have limits on concurrent incoming SMB connections. (I think the limit is 10 users at a time?)

With something like Linux or FreeBSD (possibly TrueNAS), though, it will do the job in the beginning – it can be an OpenVPN server, and/or it can be a NAS running ZFS and Samba (for Windows file sharing).

You still have the issue of the CPU being quite old, though. It'll definitely struggle with serving files and handling multiple encrypted VPN connections at the same time. (It'll probably suck power, too.)

Do I need a static public IP address? In what scenario would I need to have one?

A public IP address, static or not, is required for a device whenever you want to reach that device across the Internet. (Though you only need one public address, for reaching the office's VPN server, and everything else at your office can be reached using private addresses through the VPN connection.)

Depending on what kind of Internet connection you have, the ISP might give you just one address that gets assigned to the office's ISP router – that's good enough if the router is configured to NAT ("port-forward") the inbound VPN connections to the actual VPN server.

(All of this is not limited to VPNs, of course, but things like Windows Remote Desktop and File Sharing should definitely go through a VPN and not be exposed directly to the Internet if you can avoid it.)

A static public IP address isn't entirely mandatory, as there are ways to automatically update DNS entries with your new dynamic IP address whenever it changes (and you definitely should be using DNS if you can), but having the server's address be static will definitely make things much easier (as well as looking more professional).

Finally, note that many VPN apps exclude the VPN server's own address from the tunnel (to avoid infinite loops where tunnel packets go through the tunnel again and again). Because of this, hosting a VPN server and a file server on the same IP address will need some care (i.e. make sure the file shares are being accessed through the server's internal VPN address, and that they're impossible to accidentally access through the public one).

Is there any way to set it up so I could access the server files directly from Windows explorer? Perhaps an alternative would be via web browser?

Over a VPN connection you can use the same Windows File Sharing (i.e. SMB) as on a local network. (Though keep in mind that it won't perform well on high-latency connections – SMBv2/v3 is much better than the ancient SMBv1 in that regard, but ≥50ms between you and the server will still be quite noticeable.)

A dedicated NAS will probably also have a web-based file browser – though it's likely that you won't be able to edit files through it directly, just manually download and upload. Though some systems may support WebDAV, which runs over HTTP but can be accessed through Windows Explorer very similarly to a SMB share.

I have read about RAID for data backups. Is RAID 1 good enough for my scenario? Software RAID or hardware RAID?

RAID is not for backups, it's for uptime/redundancy. If one disk in a mirror array dies, RAID lets you swap in a replacement disk without having to restore from backups (and without having to stop everyone's work for several hours), but if a file is deleted – or ransomware'd – there's no way RAID would save you from that.

(On that note: Desktop motherboards often do not support SATA hot-plugging the way server and NAS systems do, meaning a reboot would still be required to swap disks. An emergency reboot is when you typically discover that the server will no longer boot at all.)

Software vs hardware depends on the quality of the specific implementations available. On the one hand, a dedicated hardware RAID controller on a Real Server (e.g. from HP) will be better than Windows "Dynamic disks" software RAID – but on the other hand, ZFS software RAID will be better than a "fakeraid" pseudo-hardware RAID.

0

I am planning to setup a small server for my office that my staff and I can access from anywhere from time to time. It will mostly contain documents and media files.

More often than not, this will cause more issues than it solves.

From what I researched, I'm assuming I need a NAS device and a VPN.

NAS is an option, yes. VPN is not necessarily required.

I was also told that I may need a static public IP address.

Many headaches will be alleviated with a static IP.

I've also read that I could use a remote desktop software like TeamViewer or Windows Remote Desktop

You could but reading ahead I think the employees would have a bad time.

You can use TeamViewer or Remote Desktop for managing the server when you're not physically near the machine.

but I'd rather access the files from a Windows explorer type interface where I can drag, cut and copy files and make new folders etc. Some of my staff aren't that computer savvy so the explorer interface is preferred.

Good call. Instead of a file server you could set it up as an FTP server. Windows Explorer supports connections to an FTP server.

I have an old PC that I plan to use for this setup - with new HDDs of course. It runs Windows 7 with AMD Athlon 64 X2 Dual Core 5000+ and 4 GB memory.

This seems sufficient but I would opt to:

  • Install Windows 10 on it
  • Upgrade to 8GB of RAM
  • Apply fresh thermal paste under the CPU cooler
    • Consider upgrading to a beefier cooler instead of the stock one. I can only assume the fan is ready to die. A beefier CPU cooler could in theory cool the CPU even if the fan dies.
  • Install a new power supply. I can only assume the existing one is ready to "kick the bucket"

The Athlon 64 x2 5000+ is 16 years old now. I will be amazed if the motherboard stays alive for the next two years.

Do I need a static public IP address?

Highly advisable to have a static IP so that you have no trouble accessing the system.

In what scenario would I need to have one?

Having a file server be accessible outside of your local network is a valid need for a static IP address.

Is there any way to set it up so I could access the server files directly from Windows explorer?

Yes, the aforementioned https://www.howtogeek.com/272176/how-to-connect-to-ftp-servers-in-windows-without-extra-software/

Perhaps an alternative would be via web browser?

Yes, there are FTP plug-ins for web browsers.

I have read about RAID for data backups.

Oof, RAID is not a backup mechanism. RAID is for resiliency. You should periodically (daily) backup the files from this server onto a different storage solution.

Is RAID 1 good enough for my scenario?

If your data is not important, do whatever the heck you want.

Software RAID or hardware RAID?

It doesn't matter. Your setup isn't complex enough to realize any benefits of hardware RAID. Besides, I doubt you're willing to spend money on a proper RAID card.


Closing thoughts:

There is very little to be gained from your plan and a lot to be lost. I personally wouldn't trust your setup for even basic home use let alone office/employee use.

Strongly consider cloud storage because they have redundancy, access, privileges, speed, and version history built right in.

Your plan is less expensive in regards to hardware but you will quickly lose all your gains in the hours spent to set it up, getting employees to use it, and as soon as a single issue occurs like the motherboard dying then you're 100% S.O.L. until a new server can be created.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .