1

Bit of a noob here but I was wanting to remotely connect my laptop to a work network (specifically to access a network storage device) and came across the idea of using dynamic DNS due to the dynamic external IP of my work environment. I have read that NO-IP or dynDNS would be a good way to remotely connect.

I understand how it works but was not to sure of the security implications that are posed to it. Would the connection be secure when accessing the work network remotely? Are there any other ways to boost security?

  • I assume your workplace IT folks are ok with you rolling out a DIY solution? – surfasb Nov 23 '15 at 16:10
3

Dynamic DNS does not secure your connection, or make it inherently insecure - all it does is provide a convenient mapping between a (presumably changing) IP address and host name.

It could be argued that it slightly reduces security by "leaking" information of the machine onto the wider Internet and by facilitating a MITM attack - however this risk is really minimal if taken in the broader context.

The broader context is this:

Regardless of whether you use dynamic DNS or not, you will want to ensure that the data is encrypted in-flight and that both parties are authenticated to each other. Dynamic DNS does not substantively help with either of these things.

It would be a mistake to open a port on your router and simply let anything which knows the IP address (or domain name) connect and suck down information.

The "standard" solution to this problem would be to create a VPN and use this to bridge your remote device onto your LAN to communicate with your NAS.

There is no "one-size-fits-all" approach here, and you may be constrained or freed by the functionality of your NAS and/or router. (It is possible either or both devices will be able to act as a VPN server - if not, you will need to replace one of them, or get them to act as a client and get another device outside your network, and setting up a VPN from your LAN to it, as well as from your off-site computer.

You might be able to get sufficiently part-way there if instead of using a VPN you can get away with SCP or SFTP (which encrypts the connection and exposes an interface), or even an HTTPS connection. (If using an HTTPS connection you need to ensure you can trust it, ie appropriate certificate and possibly client-side authentication).

| improve this answer | |
  • I wouldn't say it is a "mistake" to open a port. A process would need to authenticate to suck down info. Maybe it is a mistake in cetain enterprise setting, but it is perfectly acceptable in a small business setting where time and money is too limited to setup a VPN. – surfasb Nov 23 '15 at 16:04
  • Opening a port directly to a fileserver from the wider Internet is a mistake - it facilitates MITM attacks and brute force attacks. Most systems on the Internet are scanned multiple times a day. It can also expose printers and other devices and facilitate DoS attacks. Worst of all, SMB [filesharing] data may not be encrypted (eg using < Windows 8) so can be sniffed straight off the wire. If the business is too small to afford to set up a VPN its too small to need remote access and can keep everything on portable disks. The OP was specifically interested in security concerns. – davidgo Nov 23 '15 at 18:35
  • 1
    I believe the question was in the context of Remote Desktop, RDP, and not direct connections to a file server, like SMB. IMO, portable drives are a bad alternative as it is more expensive and you have to deal with sync problems. (Do I have the latest copy?) – surfasb Nov 23 '15 at 20:50
  • @surfasb - Sorry, you are quite right. – davidgo Nov 23 '15 at 21:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.