Accessing our Intranet from outside our Network - WITHOUT VPN

Question

We just upgraded our company intranet from an IIS based, ASP (poorly written) server/code base to a Windows Server 2008 r2 (Apache/MySQL/PHP) server.

The old server allowed users to login to intranet.xxx.org using there AD user/pass which then lead them to the company Intranet from basically anywhere they had Internet access.

We want to mimic that functionality (or change it to something more secure) with the new setup.

This was seemingly setup for off-site employees running on a state network. The state network does not allow VPN, therefor, we needed a way to allow those employees access to the Intranet.

So, how do we go about allowing users to login from the outside world and gain access to our Intranet?

Solution

Unless the new "extranet" (better describes your site) is accessible from a publicly routable IP you have to provide some remote access or tunneling method to get "on" to the network and then pull the site up.

That being said, you could go one of these routes...

1. Work with the state network people, get VPN access, seems like this won't happen, but you never know.
2. Utilize some sort of edge/proxy server that can sit on the public internet and relay requests to your internal server. This provides you with a true intranet site with an extranet mechanism to get into the intranet site.
3. Route your intranet site to the public network again, like it used to be... solves the problem for sure!
4. As an aside you may also want to investigate adding ADFS (Active Directory Federation Services) into the mix, this could help you out in the long run with secure tokens. Again when combined with option 2, the user would get a simple forms based login page and if successful they would get redirected to your intranet site along with a secure token so login doesn't have to happen twice. Either way, might be good to look into.

Comments

[westexasman]

That's a way to look at it... yes. However (and I just discovered this): Some of our employees are off-site, running on a state network. This state network does NOT allow VPN. Those employees need a way to access the intranet without the use of VPN. I believe that is why the above method was created.

[westexasman]

Furthermore... the OLD intranet was setup that way. The current Intranet is NOT accessible to the outside world via any means, for the time being.

[westexasman]

We utilize Forefront Threat Management... so we will be looking down that path to get this to work. Thanks for the insight!