VPN provider for static ip

[davidd]

Good afternoon,

I need a static ip solution for my remote team so each can present a static IP to access remote services.

We can't do it via isps (they are all different). So need a VPN solution.

Any recommendations?

Thanks

David

[xtruss]

I use these to get a static ip over a 5G cgnat connection - https://www.aa.net.uk/ No issues.

[davidd]

xtruss said:

I use these to get a static ip over a 5G cgnat connection - https://www.aa.net.uk/ No issues.

Thanks, they are broadband though not 5g., I can't find anything on the AA site about static ip for landlines.

D

[manracer]

Nord offer static IP

[duff-man]

Any reason not to VPN them back to your office? (if you have one and your firewall supports it) Would mean you only have to add your office IP into any of the remote services that require it.

[Haltamer]

A VPS Hosted with a Static IP address running OpenVPN would be another option; Much more maintenance effort but it could fit your infrastructure nicely depending on what's already there.

[eliot]

duff-man said:

Any reason not to VPN them back to your office? (if you have one and your firewall supports it) Would mean you only have to add your office IP into any of the remote services that require it.

Agreed.
And even with a reasonable broadband connection and using a firewall instead of the isp’s provided router you can do this very thing which i do.

[davidd]

duff-man said:

Any reason not to VPN them back to your office? (if you have one and your firewall supports it) Would mean you only have to add your office IP into any of the remote services that require it.

We are closing our office next week, so will lose the fireconnection, firewall etc.

[davidd]

I think as it is only 5 people, the dynamic addresses are quite sticky and the endpoints are azure services we manage, it will be easier just to whitelist and change when the ip addresses change.

Thanks for the input though.

D

[HantsRat]

What's the reason for them to all be on the same network if your office is closing?

[davidd]

HantsRat said:

What's the reason for them to all be on the same network if your office is closing?

There is no need for them to be on the same network. We need to access client networks, in the past they have whitelisted the external office ip, we all vpn to the office and therefore all routed out via one ip.

No office, no firewall, no single ip.

The only reason I wanted to give them static ip's was to make management easier.

Thanks

D

[HantsRat]

davidd said:

There is no need for them to be on the same network. We need to access client networks, in the past they have whitelisted the external office ip, we all vpn to the office and therefore all routed out via one ip.

No office, no firewall, no single ip.

The only reason I wanted to give them static ip's was to make management easier.

Thanks

D

That makes sense - In that case I would setup an instance in AWS or Digital Ocean. Install OpenVPN or Wire Guard then issue out logins to your staff. They can then authenticate to the VPN when needing to connect to client networks. You then only need to whitelist the 1 IP which is included in VPS plans with AWS/Digital Ocean.

Just be sure they disconnect before they start streaming all their netflix content thrugh it and you're wacked with a huge throughput bill.

[davidd]

HantsRat said:

That makes sense - In that case I would setup an instance in AWS or Digital Ocean. Install OpenVPN or Wire Guard then issue out logins to your staff. They can then authenticate to the VPN when needing to connect to client networks. You then only need to whitelist the 1 IP which is included in VPS plans with AWS/Digital Ocean.

Just be sure they disconnect before they start streaming all their netflix content thrugh it and you're wacked with a huge throughput bill.

Ah that is good advice, thanks. We'll see how this works, we'll implement a process whereby the add their ip at the start of a job (via azure) then remove it when they are finished..

[eliot]

If you have Azure already, just host a VPN server in there or Azure VPN gateway.

[Captain_Morgan]

Sorry I’m confused, can the users not receive a static ip from there isp and then have multiple IP’s whitelisted for the service?

It seems preferable to running a server & vpn software if only for simplicity.

[davidd]

Captain_Morgan said:

Sorry I’m confused, can the users not receive a static ip from there isp and then have multiple IP’s whitelisted for the service?

It seems preferable to running a server & vpn software if only for simplicity.

1. the users (my dev team) would all have to change isp, which will be painful.

[davidd]

eliot said:

If you have Azure already, just host a VPN server in there or Azure VPN gateway.

I did wonder about that but it does look horribly complicated to set up. Beyond my basic abilities, will need a devops person.

[HantsRat]

Captain_Morgan said:

Sorry I’m confused, can the users not receive a static ip from there isp and then have multiple IP’s whitelisted for the service?

It seems preferable to running a server & vpn software if only for simplicity.

Most providers don't allow static IP's unless on business plans.

[Mr Pointy]

As said Nord VPN will sell you a Dedicated IP for £3.39 a month on top of the VPN package cost:

https://nordvpn.com/features/dedicated-ip/

[eeLee]

davidd said:

There is no need for them to be on the same network. We need to access client networks, in the past they have whitelisted the external office ip, we all vpn to the office and therefore all routed out via one ip.

No office, no firewall, no single ip.

The only reason I wanted to give them static ip's was to make management easier.

Thanks

D

will your client be happy about this? We would not let you in with Nord, for example.
the control objective is that you have your own network, deploy machines professionally, have security controls in place to protect the client.

do you not have a corporate network of some kind with a proper VPN including strong authentication (non-exportable certificates, MFA, etc)?