Tell me more ×
Database Administrators Stack Exchange is a question and answer site for database professionals who wish to improve their database skills and learn from others in the community. It's 100% free, no registration required.
up vote 6 down vote favorite

The scenario is that this is a SQL Server behind a corporate firewall with your standard setup to allow only minimal outbound traffic and zero inbound. However, port 80/443 are open, per the usual allowance.

Has anyone tried, or is it possible to

  1. Connect to a remote machine port 80, say using Telnet.
  2. On the local machine, note the bound address and port [1], e.g. netstat
  3. Disconnect from telnet. Start port forwarder and listen on [1], mapped to SQL Server TCP/IP listener
  4. On remote machine, connect to SQL Server on [1]

What do you think? I just need to get some testing done and I don't want to move my huge database outside for this one-off. I am familiar with and have used UDP hole punching for NAT traversal, mainly for push to mobile phones, but am interested to know if this works with TCP as well.

References:

I am open to other suggestions.

Network topology

share|improve this question
Would this question be a better fit for Server Fault? (Just asking -- seems like more of a networking question than a SQL Server question.) – Jon Seigel Oct 26 '12 at 2:23
It could be, but maybe there are other options used by SQL Server dbas/programmers, so I'm testing the waters here first. – 孔夫子 Oct 26 '12 at 2:27
1  
You need to use VPN or DirectAccess. There is more that just the IP issue, there is also security at play. do the right thing. – Remus Rusanu Feb 23 at 8:05

4 Answers

up vote 0 down vote

This basically sounds like a reverse proxy. I was in a situation where I almost had to implement this in order to move SQL Server to a different data center in a 24/7 environment, but we used another method. Between discussions with the networking and ops teams, it should be possible but I didn't get to explicitly test it out myself to tell you my results.

SQL Server needs to get the requests on the port # assigned to it as far as SQLOL is concerned so I don't see why not, and there's an article written about doing this with a focus on the benefits of avoiding SQL injection at TechRepublic found here.

share|improve this answer
Can you elaborate on some of the finer points of that TR Article by chance? – jcolebrand♦ Oct 25 '12 at 22:11
Basically it goes through the frequency/severity of SQL Server injection attacks and how a reverse proxy would first forward the requests from the web client to that device, then that device would send the request back after sanitizing it. In their topology diagram they had the reverse proxy box hitting the web server again then having it go to SQL Server, in this case we would have it directly connect to the sql server most likely. – Ali Razeghi Oct 25 '12 at 22:48
Does that help me with my question? – 孔夫子 Oct 25 '12 at 23:16
Unless I completely misunderstood your question, that should solve it. You connect to a reverse proxy on port 80, the agent then forwards your request to SQL Server on your specified port (default port 1433). – Ali Razeghi Oct 25 '12 at 23:50
Can you elaborate on that? Consider me as a normal corporate citizen with no access to the firewall. I can't install a reverse proxy on port 80 within the firewall (SQL Server side). I need to get from remote into SQL Server behind a NAT. – 孔夫子 Oct 26 '12 at 2:17
show 1 more comment
up vote 0 down vote

Just to throw this out there, another option would be to just use PowerShell. PowerShell remoting offers the ability to make that remote connection over port 80 or 443. You just have to configure the listeners to listen on those ports.

If you check PowerShell.com there is a great PDF on remoting that is worth a read.

Once you have created a remote session and enter that session it would be as if you are local on that server. If you are working with SQL Server 2005 you could utilize SMO, then with SQL 2008 and above SQLPS or SMO. There is also implicit remoting, that is pretty cool setup.

share|improve this answer
Thanks for the response. I don't seem to get how this works, it could be my lack of understanding; but could I get you to double check you got the network topology correct? I have edited my question. – 孔夫子 Oct 26 '12 at 2:30
As you stated in your question your firewall already allows traffice inbound/outbound on port 80 and 443. PowerShell offers the ability for me to create a remote session from the PowerShell.exe console on my computer to another computer. This is similar to connecting to a web site or remote desktop session, simply through PowerShell commands. That remote computer's PowerShell service can be configured to listen for session request over a port you configure. – Shawn Melton Oct 26 '12 at 2:47
And how do I hook that up to my client APP on one side and SQL Server on the other side? – 孔夫子 Oct 26 '12 at 2:48
You would not be able to. I did not read from your question that you were wanting to do this through an application on that remote VM. Guess I did not read into your question enough to make that assumption. – Shawn Melton Oct 26 '12 at 2:53
up vote 0 down vote

Can you not just RDP in on port 80 and do what you need to do as per: http://www.iteezy.com/change-rdp-3389-port-on-windows-2008-server/qc/10098

share|improve this answer
up vote -1 down vote

You can try using SQL authentication between servers. It works for me.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.