2

I've successfully created a SQL Server AlwaysOn High Availability Group between two servers and everything seems to be working great internally. Each replica is on a separate physical location, behind different firewalls and public IPs, as well as private IPs/subnets. Right now they are able to communicate directly with each other through a site-to-site VPN.

The application that I use to access the database is able to connect to the listener's DNS. Both Failover Cluster nodes and SQL replicas have private IPs so as long as I run the application within my network, I'm OK.

The issue that I have now is that I need the application to be able from anywhere in the world. Basically, I need to be able to connect to the listener from the Internet without having to VPN in and still be able to take advantage of the HA//Failover capabilities.

How can this be accomplished? The only documentation that seems to be posted online relates to Azure which doesn't apply to my setup.

Thank you!

|improve this question
  • 4
    Please don't make your database reachable from the internet. – AMtwo Aug 2 '17 at 0:10
  • @TooManyHats, what application you want to connect from your Database. Did you configure ' Availability Group Listener' or not? – Md Haidar Ali Khan Aug 2 '17 at 5:44
  • 2
    What @AMtwo said. – Daniel Hutmacher Aug 2 '17 at 13:41
  • I got it working using port forwarding rules on my firewall but I'm nost sure if it's the "cleanest" solution or best way to do this. @AMtwo How can I allow the application access to the database, then? It's a native Windows application that gets installed on every user's laptop and most of them are rarely on premise. For the sake of security, I would prefer that they VPN in so the SQL servers are not exposed to the Internet but the other stakeholders find this solution impractical" and "unacceptable". – TooManyHats Aug 2 '17 at 17:06
4

It's generally considered a really bad idea to make your database accessible from the internet.

Making the database accessible from the public internet is a HUGE security risk. It's easy to port-scan and find publicly accessible databases. Even if you run on a non-standard port, it's relatively trivial to discover the SQL Server instance that is internet-facing. Your database would be available to anyone to exploit. It's likely that you'd be victim of every zero-day exploit, in addition to brute force attacks. Eventually, your data will be stolen or destroyed.

Take a look at shodan.io to see how easy it is to discover databases on the public internet. You will essentially have a big sign saying "HACK ME" hanging on your IP address.

Ideally, you would have a web service that the application would interact with. That public web service would be the only thing that connects to the (non-public, firewalled) database. Doing this would require re-architecting your application to use the web service, rather than a direct client-server database connection. If you can't re-architect the application, then VPN is the only secure solution.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.