Keeping some web services private and others public

Question

Not sure of the best way of achieving something...

We've got a number of web services running on asp.net v3.5 on a couple of web servers. They all talk nicely to each other and to the public internet.

Now we'd like to keep some of these web services 'private' ie make them not available to the public internet, whilst leaving others accessible.

AFAICS the simplest way to do this is simply to run the private services on a different port and keep the public ones on port 80. Our firewall only permits internet access via port 80 so would drop any requests from the internet to the private web services. Sorted... I think?

Is this idea a reasonable solution? Or is there some drop dead simple IIS mechanism that I ought to use?

Thanks

SAL

Answer 1

You can put IP access restrictions onto any site/app you want. We have several internal web services that only allow access on the 10.x.x.x range for example.

Answer 2

You can restrict access to a site via a blacklist/whitelist in the IIS control Panel (directory security tab). That's what I've done in the past to filter by IP address.

Answer 3

Besides the port, you could use the restriction for the caller (using IP address filtering, for example).

Also you could actually require authentication for the caller of a web-service, which should be easy to configure in case you use ActiveDirectory.

In any case if you have a 'public' web service, which is private as well, you may want to 'publish' it twice: once for public (with nice external URL) and one for internal, so that your other internal services and/or clients do not have to go via 'external' URL. Then you could configure restrictions (client IP, authentication, ..) differently for different publishers of the same service.

Answer 4

AFAICS the simplest way to do this is simply to run the private services on a different port and keep the public ones on port 80. Our firewall only permits internet access via port 80 so would drop any requests from the internet to the private web services.

This is exactly the approach we take. We also have a VPN so that employees can access the site if they're working remotely.

Answer 5

It really depends on how secure you want the internal web services.

If you have sensitive data on the internal web services, you need to have them on a completely different server, even if you don't allow access to them from the outside by assigning them a different port.

However, if you don't have an issue with sensitive data then assigning a different port, or IP-address, for internal and external users is a good way to go.