Off-site web server talking to on-site database for small business: is it feasible?

Question

I am going to be putting a website up that will talk directly to a Microsoft SQL database that is hosted in a small office. I am debating between having the web server in the same office vs. hosting it with a professional hosting company. The trick is that the database must remain in the office because of internal software requirements.

Internet speeds at the office are 1.2 MB up / 5 MB down. Would it be feasible to have an off-site web server talk to the Microsoft SQL database in the office? I would restrict access to the database based on IP address. The website would not be high-traffic by any means.

Answer 1

Would it be feasible to have an off-site web server talk to the Microsoft SQL database in the office?

It's impossible to tell without seeing the site, but probably not, at least not on a permanent basis. Performance would most likely be horrible, and by tying the web site to the shop server, you will be making the availability of the web site depend on the availability of the shop's DSL connection. A power outage in the store would take down the web site, and the store owner's son downloading a pirated movie would slow down your app's order processing. :)

You probably should either do frequent data exports (instead of a permanent connection) from the store database to the online one, or have the database run remotely after all - it might be possible to work around the "database must be local" requirement using a VPN or something.

Answer 2

Speaking of database, I think that it is not a good idea to expose it online at all, since it seems to me from the requirements to keep the DB in office, that you are using it heavily for on-going work, aside from using it to display data on the (future) web-site. If someone hacks through into this database, it will not only harm your website, but also any other projects that depend on this DB.

Instead, you should have website use a replicated server, but never the master you are working on. I know it's overkill for you at the moment, but still, the gains in security IMHO by far outweigh a little bit of additional hassle.

Regarding the hosting issue - You should outsource the hosting, because there is less sys admin work for you - remember that if you are going to host your www site yourself, it means a 24/7 worry about availability etc.

Also, be careful with restricting the DB access by means of IP restriction only, as IPs can be spoofed. Make sure that other security measures are enforced as well.