atcomsystems.ca/forum Forums VOIP Phones & IP PBX Networking Port forwarding and security

Often we install systems that can be connected to a network, then, after forwarding a port to a LAN IP address, they can be remotely programed. Sometimes I just do it myself, but if another company handles the network, then I have to go through them...

Most of the time, I have no problem getting cooperation from the network administrators when it comes to this, but I have had some that hem and haw about doing it (If they think we are bad about being secretive, we have nothing on some of them!)

Anyways, I was wondering, am I really creating that big a security risk by forwarding a port to an inside IP address?

ESI uses the same port forward procedure and yes the CG's can get very territorial. When I get flak I just tell the customer little things can be done cheap and quick via remote access. If I can't have remote access then trip charges and hourly minimums will still apply to the smallest details.

Money Talks and BS Walks!

In most cases, if the network people have done their job and set up everything properly, the answer is no. Unfortunately even when this is the case, some people do get too teritorial. I suspect it has to do more with the fact that you are a) an outsider not on their "approved" lists and b) this question: remote telecom maintenance? why should I care?

As Phone systems become more & more IP, you will experience more & more resistance from your customers CG vendor.

The CG is the ultimate control freak, they work in a cloud of smoke, their biggest fear is that the blue collar telephone vendor will blow away their cloud & reveal that the CG was not what he pretended he was.

I've lost several IP system quotes due to chest thumping 3rd party CG companies.

"hey you... get off of my cloud".

No you are not creating a security risk.

What most network admins don't grasp is the fact that most reputable telephone system manufacturers don't use a Windows or even Unix operating system; proprietary operating systems are notoriously difficult to hack. It also tends to tick them off when they can't get in and 'reverse engineer' things for their own use.

I LIKE this topic and DESPISE the situation. JBean, can I call you as a backup? :rofl: I have given them the exact information and was met with angry eyes!

1st rebuttal :
"You're creating a hole in my system, no way!"

They really, really don't understand that the uneducated users, on their machines, on their own network create the highest risk!

I agree, when the CG try's to pull the security issue, I have to laugh,

Like that $60 firewall you bought in staples is really defending your network.....

Like anyone would have the time or inclination to even bother to try hack into your network anyway.

Like billy in accounting IM-ing his buddies & sneaking a look at some lunchtime porn isn't a security risk........

Thanks for the response guys. You've definitely confirmed my opinion about the company that I dealt with who brought this on.

What they talked the guy in charge into doing was opening the port on an as-needed basis (charging a fat fee for doing so no doubt).

Ah well, I can only do so much, but I can say that I installed the office administrator on one of their computers (it was a DSX).

I'll have to remember that response, and the one about proprietary OSs too!

Another idea... if you want to have access on a "per-call" basis. You could install something like UltraVNC on a computer at their site, which has the admin program installed too. Then, whenever they need a change, they only have to open the VNC and you can connect to them - when you're done, close it. Keep the CG out of the situation all together and the $ outta his pockets and in the customers. There is no reason the customer should be paying twice per service call, that's BS!