What is the correct way to release a site on the Internet using https?

M

Mad_runner2019-01-30 13:50:23

System administration

Mad_runner, 2019-01-30 13:50:23

There is a web service running on IIS in Win SRV 2012R2 (virtual server in hyper-v). Now they go to it on the local network at http:\\1.1.1.1/service.
I need to release it to the world, here I see and know the following options:

v1) I forward port 80 (or 1088) on the router to the IIS server. Users need to memorize some characters, the characters in the office and at home are different, if the port is non-standard then + some other icon and characters): http:\\100.120.120.101:1088/service.

v2) I get a certificate for Let's Encrypt and do port forwarding 80,443. I make an entry in the local DNS and everyone goes everywhere by the domain name: service.companyname.com

v3) I get a commercial certificate (I don’t know yet how much it costs and how to get a certificate) I do port forwarding 80,443. I make an entry in the local DNS and everyone goes everywhere by the domain name: service.companyname.com

Questions:
1) which way to go?
2) is it necessary to tighten up security on IIS and what to turn?
3) does it make sense to add another network adapter to IIS and let it out into the world?

PS maybe I wrote something wrong here, correct me I will be grateful!

Reply

Answer the question

In order to leave comments, you need to log in

2 answer(s)

Z

Ziptar, 2019-01-30
@Ziptar

1) which way to go?

In the general case, option 2, the rest can float depending on the purpose of the site and other details.
What's on the site? Authentication twist, what would be safe.
In general, you can allocate a separate server for the site, organize a DMZ, but is it necessary in your case?
Without DMZ - only if there is a big load.

I

Igor Tkhorik, 2019-01-30
@habcerga1

You can generate a certificate yourself in IIS, put only https, and add authorization to the project (well, or write a separate authorization service and redirect to the first service in the absence of the source of the first one), or do authorization using IIS. Then set up DNS inside (or make your own DNS server in windows server). After redirecting port 443 to an internal service, buy a domain and set up dns through Cloudflare.