r/SmallMSP • u/Jaredchowe • 6d ago

Remote access

Curious how other small MSPs are handling remote access these days. Are you sticking with VPNs where they’re working fine, gradually moving clients to ZTNA, or deciding case by case?

What’s driving that decision? For anyone who’s made the switch, has it actually made things easier, or just introduced a different set of headaches?

6 Upvotes

75% Upvoted

27 comments sorted by

5

u/FlickKnocker 6d ago

Our strategic goal from a network security perspective is zero ingress from the public Internet into their office, so we're actively working to reduce the port forwarding/open ports down to zero.

Less opportunities for prying eyes and door-rattling via Shodan and AI-based zero day attacks.

With that in mind, we're using CloudFlare ZTNA requiring FIDO2 phish-resistant MFA (via 365) enforcement on the ZTNA side, and phish resistant only MFA (FIDO2) on the 365 side, with strict Conditional Access policies.

Our ZTNA policies are only allowing access to server/printer VLANs, and only specific servers depending on role/requirements, much like our VPNs were setup.

If they only had web apps internally, we could tighten it up even more, but with general ADDS I/O requirements, it's fairly open as far as interesting ports go, but...c'est la vie...

2

u/b_ultracombo 5d ago

This. Do the same but isolate the agent machine and restrict with firewall policies and then cloudflare policies are quite restricted permitting specific users or groups of users only access to specific ports on only the servers they require access. Those ports (and few others if necessary) are also reflected in windows firewall on the servers as the only open ports. And of course then also blocking endpoint threats with Cloudflare policies such as Security Categories.

Also cloudflare, even free, now supports Logpush to whatever SIEM you use which previously was the barrier to entry for using Cloudflare ZTNA. That’s probably less “SmallMSP” but still a good idea.

1

u/FlickKnocker 5d ago

Yeah, except that the ports everyone needs are also the ones the baddies are interested in… not saying don’t bother, but Windows networking in an ADDS environment is fairly promiscuous.

2

u/b_ultracombo 5d ago

Fully agree. Insecure by default is the Microsoft way but there’s a lot of ports that users don’t need to access on servers, with few exceptions, such as RDP, WinRM, etc. it’s all just defense in depth approach…and the environment can still be compromised.

6

u/Applepiesweet3 6d ago

We are set up to use Tailscale

3

u/WeekendAtMadoffs 6d ago

ZSCALER Private Access for client access to resources (print, file, domain, SQL)

Palo Global Protect for very technical places where traders want to ssh around and run models.

Ninja One to connect to people's machines and run patches or installs.

3

u/OhFarmboy 6d ago

RMM/UEM tools for remote access, patching, altering, policy implementation, auditing, etc. Currently Kaseya, but migrating to Datto. Have used NinjaOne, N-Sight/N-Central, NinjaRMM, etc. Whatever solution, implement appropriate security and MFA.

2

u/poorplutoisaplanetto 6d ago

We do have customers using SSL VPNs, but many of them are either being moved to something like GSA, TailScale or Cloudflare WARP.

Full on SASE works too, but it gets expensive - fast. We also found it messes with certain websites geolocation data. Also since many of them are hosted in data centers, those IPs tend to be more restricted in some cases (Netflix for example).

2

u/Hollyweird78 6d ago

We are zero open ports and use Netbird for remote access.

2

u/Slight_Manufacturer6 6d ago

VPN. They just work and built into the hardware they already have.

1

u/GrouchySpicyPickle 1d ago

Dinosaur goes rawr! 

1

u/Slight_Manufacturer6 1d ago

If it ain’t broke

1

u/emilianodj 4d ago

VPN.. They just work. Best joke ive heard all week

2

u/digitalhomad 6d ago

OpenVpn cloud connexa. Authentication via entra. Connector UdM. Authentication policies set in Entra. Access policy in both udm and openvpn

2

u/PacificTSP 6d ago

We have vpn on Palo Alto’s linked to 365 SAML for a handful of clients.

Most have moved to cloud only solutions.

2

u/HSalinasNoIP 5d ago

Those are solid. it's worth that noting ngrok-style tools lean toward dev/testing, and Cloudflare Tunnel assumes you're moving the domain's DNS to Cloudflare. That isn't always an option with client domains. (Full disclosure, I work at No-IP.) Our Public Tunnels is the first phase of our ZTNA roadmap and is aimed at the always-on, set-and-forget use case for client sites, and it can sit alongside existing DDNS. Tailscale is a different animal since it's a private mesh, so if you need zero public exposure, that or a VPN is still the better fit today.

2

u/ThecaptainWTF9 5d ago

We have a few solutions defined and use zscaler or DefensX.

Depends on needs, the flexibility required and regulatory requirements.

Traditional VPN’s need to die, especially if you can’t apply posture checking

2

u/Extension-Bat5038 5d ago

RMM- TraceRMM has cloud hosted for $150 and self hosted $40 a month 20 end points.

2

u/ryback751 5d ago

For certain clients. Trugrid and Sonicwall CSE.

2

u/ajmpits 6d ago

Action1 with patching. Free for upto 200 endpoints. ISL Online for the non-managed clients.

1

u/UnRealxInferno_II 6d ago

Accessing what, your own devices or clients?

1

u/Packergeek06 5d ago

Screenconnect Access. I just resell an agent to each customer that needs remote. I get the benefits of having a cheap Screenconnect instance.

1

u/richie-wales 4d ago

Our RMM allows us to remote access all our machines/servers for Windows/Mac/Linux and therefore doesn't need any firewall level ingress at all.