Anyone familiar with Filemaker? Remote access in particular.

dak125

Hola,

I run a Filemaker database for my records in my office. I am able to access the machine with my laptop when I am on the same network. Unfortunately I am unable to access the database when I am on any other network. This, of course, poses quite the problem because I need to access that information when I'm out of the office.

Does anyone know how I can setup remote access to Filemaker using an outside network?

Thanks!

Kwitko

You need to set up VPN.

dak125

Kwitko wrote:

You need to set up VPN.

Thanks for the info. I came across this and I'm going to give it a shot on Monday.

Thrax

Enable web-sharing in Filemaker's sharing options. Generally it's [url]HTTP://IPADDRESS:8081[/url] when this option is enabled. VPN not necessary.

//EDIT: I'm echoing the link it would seem.

Kwitko

Seems unsafe without VPN, no?

Thrax

It's hard to say. I'm a personal hater of Filemaker's proprietary database nonsense; it's a convoluted program with a dumpy, non-relational DB design that's hard to work with. I'd not run the web sharing myself, but it's an option.

kryyst

Well buy putting a whole in your firewall at port 8081 it would mean anyone could access your filemaker program. I don't know if it requires a password or not to establish a remote connection. If it does then it's pretty secure. A vpn is essentially the same concept, they access your computer with a given username password. If it matches they then have full access to your computer.

So VPN is more secure in that it's harder to crack. If filemaker remote access through that port requires a password it's more secure because they'd only have access to filemaker.

dak125

kryyst wrote:

Well buy putting a whole in your firewall at port 8081 it would mean anyone could access your filemaker program. I don't know if it requires a password or not to establish a remote connection. If it does then it's pretty secure. A vpn is essentially the same concept, they access your computer with a given username password. If it matches they then have full access to your computer.

So VPN is more secure in that it's harder to crack. If filemaker remote access through that port requires a password it's more secure because they'd only have access to filemaker.

I'm really not sure. I'll check it out on Monday.

Filemaker was the only program that really fit our needs. I was unable to think of any other program that would allow remote access, allow customized databases, and was self-updating.

Thrax

it does require user/pass, but who knows how secure it really is?

dak125

A little help if you wouldn't mind...

I'm in the office trying to set this up and I'm having a bit of an issue. Following that 'guide' posted above I signed up for DynDNS in order to obtain a static IP. That went fine but Filemaker is still only showing the Dynamic IP address, not the static one. Meaning when I go to sharing it shows my internal, dynamic IP as opposed to the one I would be able to access from an outside network.

If I try typing the static IP in from my laptop it doesn't show there being any Filemaker databases I'm assuming because Filemaker is still only on the dynamic IP.

Any ideas?

Thrax

A DynDNS maps your EXTERNAL IP (The internet IP your company uses) to the DynDNS name, and your external IP must be port-forwarded in your router/the company's router to the internal IP of that box.

DYNDNS <---> EXTERNAL IP <---> WAN IP

It's not working because the router for your network hasn't forwarded to port 8081 on the LAN side. I, however, strongly recommend against this and seriously suggest connecting via VPN to the network, then get to it from the LAN IP

dak125

Thrax wrote:

A DynDNS maps your EXTERNAL IP (The internet IP your company uses) to the DynDNS name, and your external IP must be port-forwarded in your router/the company's router to the internal IP of that box.

DYNDNS <---> EXTERNAL IP <---> WAN IP

It's not working because the router for your network hasn't forwarded to port 8081 on the LAN side. I, however, strongly recommend against this and seriously suggest connecting via VPN to the network, then get to it from the LAN IP

I reread your post 3 times and I'm a bit confused.

You got me until the VPN portion came up. VPN has been mentioned in this thread in addition to another thread at a different forum, what is it and how do I set it up? Is it the equivalent of remote pc? I would really like to avoid running that if at all possible.

Thanks for the quick response!

kryyst

Thrax is right. You need to port forward from the external to the internal. This will allow anyone external to connect to your server at the dyndns address on port 8081 with the appropriate user/pass for file server.

But Thrax is also right that the VPN method is more secure. However The VPN method does depend on other elements of your network. Port forwarding is easy and relatively secure. However there are risks and it does cause a permanent hole in your network that could potentially be exploited.

So the right answer to your solution is does the need of creating this link exceed the potential risk.

dak125

Questions ...

1) How would one, with no real idea of how this network is setup, go about forwarding a port? Also, there is no in-house IT guy unfortunately.
2) What other elements of the network need be addressed in order to go the VPN route?
3) How would one go about assigning username/passwords for Filemaker users? I see an option for users but there is no mention of creating users and passwords.

Thanks for the continued help.

kryyst

To setup port forwarding you need direct access to the router. To setup a VPN tunnel you need direct access to the router. If you don't have that we can't help you. Furthermore if you aren't the IT guy for your company I don't feel that we should be helping you further with respects to bypassing any security measures setup.

So the only other way you could do this without breaching security the hardware would be to use himachi. Which will allow you to setup a sort of virtual VPN overtop of a firewall. It kinda works like dyndns but creates actual routed tunnels to himachi connected users. The himachi servers act as the hub to the various spokes (users) connected to it.

That's about your only choice now.

primesuspect

There comes a point when any business who is serious about their infrastructure needs to throw the towel in and hire a consultant for issues like this. Them not hiring an "IT Guy" for this is pretty sad, to be honest. You're talking about setting up something that, if done improperly or by someone inexperienced, can open you up to complete attack. They are putting their business at risk by exposing their live filemaker data (which, I am assuming is business-critical info) to the scum of the internet.

Let me put it another way: if an expert does not do this, it will end up costing them much more in the long run, because it very likely will be compromised.

dak125

I appreciate the heads up. Just to clarify this is a database I set up for my own records. The idea was to have a couple of other people that I work with access the database. I am certainly not trying to circumvent security measures or avoid the IT Guy. The fact of the matter is there is no in house IT person because a situation like this rarely, if ever has come up. There was someone that set the network up initially but that was before I was part of the organization. Furthermore the information is sensitive to only my team, I would have to contact another person in the building who is a competitor in a sense. I was just trying to get a feel for how this worked.

I set up the web enabled portion a little while ago and I'm in the process of testing it.

Thanks for the continued help!

kryyst

If all you are doing is passing info around internally (inside the same network) then you don't have to deal with port forwards or vpn's. If everyone is on the same network then you should be able to enable the web portion and then the various clients just need to point their computers to your computer's IP.

If your internal IP is dynamic then dyndns won't help. However if you are in part of a domain your computer will have a 'name' that will be registered with the domain server and the varioud users should be able to see you at that name, without needing to know your periodically changing IP.

To test this go into dos and do a 'ping -a your.machines.ip' so if your machine's ip is 192.168.1.30 do ping -a 192.168.1.30 that will give you a name and then from any other machine they should be able to do a ping name for your machine. Which they could then reach through the filemaker program name:8081 with no need for anything else.