在不配置防火墙的情况下连接到远程SQL Server

Question

I have an SQL Server located in the US, I've written a program that connects to a database on the server and takes the data from the server. The users of the program are spread around the world. The majority of them can easily use the program (ie the connection is successfully established).

But some of the users who try to run the program from inside their office building can't connect to the server because of their companies' firewalls. Since the number and location of the users is not known (the application is distributed for free with no notifications to me), customizing every firewall isn't really an option (even though it helped when I was able to do this).

I believe there should be an option like a kind of "certificate" that has to be embedded in my program and has to be registered somewhere on a user's machine that would allow establishing the connection. Or anything of that sort. Unfortunately, I haven't found anything specific in the Internet. Most probably because I googled wrong words or so.

Any help or advice is very much appreciated!

Answer 1

If a firewall (or other security device) is blocking, then there is no magic bullet. You need to avoid directly talking to SQL Server.

Even if you changed the port, many of those company workers will be limited to HTTP(S) access, and then only via a proxy.

So you need to talk HTTP to an API you provide, and the implementation of that API then talks (under your control) to the database.

This has the enormous advantage of giving you an extra layer protecting the integrity of the data in the database.

Answer 2

To build a connection you need firewall at client's place to allow access to the ip where your sql server present.

You can give a custom message to the users to allow access to the IP address of the SQL server, but it is not safe to do so due to security concerns.

Instead you can make a third application to take requests from clients and forward it to your sql server. Like some web service. Host this application on public IP and inform the clients that they need to open the IP in their firewall to run the program. It will ensure security as well as your problem will be solved.