Hi guys. I've got a couple of related questions for you. I'm looking into the best options for remote management of Edge Routers. We will be deploying two to very far remote clients in the coming future. It would be handy to not have to drive onsite nor rely on Teamviewer like application on the client's workstations.
I realize a VPN would be the most secure, best way to go first and foremost. A site to site wouldn't be possible but hopefully any other type would be, speed not really being an issue for this purpose. It is likely what I'll implement for this client. However for my companies purposes we are going to have another remote office where I'd like a few different options.
I've messed around with changing the web access ports, ssh ports, and telnet ports per this example here https://blog.laslabs.com/2013/04/change-webui-port-ubiquiti-edge-router-lite/
Has anyone used this kind of setup along with additional filtering of sorts? For example one of my thoughts is this: Is there a way I can specify which external IP addresses have access to the remote web gui? In my example I would set it up as the main office static ip subnet as allowable. So in theory then you'd have to be at our office or remotely connected to the terminal server onsite to then access the remote router web gui. Would this be in the wan_in firewall with those "allowed" ips in the source field? I know this isn't foolproof but you'd have to at least figure out our main office external ip subnet to gain access to the remote office router. If there are any other better ideas, non vpn that is, I'm all ears. Thank you.
Greg