Expressway Gui access

[silex]

I want to be able to block web admin gui access to the edge server from the internet, and only allow Lan subnets from inside the network.

Is this possible ?

[Chris Deren · Accepted solution]

That is how it normally works as Services DMZ NIC should be behind firewall and http and https port should not be allowed to it from outisde network.  

Are you NATing the LAN2 interface or did you put it on public IP without firewall?

[silex]

sorry, I didn't explain very well. Yes I have 1 nic interface with static Nat and it is in the DMZ of the firewall, Is HTTP and HTTPS  protocol only needed for Access? If so I will just block them as suggested

[parcvista]

HTTP/HTTPS are only needed for management, you may block them together with SSH.

[silex]

many thanks

[devils_advocate]

The ports required for MRA to work via Expressway are in the deployment guide.

The recommended configuration is to have a firewall between the Exp-E and the outside world. The default behaviour of a Firewall is to block everything inbound towards the Exp-E including http and https. You then just open the ports required as per the deployment guide for MRA to function. 

[devils_advocate · Accepted solution]

Agree with Chris on this, there should be a Firewall which sits between the Exp-E node and the outside world which only permits traffic needed as per the Deployment Guide.