Introduction

1. Connect to an external license server
   
2. Connect to an external repository for data or packages
   
3. Connect to websites
   

1. By opening up ports (self-service)
   
2. By allowlisting certain domains (self-service)
   

Please consult your local Support team member if you are not sure which of the two approaches is more suitable for your application of your way of working within the myDRE workspace.

You have to be a workspace Accountable or a Privileged Member to be able to open up ports or request domains to be allowlisted

Enabling external access in your workspace has implications:

Reduced auditability: data can be ingressed and egressed from a VM to external location, bypassing the standard audited myDRE workflows.

Reduced security: it is possible that (accidentally) installed services by a workspace member pose a risk.

Recommendations for reducing risks

We advise to reduce risks associated with enabling external access in myDRE workspace by taking the following measurements:

1. Inform and train all members of the workspace.
   
2. Be mindful when to use the self-service open ports feature or allowlisting certain domains.
   
3. Close ports and request removing domains from the allowlist that are not needed, they can be reopened and requested again once required
   
4. Install a virusscanner/firewall.
   

Opening up ports

This feature is a self-service for workspace Accountable and Privileged member

This feature enables you to open up ports to static IP adresses. If you want to make use of dynamic adresses, please use domain allowlisting option. Opening up ports is enabled on the workspace level, and not possible on the VM level.

Outbound ports only.

To reduce the risks associated with outside connection, only outside ports can be opened. Therefore, VMs must initiate the connection to the outside.

External services cannot initiate connection to the inside of a VM.

1. Go to you workspace and find the tab: External Access.

1. Create a new rule by clicking button Add a security rule on the left top side.

1. Fill in the details and press Add rule.

1. By default newly created rule is not enabled and needs to be turned on. 

1. Enable the rule by toggling the Enabled button next to the rule.
   
2. Review the Warning, accept the terms by ticking the box and press Turn on.
   

1. You can turn off the rule by simply by turning off the Enabled button next to the rule

Please do not create a rule that blocks access to IP 11.5.0.4 port 3128. This IP and port must remain accessible in order to ensure proper functionality of myDRE workspaces, such as domain allowlisting and connecting to virtual machines through Bastion. In the event that this warning is ignored and any bugs or issues arise as a result, it should be noted that they will fall outside of the service level agreement (SLA) provided.

Please be aware that opening ports may have potential security and auditability implications and therefroe it is important to maintain visibility of all potentially accessed rules at all times. As such, any requests to have a rule completely removed or to close a port is currently not a self-service and should be submitted via a ticket on support.mydre.org. Please include details such as the specific rule and the workspace ID it pertains to. 

1. On Windows: cmd, on MacOS: Terminal, on Linux: Telnet/Terminal.
   
2. Type ping <hostname> (for instance ping google.com).
   
3. This will return an IP address.
   
4. Be sure that the IP address does not change several times, we can only whitelist static IP addresses (IP addresses that do not change).
   
5. Alternatively, you can use the command nslookup <hostname>; This will give multiple lines of output, you need the IP address mentioned under Addresses.
   

1. There are several online tools that can find the IP address, such as Website IP Checker and many others.
   
2. Fill in the website URL and you'll receive an IP address.
   
3. Be sure that the IP address does not change several times, we can only whitelist static IP addresses (IP addresses that do not change).
   

Domain allowlisting is suitable for HTTP en HTTPS protocols but not protocols such as FTP. If you have a software or code that relies on FTP, please contact anDREa support via submitting a ticket on support.mydre.org and see further section Requesting full internet access

Domain allowlisting enables adding (sub)domains to the allowlist, but it does work URL level. For example: you are able to allowlist specifically maps.google.com or google.com but not google.com/maps

1. Submit a ticket to your local Support Team member to request domain allowlisting. Be aware that domain whitelisting is currently an optional feature and your institute might not yet support it. Consult your Local Support team member for availability. 
   
2. Specify the workspace that needs access.
   
3. Specify the domains that need to be allowlisted
   
4. Must be approved by workspace Accountable or Privileged member (e.g. departmental head/Principal Investigator) in the ticket
   
5. Once domains have been allowlisted, you will be notified in the ticket. 
   

Managing the domains being whitelisted is currently a manual action, please keep in mind that once your complete ticket has been submitted, that it might take at least one working day to handle your request.

How do I know which domains is my application using? 

1. Open your browser and go to the website
   
2. Open DevTools (usually ctrl+shift+i)
   
3. Click Network
   
4. Refresh the page
   
5. Look for the URLs for entries that are red
   

Option 3: Use a programme like Fiddler-classic (specifically for applications)

1. Download and install Fiddler-classic
   
2. Run Fiddler-classic
   
3. Run the application
   
4. Read in one of the columns of Fiddler-classic the (sub)domains
   
1. Don't allow Fiddler related (sub)domains, just look at the last few lines
5. Ensure the (sub)domains are allowed
   
6. If everything works, uninstall Fiddler-classic
   
7. Check if proxy settings are still correct
   
1. Manual proxy configurations
   

Requesting full internet access

Be aware that full internet will only be allowed when it can be clearly demostrated that options above (opening up ports or domain allowlisting) are not sufficient. 

With full internet access: anDREa B.V. cannot guarantee the Confidentiality=HIGH, Availability=MEDIUM, and Integrity=MEDIUM and the SLA that is applicable for default Workspace.

Opening up full internet access in a workspace is a last-resort option only. Your support team member will assess whether internet access is necessary

This is an outside-SLA feature. Be aware that full internet access will bring along risks if you have any data in your workspace. This is a last-resort option only if it is really necessary. Your support team member will assess whether internet access is necessary.

Requesting full internet access for a day

Please be aware that only complete requests will be handled. Requests without details below will be denied by default. Please also be aware that this is a manual and planned action for the anDREa team. Therefore, let us know at least one day in advance.

Full internet access will bring along risks. Therefore, users can only request full internet access for a short time period by following the criteria below:

Create a ticket.

1. Specify the time window and it must take place between 9:00-17:00 normal working days CET (nothing opened before 9:00, everything, regardless will be closed from 17:00 onwards).
   
2. Specify the workspace that needs internet access.
   
3. Specify the reason for needing full internet access.
   
4. Specify why domain whitelisting is not sufficient.
   
5. Must be approved by departmental head/Principal Investigator in the ticket.
   
6. The requestor must be able to invite an anDREa support member to the workspace in the role of Privileged member.
   

1. If finished earlier, immediately contact us to shut it down.
   
2. After closing internet access, you can remove the anDREa support member(s) from the workspace.

Take a good look at the External Access tab. Any rules you have created there but have unchecked boxes will not be accessible even with the full internet setting on. Please check the relevant boxes if you also want to visit those webpages. For example: You have created a rule to visit the CRAN to download R packages. You uncheck the box and you request full internet access. You will then be able to go to any webpage except the CRAN.

Requesting internet access for a longer time period

Having permanent full outbound internet might be necessary for a specific Workspace to be able to do what needs to be done. However, this increases the risk for self-installed software/applications that might egress data or receive instructions to corrupt data. Also, data can be intentionally egressed from the Workspace without an audit trail to any target that is accessible via internet.

1. Please confirm (as the Accountable) that you understand the risks described above and take full responsibility for the risk that can impact the Confidentiality, Availability, Integrity, Auditability, and Costs for Workspace [fill in workspace name].
   
2. Provide us with the details as described under Requesting full internet access for a day.
   
3. Provide us with an end-date when the internet access can be closed or internet access can be re-evaluated