Sooner or later a vendor sends an email like this. “We just need a static IP and a port forwarded to the server so our technicians can support the system.” It arrives on a Tuesday, it sounds routine, and the person who receives it is usually an office manager or owner with no way to evaluate it. The vendor is friendly. The install is scheduled. Saying yes feels like the cooperative thing to do.
Most of the time the vendor is not up to anything. They are asking for the setup that has always worked for them, which may be the setup that worked in 2011. The problem is that these requests get treated as paperwork instead of decisions, and the consequences land on you. So let us translate what they are asking for, and give you a few things to say back.
What They Are Actually Asking For
The vocabulary is the barrier here, so let us clear it out.
- A static IP address is a permanent street address for your internet connection. Many businesses get an address that can change over time. A static one does not. This request is usually harmless, sometimes costs a small monthly amount, and mainly exists so the vendor can put your address on a list somewhere.
- A port is a numbered door on a building. Your public address is the building. Web traffic knocks on one door, email on another, remote desktop on another. Ports are just conventions so software knows where to knock.
- Port forwarding means drilling a doorway from the public street into one specific room. When anyone on the internet knocks on that door number at your address, your firewall walks them straight to a named machine inside your office. That is a genuine change to your building, not a setting.
- A firewall rule is written permission for a specific kind of traffic. Sometimes narrow, sometimes enormous, and the email will not tell you which.
- An allowlist, sometimes still called a whitelist, is a guest list at the door. Only the addresses on the list get through. This is one of the good ones.
Why Opening a Port Is a Security Decision
The default posture of a decent firewall is to say no to everything nobody asked for. NIST, the federal standards agency, put it directly in Special Publication 800-41 Revision 1 in 2009: “Generally, all inbound and outbound traffic not expressly permitted by the firewall policy should be blocked because such traffic is not needed by the organization.” The same publication says deny by default policies should be used for incoming traffic, and that firewall policies “should only allow necessary IP protocols through.”
A forwarded port is a permanent exception to that. Once it exists, the door is open to everyone, not just the vendor. It does not care who is knocking. Automated scanners find open doors on the public internet continuously, and the machine behind that door is now responsible for defending itself, forever, whether or not anyone is patching it.
That is the part that gets lost. The risk is not the day it opens. The risk is year four, when the vendor has changed hands, the server is two versions behind, and nobody remembers the door exists. NIST also recommends putting public-facing servers on a separate segment rather than your main internal network, which is the same instinct: if something must be reachable, do not let it sit next to your accounting data. This is the sort of unglamorous decision that adds up, which is why we argue that cybersecurity is no longer optional for mid-sized businesses.
Safer Alternatives Worth Suggesting
Here is the useful move. Do not say no. Ask whether one of these works instead. Vendors very often say yes, because the original request was habit rather than requirement.
- A VPN account for the vendor. They connect through a controlled tunnel with their own credentials instead of you opening a public door. CISA and its partner agencies recommended in their 2023 Guide to Securing Remote Access Software that authorized remote management tools “only be used from within your network over approved remote access solutions, such as VPNs or virtual desktop interfaces (VDIs).”
- An outbound-only connection. Your device reaches out to the vendor’s service rather than the vendor reaching in. This is how most modern equipment works, and it means nothing has to be opened at all. Ask directly whether their product supports it.
- The vendor’s own hosted portal. Many vendors already run a cloud service that does this properly and simply did not offer it, because the older instructions were easier to paste into an email.
- An allowlist on the rule. If a port truly must open, restrict it to the vendor’s known addresses so the rest of the internet cannot knock. Narrower is always better than wider.
- Multi-factor authentication on the account. The CISA guide recommends enabling “just-in-time access and/or two-factor authentication based on the level of risks.” A vendor login without it is a single password standing between the internet and your systems.
Questions to Ask the Vendor Who Insists
Some vendors will push back, and occasionally they are right. These questions sort the genuine cases from the lazy ones, and they are all fair to ask in writing.
- What breaks if we do not do this? Sometimes the honest answer is that a convenience feature stops working, not the product.
- Can you connect outbound instead? Ask plainly. A surprising number of products already support it.
- Which specific addresses will connect? If they cannot name them, they cannot be allowlisted, and that tells you something.
- Who at your company can reach this, and how do they authenticate? You are giving access to an organization, not to the technician you like.
- Who patches the software behind this door, and how often? If the answer is “you do,” you have just inherited a job.
- Will you confirm this requirement in writing? Requests that are habit tend to soften once someone has to sign their name to them.
Write Down Anything You Agree To
Every network we inherit has rules nobody can explain. A forwarded port to a long-decommissioned server. An allowlist entry for a company that no longer exists. Nobody removes them, because nobody is certain what will break.
NIST’s firewall guidance addresses this too, recommending that firewall policy “be documented in the system security plan and maintained and updated frequently,” managed through “a formal change management control process,” with ruleset reviews performed periodically. For a small business that does not mean a binder. It means a single shared document with five columns: what was opened, for whom, why, who approved it, and when it should be reviewed.
Then actually review it once or twice a year. The CISA guide makes the same point, recommending organizations “audit remote access software and their configurations on devices on your network.” Half of what you find will be removable, and removing it costs nothing.
The Bottom Line
A static IP is usually fine. Opening a port to the internet is a decision with a long tail, and it deserves five minutes of thought rather than a forwarded email. You are not being difficult by asking questions. You are the only party in the conversation who lives with the answer.
Ask what breaks. Offer an alternative. Narrow it if you must open it. Write it down with a review date. That is the whole practice, and it is within reach of a business with no IT department, which is one of the quieter arguments for having an IT partner in your corner.
We review vendor access requests for small and mid-sized businesses across Denton County, translate them into plain English, and negotiate the safer version when there is one. Forward us the next email you get. Contact us today.
Sources:
Comments are closed