0

We have a Windows server with 100+ websites hosted on it.

Some tools like whoishostingthis.com provide hosting provider's name and tools like domaintools.com provide domain names of websites hosted on a specific IP using reverse IP feature.

What we are looking for is to hide the server ip so that it can make hard for others to find the websites/domain names hosted on our server and hosting provider of our server.

We tried cloudflare.com for this. It sits between visitor and our hosting provider. So, cloudflare's dns is set to our domains which avoids exposing our server Ip. But, cloudflare is really expensive for bulk domains and their free plan has some limitations. We do not need additional features which cloudflare offers like CDN or caching.

We tried 3rd party DNS services like Amazon Route 53 or dnsmadeeasy.com, but whoishostingthis.com was still able to tell host provider's name.

What is the simplest way to achieve this? We understand that a determined person still can find these details, but we at lest want to make this task harder. What services we should search? Main concern is pricing as we have 100+ domains.

jacob wilson
  • 11
  • 1
  • 1
  • 2
  • 3
    This is the wrong way to achieve security. Presenting an IP address is how people reach your server. Otherwise you may as well just have someone else host your clients' solutions for you, which would make you an unnecessary middle man. – Mikael H Mar 04 '19 at 14:03
  • I think a good reverse proxy can do the Job. The clients will see the exposed IP of the reverse proxy and not of the server. This reverse proxy can be hosted a on different provider – Soulimane Mammar Mar 05 '19 at 05:10

2 Answers2

4

What we are looking for is to hide the server ip

Impossible. This is like hiding your phone number - and stil lexpecting others to call you. Does. Not. Work.

You can hide an IP, but you can not hide an IP and at the same time have it openly published in worldwide directories (and nothing else is DNS). Whoever tired using a third party DNS Service needs a basic course - he obviously does not know how DNS works at all. You do publish the IP, or you do not get reached. Period.

Cloudflare (or a similar proxy service) is the only possible good solution - and their free plan is IMHO pretty identical with "no solution at all", so "expensive" is really not applicable for any logic. There are better offers in the paid plan, but a proxy primarily is a proxy.

TomTom
  • 51,649
  • 7
  • 54
  • 136
1

Sure you can do that. You can hire good GNU/Linux VPS (OVH approx. $5.99 per month, not metered bandwidth), than you can re-route all traffic on ports 80 and 443 to your Windows Server with help of iptables PREROUTE chain. That way your Windows Server will receive all communication from the VPS server and will answer all web request only throughout it. Depending on your web applications this could be a limitation though, because you would never be able to see or detect your web visitors public IP addresses (they will be overwritten by your VPS server IP address during the re-routing). If what I mentioned so far is not an issue, you could go even farther in hiding the identity of your web server, by simple Windows firewall rule to drop all communication on ports 80 and 443 from IP addresses different that the IP address of your VPS server.

One of the big plus sides in this is that you are not having any speed penalties as for example VPN (encrypt, decrypt communication chattering ~30 to 40% bandwidth lose) or Reverse Proxies (except the connection overhead between your Windows Server and your VPS box but that's unavoidable in any other existing scenario).

Afterward just point your websites DNS A records to the GNU/Linux VPS box IP address.

I hope this helps.

P.S. We did this with couple of web servers and even a complete SMTP/POP3/IMAP server on dynamic IPs. Gmail and Hotmail didn't even noticed something fishy with the latter ;)

Stoyan Bukovich
  • 11
  • 2