When configuring connectors for SQL-based systems (such as Microsoft Dynamics GP or Microsoft SQL Server), Popdock offers two primary methods: Gateways and Direct Connections.
This article breaks down the layers of security that protect your data during a direct connection and explains how each component operates.
Firewall
The firewall is the most critical component of a direct connection. It acts as the gatekeeper for all communication between Popdock and your internal system.
- Customizable Security: The firewall is highly flexible. You can configure it to be as restrictive as your internal protocols require.
- Traffic Control: By narrowing the “doorway,” you ensure that only verified traffic—specifically from Popdock—is permitted to interact with your server.
Port Forwarding
Port forwarding works alongside your firewall to route traffic to the correct internal destination without exposing sensitive infrastructure details to the public internet.
- Avoid Default Ports: The default SQL port is 1433. To enhance security, we recommend using a different, static “public” port for the forwarding rule.
- What to Avoid: Do not use ports with common dedicated functions, such as 80 (HTTP) or 443 (HTTPS).
- How it Works: Popdock sends a request to your custom port; the firewall then “forwards” that request to the actual SQL port internally. This keeps your true SQL port hidden from external scans.
You can find documentation on configuring port forwarding for the Windows Firewall here.
The Popdock IP address
Since Popdock is multitenant and a SaaS (Software as a Service) product, it utilizes specific IP addresses based on your account’s server region.
- Strict Access: You should whitelist only the specific IP address associated with your region.
- Security Benefit: By whitelisting the Popdock IP, your firewall will automatically drop any connection attempts originating from any other source, even if they hit the correct port.
Data Traffic and Encryption
Popdock retrieves data by making calls to your server to request metadata and record results. This communication is never “open” or “plain text.”
- TLS Encryption: All traffic follows industry-standard TLS encryption. Data is encrypted from the moment the call is initiated until the results reach Popdock.
- The Handshake: The call travels from Popdock’s secure servers, through your firewall and port forwarding rules, to your system. The encrypted data then returns directly to the fixed outbound Popdock IP.
Other information on Popdock and Security
If you want to harden your connection even further, Popdock provides additional built-in tools:
- Popdock Firewall: Beyond your own network firewall, you can use the Popdock Firewall settings to restrict access to the Popdock interface itself. For example, you can ensure Popdock can only be opened by users physically located at your office IP.
Questions on the security surrounding Popdock direct connections? Email support at support@eonesolutions.com.
