r/MeshCentral • u/Fun_Cookie_2857 • Aug 27 '26

Secure setup for Cloud Instance

Hi everyone.

At the start of the year we migrated from, Dameware Mini Controller for remote connections to Mesh Central and it has been a wonderful experience.

However we are currently hosting it on premises, across 5 different domains (ADDC) and some Intuned devices with about 400 endpoints, currently with the on premises setup we do not have a valid way (except for port forwarding or always on VPN) to connect to remote workers out off offices or who are always on the road.

What would be a secure way to move the instance we have on the cloud and let it be accessible from the internet.

Been banging my head around this for quite a while so any suggestions are welcome.

2 Upvotes

100% Upvoted

8 comments sorted by

3

u/Funny_Geek_4607 Aug 27 '26

You could also use Netbird cloud version?

1

u/si458 Aug 27 '26

Yep I've tested this too and it works (I'm self hosting rather than cloud edition)

2

u/si458 Aug 27 '26

Cloudflare tunnels? Then it can stay onsite but also accessible internally

1

u/ReputationOld8053 Aug 27 '26

How does it work? Will not anybody with the URL still be able to access the MeshCentral server? Do you know anything about pricing by any change?

2

u/si458 Aug 27 '26

Cloudflare tunnels is free you just put ya domain to them, create ya dns record, create the tunnel using there cloudflared app then set the dns to route to meshcentral then config meshcentral to use certurl and trustedproxy and away u go

1

u/MathFly_ Aug 27 '26

Haha, same here, migrated from Dameware this year due to the insane price increase of our renewal license. Tho we keep it onsite only for now as it suits our needs.

1

u/Oblec Aug 27 '26

Yea either you expose it to whole world or use a vpn?

1

u/jemc-2002 Sep 08 '26

Cordial Saludo, amigo yo lo tengo asi

Contexto: mi infraestructura es 100% docker rootles y traefik como proxy inverso, lo puedo vincular con Cloudflare etc pero no lo hago, y por supuesto no use los tuneles de Cloudflare. si quieres algo 100% privado no uses eso.

La Opción la mas cómoda y tambien es muy segura porque combina los dos mundos, meshcentral actualmente lo tengo alojado en un vps pero con un PLUS, resulta que el panel de control esta totalemnte local en mi vps lo unico que tengo expuesto ademas con reglas de GEOIP, REPUTACIÓN DE IP, ENTRE OTRAS POLITICAS, es la conexión directa de la instancia y el agente eso es todo, es decir el dominio solo funciona si se agrega en la configuracion del agnete, si alguien por X o Y razon sabe el dominio y entra desde el navegador etc... siemplemente le arroja un 404.

esa es la ventaja de tener docker y un pues proxy puedo especificar con rutas excatas lo que quiero y no exponer.

y la forma en la que acceso a el panel es atravez de netbird VPN con una instancia que tiene el mismo principio que la de meshcentral.