Access from the internet

If invoiceR runs on a server in your network (for example because it has to talk to surrounding systems directly), it is initially only reachable internally. If users should also work on the road, you need a secure path from the internet to the server.

Traditionally this is done with a firewall rule that forwards incoming traffic to the server, often in a separate network segment (DMZ). This means a lot of effort for your IT, both for setup and operation. Two alternatives work without an inbound firewall rule.

Note

invoiceR consists of a frontend and a backend. Both must be reachable from outside, so you always need two publications.

Microsoft Entra application proxy

If you have Microsoft Entra ID with at least a P1 licence for the users, the application proxy is the recommended solution. Users must first sign in with Microsoft before any request reaches your network. Together with sign-in with Microsoft this gives an easy sign-in and more security than an open firewall.

How it works: a small Windows service (connector) in your own network, usually directly on the invoiceR server, opens a connection to Microsoft from the inside. Microsoft forwards requests over this connection to the connector, and the connector calls invoiceR internally.

Setting it up

1. At https://portal.azure.com, open Microsoft Entra ID > Application proxy and download the connector.
2. Install the connector in your own network and sign in with an administrator account during installation. After reloading the page, the connector appears in the portal.
3. Click Configure an app and fill in:
   • Name: freely chosen, for example invoiceR Frontend.
   • Internal Url: address under which invoiceR is reachable internally. If the connector runs on the invoiceR server, localhost works too.
   • External Url: address for access from outside, also with your own domain such as invoicer.contoso.ch.
   • Pre Authentication: Microsoft Entra ID.
4. Click Create. Repeat the steps for the backend.
5. Open the newly created apps under Enterprise applications and define under Users and groups which users or groups may access them.

Configure an app form in the application proxy with the fields Name, Internal Url, External Url and Pre Authentication

ngrok

If Microsoft Entra ID is not available or licences are missing, a similar concept is possible with ngrok (https://ngrok.com): a service in your own network opens a tunnel to the outside. With additional authentication, the tunnel can be restricted to authorized users.

ngrok also helps the other way round: if invoiceR runs in the cloud and needs to reach a system in your network (for example the interface of a local archive), ngrok forwards the requests. You can specify that only requests from certain IP addresses are accepted.

A classic VPN connection is also possible but usually means more effort for your IT.