1 2 Previous Next 15 Replies Latest reply on Apr 21, 2016 1:31 PM by user17152

    Do I need two servers?

    user17152

      Hello everyone.  The solution I develop and maintain is currently behind our firewall and not accessible from the internet without logging in to our VPN.  I am now adding shared, read-only calendars using SeedCode Subscribe that pull data from our solution.  For anyone not familiar with Subscribe, it runs on the server and requires PHP.  It essentially turns the Filemaker Server into a CalDAV server and allows the Mac/iOS Calendar application to subscribe to calendars that pull their data from Filemaker.  Google Calendar is also supported.

       

      Calendar data needs to be accessible from the internet or mobile and Google Calendar users will not have access.  My plan is to take my Dates table out of the main solution and create a new Dates database.  This database will contain only one simple table.  At this point I plan to keep the supplemental date data that we record like the date history (every date change is logged) in the main file.

       

      So, do I need two actual server machines and two server licenses, one for the main solution behind the firewall and the other for the internet-accessible Dates database?  It seems like I do.  I'm assuming there's no way to restrict access to databases hosted on the server by IP range or based on whether access is coming from the local network/VPN or the internet?

       

      I'd especially welcome hearing from any Subscribe users.

       

      Thanks!

        • 1. Re: Do I need two servers?
          siplus

          You are using a third party solution - from SeedCode - so the right place to ask such questions is their customer support.

          Our answers could only be a guesstimate.

          • 2. Re: Do I need two servers?
            CICT

            Hi Rob

             

            We've no experience of Subscribe, but depending on the firewall in use, you should be able to forward only the required TCP ports from a specified range or number of ranges of IP addresses. The VPN should communicate by default by the fact a VPN connection has been made to the network your database server is on. The issue with this approach is if you wish anyone to make the connection from public Internet connections without a VPN connection.

             

            Should you use an Internet facing server connecting to an internal server the firewall inbound rules should be set on the TCP port(s) in use and ensure packets are only forwarded from an IP address used by the external server, or possibly a dedicated VPN connection from the external server to the internal. You can also define wither the connection to each port is encrypted or not.

             

            In summary, your question "I'm assuming there's no way to restrict access to databases hosted on the server by IP range or based on whether access is coming from the local network/VPN or the internet?" should be possible but control this with a firewall rather than the database server.

             

            All the best

            Andy

            1 of 1 people found this helpful
            • 3. Re: Do I need two servers?
              user17152

              Thanks siplus, but my question has nothing to do with Subscribe specifically.  I did ask on SeedCode's forum too.  I need to host two files, one that needs to stay restricted to our local network or VPN, while the other is accessible from the internet without restriction.  I'm sure I'm not the only person who has encountered this kind of scenario.

              • 4. Re: Do I need two servers?
                user17152

                Thanks Andy!  I'm not the network guy in the office and the network guy is not a Filemaker guy, so we're both scratching our heads a bit.  Forgetting Subscribe for a moment, let me rework the question a bit...

                 

                Database A needs to stay behind our firewall.  Database B needs to be accessible from the internet by anyone.  Database A will never need to be accessed from the internet (unless the user has made a VPN connection to our network).  Database B needs to be accessible from both the local network (while users are logged in to Database A) and from the internet as a stand-alone database.

                 

                We're open to changing our network configuration as needed.  Obviously we'd like to avoid having to buy a second server and pay for additional server licenses.

                 

                Can one restrict access to individual databases by port?  I'm going to send our network guy a link to this thread and hope he understands it better.   Thanks again!

                • 5. Re: Do I need two servers?
                  mattel

                  Without remembering the specifics... you can set up a file that is accessible by different FM Server settings -- i.e.

                   

                  File --> Manage --> Security

                   

                  On Extended Privileges tab you can select whether the file is accessible by FM web direct, etc.

                  Screen Shot 2016-04-10 at 3.29.00 PM.png

                   

                  So your non public databases would likely be accessible only over fmapp -- and the user sets would be setup for that as well.

                   

                  Then the database files that were to be accessible over php or xml, etc -- could be setup that way.

                   

                  There are some ports that would need to be opened in the firewall to make it work

                  Ports used by FileMaker Server | FileMaker

                   

                  In the firewall your network guy should be able to forward those ports to your server and even allow them only from certain ip blocks -- i.e. if you have static ip's at all your remote locations and a handful of others then you could open those ports only for those ip ranges. 

                   

                  We will be setting up something similar once we implement the seedcode dayback calendar - just haven't done it yet.    

                  1 of 1 people found this helpful
                  • 6. Re: Do I need two servers?
                    dddan

                    Hi

                    If I understand what you're trying to do correctly then there might be a slightly different way to do this. I've made something similar years ago for a client but used the Froodware calendar plugin. That plugin can read and write data from FM directly to a local Apple Calendar and vice versa. The local Apple Calendar  then syncs it to iCloud, and from there anyone can subscribe to the iCloud calendar. (which as far as I know supports CalDAV, although my client only connects with iOS devices or online) In that way the team can see all appointments and events entered in their (custom) FM calendar.

                    The plugin supports multiple calendars. In FM I wrote a script that every 10 minutes checks if there are any events not yet synced (or changed after sync) and then writes/updates these events to the Apple calendar.

                    Nice thing is that you do not have to run it on a server but can also run it on a client without the need to open any ports.

                    It is your choice to dedicate an (old) mac to it, or run it on a different client. 

                    In my solution I am running it on the server (which also connects through a VPN) but since the Mac OS takes care of the iCloud connection there is no need to open any additional ports (apart from the VPN port), although this might depend on the way your VPN was set up. (I am not a VPN expert) As long as the server can browse the internet it should work.

                     

                    note: I am affiliated with Froodware, but that is not the reason for writing this. I am sure that the Seedcode solution can do a lot more/different things, but from what I read I had the feeling that what you try to do is similar to what I did for a client, but without the need to split up the solution in multiple files or extra servers, with only a cheap plugin and a couple of hours coding.

                    If I did not understand you correctly and the above will not work for you then sorry for this non seedcode related reply.

                    1 of 1 people found this helpful
                    • 7. Re: Do I need two servers?
                      user17152

                      Thank you mattel.  That's an interesting approach and one that would probably work for us.  The publicly accessible Dates database used by Subscribe only needs fmxml and fmphp access in order for mobile devices and Google Calendar to subscribe to our calendars.  No one will be logging into this database via the Filemaker client from outside the local network.  Thanks again!

                      • 8. Re: Do I need two servers?
                        user17152

                        Thanks dddan for the response!  I am not familiar with Froodware plugins and I appreciate your bringing them to my attention!  You propose an interesting solution that might very well work for us.  Our calendars are all read-only.  Scheduling, rescheduling, etc. is all handled within our Filemaker solution as pretty much all dates are validated via custom criteria by date type.  We're just looking for the ability to generate calendars that everyone can view on their desktop in a "calendar view" (ie: month), as well as from their mobile devices.  A lot of our users use Google Calendar too.

                         

                        Subscribe fits the bill perfectly.  However, the Froodware plugin looks very promising.  A few questions, if you don't mind...

                         

                        I assume the Apple Calendars can also reside on an OS X server instead of iCloud?

                         

                        Can calendars updated by Froodware be set as read-only?  I don't want anyone who subscribes to the calendars to be able to make changes.

                         

                        How does the calendar setup work?  Do you create a calendar in iCloud, then tell the Froodware plugin what to sync to that calendar?

                         

                        Can the Froodware plugin create calendars in iCloud from within Filemaker, or must the calendar already exist before Froodware can sync to it?

                         

                        We will have A LOT of calendars, ultimately thousands.  Of course no user will be subscribed to that many at a time.  Each project in our system will have a project calendar.  We currently have over 5,000 projects.  Each user will have a "my projects" calendar that shows events from all active projects for that user.  Each project event type will also have its own calendar, so there will be a "punch items" calendar for all active projects, for example.

                         

                        Subscribe handles the setup and maintenance of all these calendars pretty effectively.  I'm determining how to handle creation of new calendars now.  Either I will have the Subscribe configuration database open (without user intervention) when a new project is created and have the new calendar record created automatically before the configuration database closes...or I will have a server side script that runs periodically to check for new projects and generate the required calendar configuration records.  Either way, all of this will happen within Filemaker and without user interaction.  If I have to manually create each project calendar on the server before Froodware can sync, that's probably a deal-breaker.

                         

                        Thanks again!

                        • 9. Re: Do I need two servers?
                          dddan

                          Hi Rob if you don't mind I'll answer your questions tomorrow, it is late at night here, about to switch off. ;-)

                          You can download a demo with extensive manual and demo's from the site. www.froodware.com

                           

                          This will explain how it works for a good deal. (don't forget to backup your calendar when you play around with the demo files. ;-)

                          The plugin gives the developer a list of commands through which you can read and write data, and how you want that to happen.

                          More tomorrow...

                          • 10. Re: Do I need two servers?
                            dddan

                            I assume the Apple Calendars can also reside on an OS X server instead of iCloud?

                            Yes, as far as I know. If you use Apple Server software  you can setup your own calendars. But it is important to understand, also for some of your questions below, that if you would use the Froodware plugin, it would work a bit differently. And reading that you're going to work with 1000's of calendars I am not sure if this will suit you.

                            Thing is that the plugin just 'convert's the FM events into Apple Calendar (AC) events. Once they are in there, it is up to the user to decide how he wants to share this. This is not something that the plugin deals with, you would use the functionality of AC sharing and subscribing. The plugin allows you to create (or delete) calendars, read existing ones, but if you want to create new calendars you would have to execute that command on the computer where the plugin resides.

                            When I first saw your post it looked like you were doing something similar as I did for a client, because most people only have a couple of calendars, and do not make new ones very often. If I were you I'd have a close look at the manual of the plugin and the examples, they will give you more info if this will work for you. You can also install the plugin on multiple computers so that each workstation can read/write to it's own calendars.

                            Below my answers...

                             

                            Can calendars updated by Froodware be set as read-only?  I don't want anyone who subscribes to the calendars to be able to make changes.

                            See above. With the plugin you can decide if you just want to write from FM to AC, or also want to write new events from AC to FM. But once the events are in AC then the AC rules apply.

                             

                            How does the calendar setup work?  Do you create a calendar in iCloud, then tell the Froodware plugin what to sync to that calendar?

                            No, you can tell the plugin to create a new Calendar. Then, if iCloud (or other syncing) is set up on the computer where you created the new calendar, it will automatically be present in the Cloud. You can also 'ask' the Calendar, (but again, on the computer where the plugin resides) which calendars are present in AC.

                             

                            Can the Froodware plugin create calendars in iCloud from within Filemaker, or must the calendar already exist before Froodware can sync to it?

                            See above.

                             

                            We will have A LOT of calendars, ultimately thousands.  Of course no user will be subscribed to that many at a time.  Each project in our system will have a project calendar.  We currently have over 5,000 projects.  Each user will have a "my projects" calendar that shows events from all active projects for that user.  Each project event type will also have its own calendar, so there will be a "punch items" calendar for all active projects, for example.

                            Wow, cool project. But it is something you really need to think thru, so my end conclusion is that the best thing you can do is download the demo, manual and examples, and see if this fits what you have in mind. The toolset within the calendar is quite extensive, but I am not 100% sure it fits your purpose. I would also do a test how AC performs with 100's of calendars. 

                            PS the demo files are in fp7 format because the plugin works from FM10 up, so you just have to convert them to fmp12.

                             

                            Subscribe handles the setup and maintenance of all these calendars pretty effectively.  I'm determining how to handle creation of new calendars now.  Either I will have the Subscribe configuration database open (without user intervention) when a new project is created and have the new calendar record created automatically before the configuration database closes...or I will have a server side script that runs periodically to check for new projects and generate the required calendar configuration records.  Either way, all of this will happen within Filemaker and without user interaction.  If I have to manually create each project calendar on the server before Froodware can sync, that's probably a deal-breaker.

                             

                             

                            1 of 1 people found this helpful
                            • 11. Re: Do I need two servers?
                              user17152

                              Thanks for the additional information!  I checked out the Froodware plugin last night and it's very cool.  However, as you have also speculated, I don't think it's the right solution for us.  If we were interested in manipulating local calendars and enabling 2-way sync between Apple Calendar and Filemaker, it would be awesome!  But we really need a simple, read-only solution and Subscribe fits the bill best.  I got it working last night with our Projects table.  It automatically generates a new set of shared calendars for every project created.

                               

                              As for the server issue, according to SeedCode, the PHP module used by Subscribe to generate the calendars can reside on another server, so I can keep our Filemaker server restricted to our local network/VPN and put the PHP server on the internet.  Going to test that out today and see what happens...

                               

                              Thanks again for the suggestions!  I'm going to play around with the Froodware Contacts plugin a bit as I've been looking for a way to let users push contact data from our Filemaker solution to their Apple Contacts.

                              • 12. Re: Do I need two servers?
                                ch0c0halic

                                You can use a two computer configuration of FMS Host and Worker. Put the PHP on the Worker computer. Put the worker computer in your "DMZ" area. DMZ is an external firewall protected area that allows public access. Leave FMS in your internal network. Have IT configure the internal firewall to allow ONLY the Worker and FMS host computers to communicate across the internal Firewall.

                                 

                                Per the SeedCode docs.

                                SeedCode Subscribe lets you publish data from your own hosted FileMaker solution to iCal, Google Calendar, and iOS Calendars via a simple PHP-powered application that you install on your server.

                                • 13. Re: Do I need two servers?
                                  CICT

                                  Hi Rob

                                   

                                  Sorry for the slow response - one of those days. Your post has moved on quite a bit since my initial reply with some interesting ideas. To borrow a little from these, if you do only require non FMP external access to your database and  subject to your security policy, I see no reason as to why you'd need 2 FMS servers.   Providing port 5003 is not open on your firewall, then no FMP or FM Go clients can access your databases externally without the VPN connection.  If you allow the standard 443 port for HTTPS requests to be forwarded to your server, from memory there are one or two other ports needed for custom web publishing, then this should allow the fmxml and fmphp connections.

                                   

                                  However, if you have something like a webmail server behind your firewall, then this may not be possible, as the ports will already be forwarded to this. As suggested elsewhere you could setup a 2 server deployment to offload the web publishing,  this only requires a single FMS license. In this case you could have the web publishing server outside your firewall or on a DMZ and have the firewall forward all traffic from this server only to your database server. This should overcome any problems of selected port forwarding. Needless to say, this is dependent on your firewall in use, but is pretty straight forward to setup, say on a standard Windows firewall.

                                   

                                  All the best

                                  Andy

                                  • 14. Re: Do I need two servers?
                                    user17152

                                    Hey Andy, I wanted to just get back to you and thank you for that follow up post.

                                     

                                    In the end, the solution was two server machines, but only one FM Server.  The FM Server stays behind the firewall and the new web/PHP server is Internet accessible.  The Subscribe Engine runs on the web/PHP server.  There's a Subscribe Setup FileMaker database that is used to define each calendar setup and a PHP "engine" that essentially turns the machine into a CalDAV server pulling data from FileMaker databases as described in the Subscribe Setup database.

                                     

                                    I was able to point the Subscribe Engine to the FileMaker Server's internal IP...and it works!  Apple Calendar and Google Calendar users subscribe to publicly accessible URLs on the web/PHP server and that machine talks to the FM Server behind the firewall via the local 192.168.xxx.xxx network.  In the end, pretty easy breazy.  Subscribe's documentation is rather sparse.  It could have been better explained.

                                     

                                    Thanks again for taking the time to follow up and offer assistance!

                                     

                                    -Rob

                                    1 2 Previous Next