The problem: The company I work for offers a hardware solution that is managed from a web interface that runs on a local network on a dedicated machine that we built. Because of low-level constraints, it is not possible for us to move this web interface solution into the cloud, but some of our customers do want their web interface to be reached from outside the network. Our machines already have the option to connect to a central server, publicly reachable, to report their status. I would like to extend that connection to include information on the whereabouts of the machine so users can be forwarded to it.
What solution do I need? My perfect solution would be the following: users can log in to our publicly reachable server and click on a button to connect to the machine on the private network. No further software would be required on the user's side. A browser, a click on a button, and a connection is set up to the website hosted on our machine on a private network.
What is this web server exactly? The web server is an ARM-based device running a custom Debian-based Linux. The web server software is Kestrel (ASP.NET Core) and serving a HTTPS website encrypted with a self-signed certificate. Some of the pages offer dynamic content using SignalR and websockets.
What have you researched? Well, "talk to a resource on a private network from a different private network" is something we have done before with VPN. Our issue is scalability and data use, so VPN is not preferred. The line does not have to be open all the time, only when a client wants to connect.
Another option would be TURN. This is definitely possible, although you would still have all your traffic routed through a server in the middle. It does solve the issue with exhausting IP's on a VPN.
Port forwarding and a static IP on the private network would be an easy fix, but some clients cannot or do not want to do that.
That led me to STUN, and ICE, and WebRTC. But the way I read it, WebRTC is more useful for a peer-to-peer connection while on a static page. Examples are often a chat-app or a webcam view; one element in a public website comes from a private source and a UDP connection is set up. For my solution I need to be able to surf on a website hosted in a private network, moving from page to page. As a website, TCP would be preferred over UDP.
STUN does allow me to do some TCP Hole Punching, and combined with an Apache reverse proxy on our machine I could do some port forwarding. However, I am not sure how I would forward a range of ports without limiting the number of ports available for the hole punching.
TL;DR I want to connect to a machine on a private network from any other network and access its website. There are so many options available that I can't see the forest for the trees. TURN, STUN, ICE, WebRTC, PeerJS. They are all a part of the solution I seek, but which components I should select and how to link it all together is where I can use your advice.
