Opening a file server to the internet is a graded risk, not a single switch. VPN, SFTP and FTPS compared honestly.
A Cerberus server that works on the LAN tempts one quick router change - forward port 21 and share the address. That one change is the difference between a private tool and a public target. This page grades the real options honestly, from VPN safest to plain FTP never, covers the full job if you do forward ports, and includes the trial and CGNAT facts that quietly break public setups.
There is no single correct way to reach Cerberus from outside - there are grades of risk, and you should choose with your eyes open.
22. One encrypted protocol, no passive range, host key identity. A strong choice when external users or automated jobs must connect directly.990 or 21 with required TLS, plus the full passive range. Encrypted and standards based, but it opens many ports and needs certificate care, as the certificate page explains.21 with plain logins exposes every password and file to anyone watching the path. No convenience justifies it in 2026.One planning fact belongs in this page because public setups outlive experiments. Cerberus is commercial software with a trial period - stated loosely, current vendor material describes a free trial of about 25 days - and continued use needs a paid licence, with editions and prices that change over time. Do not publish an address, onboard clients or build an automation on a trial install and discover the licence question on the busiest day of the month. Decide the edition you need - features such as web client, automation and directory integration vary by edition - on the official site, before the server becomes load bearing. That is not a sales pitch; it is how you avoid an emergency purchase or a forced migration later.
Sometimes the setup is perfect and outside access still fails because the internet connection itself cannot receive connections. Many home and small office connections sit behind carrier grade NAT, where the router public address is itself private and no forwarding rule can work. The sign is a router WAN address in private ranges such as 100.64.x.x or a mismatch with the address shown by an IP check website. The honest fixes are asking the provider for a public IP, using the VPN route hosted where a public address exists, or using a proper hosted server - not opening more ports and hoping. Check this before spending an evening on firewall rules.
Whichever grade you chose, write it down - which ports are open, why, for whom, and when you will review it. Internet exposure drifts: a temporary forward for a client becomes permanent, a trial becomes production, an ex staff account stays enabled. A quarterly ten minute review of open ports, Cerberus users and log failures keeps a deliberate setup deliberate. Exposure is not a one time decision; it is a standing one.
The video builds the Cerberus server - this page decides how, and whether, that server should face the internet.
Watch Full VideoThrough a VPN into the office network, with no file transfer ports forwarded on the router at all. Users connect by VPN first, then use Cerberus on its LAN address. If direct external access is genuinely needed, SFTP on port 22 alone is the next safest option.
Your connection may be behind carrier grade NAT, where the router does not hold a true public IP address, so inbound forwards cannot reach you. Check whether the router WAN address matches your public IP on an IP check site. The fixes are a public IP from the provider, a VPN design that works outbound, or a hosted server.
You can test with the trial, but plan the licence before the server becomes production. Cerberus is commercial software - after the trial a paid licence is required, and editions differ in features. Confirm current trial length, editions and pricing on the official site for your exact needs.