You have not specified how/if NAT is being done, or if you just MIP/Full-Translate the static IP onto the dedicated or...
Well, roughly, this is how I would do it (Scroll down for ASCII diagram love <3)
.-,( ),-.
.-( )-.
( teh internets )
'-( ).-'
.-----'-.( ).-'----.
| |
| |
__v___ __v___
LAN Line |_ooo_x| |_ooo_x| Dedicated Server Line
| |
| |
[69.70.2xx.21] [75.120.1xx.37]
| |
| |
| |
'-->eth0 eth1<--'
............................. _*______*_ ...........................
. .-------eth2*.[_...__...o]*eth3 -------. .
. | . ROUTER/SW . | .
. | . . | .
. [192.168.1.0/24] . . [172.16.32.0/24] .
. | . . | .
. | . . | .
. v . . | .
. ____ __ . . | .
. | | |==| . . | .
. |____| | | . . | .
. /::::/ |__| . . | ____ .
. ____ __ ____ __ . . v |====| .
. | | |==| | | |==| . . eth0*| | .
. |____| | | |____| | | . . | | .
. /::::/ |__| /::::/ |__| . . |____| .
. . . .
. Local Network . . Web Server .
............................. ...........................
[vlan1 - LAN] [vlan2 - DMZ]
.----------------------------------------------.
| Abstract Routing/Vlan device Config |
| |
| 192.168.1.0/24 => NAT on 69.70.2xx.21 |
| |
| Full NAT/Mapping: |
| 75.120.1xx.37 => MAP to 172.16.32.X [Server] |
| 172.16.32.X => NAT on 75.120.1xx.37 |
| |
| Route LAN => DMZ traffic |
| 192.168.1.0/24 => 172.16.32.0/24 |
| (filtered, ex: TCP DST 22/80/443) |
| |
| Deny outbound DMZ => LAN traffic: |
| 172.16.32.0/24 =>X 192.168.1.0/24 [DENY] |
| (except related) |
'----------------------------------------------'
Do note that you may substitute ports for VLANs, and replace the mythical router-like device in that schema with a combination of multiple routers/NAT devices and switches/VLANs. But this is the generic idea. I would probably go for mapping/full NAT instead of adding an extra NIC to the web server to route back into the LAN.
Filtering the traffic is also nice -- allows /some/ access to the DMZ from your local network, which is the entire point, and prevents the web server from directly accessing your LAN. Useful, in case of break in.
Possible alternatives for mythical router-like device:
.---------------------------.
| Multiple NAT Devices |
| (Requires Router Switch, |
| or extra Router) |
'---------------------------' .-,( ),-.
.-----------------------> .-( )-.
| .--->( interwebs )
69.70.2xx.21 | '-( ).-'
| 75.120.1xx.37 '-.( ).-'
| |
__________ __________
.->|____oooo_x| |____oooo_x|<---.
| LAN Line Server Line |
| (NAT) (NAT) |
| |
**|**************** ******************|
192.168.1.0/24 __Managed Switch____ 172.16.32.0/24
* '--------[_::::::::::::::::::x]--------'
* ^ * * ^ *
* | * * | *
*LAN VLAN****|***** ******|**DMZ VLAN*
| |
| __________ |
'-[_...__...x]--'
route/filtering
192.168.1.0/24 <=> 172.16.32.0/24
That scenario implies the machines in each VLAN have a route for each other's subnet, and each VLAN's NAT device is their respective's default gateway.
Or if you actually have a "real" edge device (which would be very nice):
.---------------------------.
| Simple NAT Device |
| + ASA/Edge Firewall |
'---------------------------'
.-,( ),-.
.-----------------------> .-( )-.
| ( interwebs )
69.70.2xx.21 '-( ).-'
| '-.( ).-'
______ ^
.--->|_ooo_x| .--------'
| LAN Line |
| (Office NAT) 75.120.1xx.37
| |
192.168.1.0/24 |
| _[Out Int.]_____
******|************* [_...________...x][DMZ Int.]
* ___|__________ * ^ [In Int.] |
* [_::::::::::::x] * / | ************|*******
* Switch ^ * / | * 172.16.32.0/24
* '-------192.168.1.0/24----' * _ | *
* * / * |=| | *
*LAN VLAN*********** / * |_| v *
/ * Web Server *
.--------------------------------------. * *
. route/filtering . ***********DMZ VLAN*
. on Edge FW, between In and DMZ .
. 192.168.1.0/24 <=> 172.16.32.0/24 .
. (Previous pseudo-rules/routes apply) .
'--------------------------------------'
Or if your server really is directly connected with no NAT whatsoever (better have that filtering up and running on it):
.------------------------------------------------------.
| Single Office NAT + |
| Server w/ Direct, Routable IP |
| (Requires second NIC, and a lot of manual, |
| separate, OS-specific filtering done on the server) |
'------------------------------------------------------'
.-,( ),-.
.-----------------------> .-( )-.
| ( interwebs )
69.70.2xx.21 '-( ).-'
| '-.( ).-'
______ |
.----->|_ooo_x| |
| LAN Line |
| (Office NAT) 75.120.1xx.37
| |
192.168.1.0/24 |
| |
******|************* v
* ___|__________ * eth0
* [_::::::::::::x] * __
* Switch ^ * _______ |==|
* '--192.168.1.0/24--|___|___|---eth1| |
* * |_|___|_| |__|
*LAN VLAN*********** Firewall Web Server
(On server)
.--------------------------------------------------------------------.
. "pseudo DMZ" enforced by fw rules on Server. .
. No routing required. Defeats the entire point, too. .
. Attacker on Server can potentially alter ruleset and poke at LAN. .
'--------------------------------------------------------------------'
However that's not very nice, security-wise. Feel free to combine scenarios. If you require more details, feel free to ask, too :)
Hope this somewhat helps. Also, had been a while since I had done ASCII graphs. Much fun was had here :D