Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Here is our problem:

We have several webservers, which should be reached from public. The database servers that store the data for the web apps on those webservers though shall not have a public IP.

So, since I want to be able to connect to the SQL servers using ssh for example, and those servers need to talk with each other, I had this idea:

|                |
Webserver 1      Webserver 2     Database Server
|                |               |
-------------- vLAN --------------
Workstation (my PC)

My idea was that I can connect to the vLAN using PPTP so that I have access to all servers in that LAN, but the database server remains unvisible to the public.

Is this infrastructure a good idea?

share|improve this question

You just described a DMZ. There's no need to vpn to get to this. Simple routing from the internal network to the DMZ is normally sufficient.

A typical company network looks like this.

Internet -- firewall -- dmz
      protected networks

The only time I would resort to a VPN is to access the protected networks or management services/ports on the dmz servers from somewhere on the from home.

share|improve this answer
But what do I do, when my LAN is available to quite a lot of people, that do not necessarily are employees at my company, but friends / freelancers etc? I do not want to expose my servers to my LAN so that everybody who is in the LAN can just connect to the servers. – Sebastian Hoitz Feb 23 '10 at 20:07
Well non employees shouldn't be on the company LAN. But that's another issue. You could set appropriate firewall rules for accessing the servers in the DMZ. Such as only allowing ssh from LAN to DMZ and setup the computers to only allow publickey authentication and limiting what IP addresses can access the DMZ. – 3dinfluence Feb 24 '10 at 0:26
Where I work we have a separate guest network coming off our firewall which only allows access to the internet. If you have equipment capable of vlans you should be able to put all the company network ports on a company network...maybe put a wireless AP on one too. Then put another AP and the rest of the ports on a guest network. – 3dinfluence Feb 24 '10 at 0:29

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.