Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

I'm planning a web application that will have its own server behind the corporate firewall. There will be two sets of users, internal and external to the organisation. Internal users will be located inside of the firewall as same as the application server and the external users are outside over the internet. All users will be authenticated via a login by the web application.

I would like a setup where the external users will be required to access whole of the application using SSL and the internal users via standard http connection.

I would like to know, if it is possible to setup a single instance the application so that it can be accessed via SSL for external (over the internet) users AND over http for internal users?

The server OS will be Windows 2008R2 and using IIS 7.5. The application will be using .NET Framework 3.5.

Thanks

share|improve this question
Could you please specify your server OS/software? (you can edit your question) – splattne♦ Mar 30 '10 at 10:37
Why not just enable SSL for both internal and external? – Dscoduc Mar 30 '10 at 15:59

3 Answers

up vote 1 down vote accepted

Yep sure its possible. Using Apache with VirtualHosts you can have different VHosts defined and they can have different authentication rules.

If you are allowing access to something from the big bad internet, best to place it in a DMZ in case someone does break into it, so they can't then break into the rest of your network.

I would further question what is the reasoning behind doing this? It would be better to have everyone using SSL all the time if they are passing around credentials. Again if the webserver is in a DMZ then the firewall between the internal users and the DMZ can transparently NAT their requests to the webserver - that is if you are worried about how to route internal users to the server.

share|improve this answer
I was just about to ask why the OP is bothering to use HTTP internally and HTTPS externally instead of just requiring HTTPS for everyone...simpler, plus protects from internal snooping of credentials. – Bart Silverstrim Mar 30 '10 at 11:11
Primary concern for using both http and https was performance degradation when using large amount of data. Do you not think this is an issue? Given that I'm using Win 2008 R2 with IIS 7.5 is than possible? – user36585 Mar 30 '10 at 13:50
Performance degradation for clients using a large amount of data is not an issue, and here is why. The SSL public-key handshake is the expensive step (hurting the server more than the client) but after that is complete an asymmetric key is established which is super-fast to process. Performance is only a problem when you have lots of clients. Lots means lots - we have small 2VCPU 2GB ram Xen guests running up to 512 simultaneous SSL connections without a problem. nginx is a high performance web server: nginx.net – giant_squid Mar 30 '10 at 19:48
Brilliant, Thanks. I will enable SSL on all sides. – user36585 Mar 31 '10 at 7:44
up vote 1 down vote

I would suggest that your best bet is to setup your web server to listen for both HTTP and HTTPS traffic, and then only allow external HTTPS traffic to go to your server. Either by restricting it at your firewall, or by having your web server only listed on port 443 on the External IP address.

To give you more specific details we will need to know what web server you are using.

share|improve this answer
+1 Definitely the simplest approach, regardless of OS or web server. – John Gardeniers Mar 30 '10 at 12:33
up vote 0 down vote

Generally, yes. Details depend on the software you use.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.