Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Web developer here who has to occasionally wear a system & network admin hat (small company). We currently have a single hosted server running Windows Server 2003 that runs both our web server (IIS/Coldfusion) and our database server (SQL Server 2008). We lock down the SQL server by allowing only specific IPs to connect to it. Not ideal but it's worked thus far.

We're moving up to two distinct servers and I want to take the opportunity to 'get things right' and make only the web server face the public. What I need to be able to do is to allow only a handful of people to connect to the database server.

Rather than using an IP allow list, I'd prefer to use a VPN to let people through so that access is based on the user and not simply the user's location. I'm leaning toward something like OpenVPN, just so I can stick with Server 2008 Web edition. Do I:

  • Use the web server as a VPN server and set up the database server to only accept connections from the web server? Is there an extra step required to make connections to, say, route through the VPN rather than through a different connection? I'm ignorant of this part of network infrastructure stuff. Or,
  • Set up a VPN server on the database server as the only public-facing server connection so that there aren't any routing issues to deal with?

I know this is Network 101 stuff but I thought I'd ask before just blundering through it since it could affect the company a bit. Thanks very much!

share|improve this question
up vote 0 down vote accepted

I'd move VPN to the firewall (any basic cisco can handle this just fine)

Setup two zones, your "Secure zone" which contains your database & backend servers, anything that stores private or sensitive information.

Then your DMZ for your webserver(s). If your webserver ever gets hacked (its more of a matter of when, then if. ) They dont have direct access to machines with sensitive information.

Edit: This is assuming you have a firewall capable of doing VPN. (you didn't mention anything about a firewall. If you do not, I'd put the VPN on the webserver. Not the best option but could be worse. I also suggest some kind of logging / tripwire software for your webservers in the case they do get compromised you'll know about it as quickly as possible. Hopefully you can shut them down before they get VPN Keys, start hammering your databases or start causing big problems :P.

alt text

share|improve this answer
I think the hosting company (Codero) wants a bit of extra money to handle the firewall piece, as that's out of our control, so I think we're stuck with option #2 for the time being. That looks good, though, thank you! Is there anything in particular I need to do to OpenVPN on the client side so that it knows 'all connections to go through the VPN gateway'? – Aquitaine Jun 7 '10 at 23:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.