Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Given the following physical layout for a .NET web application:

  1. DB (sql server, windows) - No public route (no table access, only stored procs)

  2. Web Service DAL (iis, windows) - No public route (can be accessed by web server via port 80 and 443)

  3. Web Server (iis, windows) - Public route (only via port 80 and 443)

What type(s) / examples of attack could be used to compromise the public web server but would be blocked by the Web Service DAL? i.e. can you think of concrete attack types that the DAL stops?

Please note, I am interested only in the security aspect, not scaling / fault tolerance / performance / etc.

In my mind if the web server has been compromised using an attack over port 80/443, then the same attack would work over port 80/443 to the Web Service DAL box.

share|improve this question

migrated from Jun 16 '10 at 13:07

This question came from our site for professional and enthusiast programmers.

up vote 2 down vote accepted

You gain the ability to exclude all incoming requests (on server two - the web service layer) except those from specific IP addresses - normally only those associated with the public-facing web server.

In that configuration, attacks on server two need to be staged on server three.

It's not impossible to get control of server three, then use it to launch attacks, but it's considerably more difficult than attacking from an independent machine.

share|improve this answer
@Jeff - agreed, however if we assume that the DB, resources et al are not routable from the web - only server 3 - then could we agree that the attacker must stage any type of attack from server 3? Thank you very much for your input Jeff. – Jonno Jun 16 '10 at 13:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.