up vote 0 down vote favorite
share [g+] share [fb]

I'm a developer by trade but because I'm therefore an "expert" at all things IT I'm find myself helping out at my wife's office from time-to-time... however I'm pushing my networking knowledge a little here so I was hoping somebody here could help me out a bit.

The situation (as I recently found out!) is that they have a website hosted in their office (publically accessible via a fixed-IP that is port-forwarded (80 and 443) on their simple Netgear Wifi AcessPoint/Router to their server). This server holds EVERYTHING for the company - their databases, documents etc. The databases are accessed by the website and internal users with an internal Windows application. The DBs hold fairly private data. When I found out they were doing this I recommended they move the website to another server (they had a spare one), and keep the public access separate from their main server. The main server runs Win2k3 SBS and the Webserver I've setup runs Win2k3 Web Edition.

What I was thinking of doing was putting the webserver on a different subnet (say 192.168.10.x instead of 192.168.0.x) and having the router forward 80 and 443 onto that. Then multi-home the main server so it can see the other subnet, too. However the router cannot forward to a different subnet so I got a bit stuck and ran out of networking know-how. The router is doing DHCP, by the way.

Is there a way to configure this sort of thing using RRAS? Or am I fighting a lost-cause? Should I persuade them to buy a better router (which has to be CHEAP! - they are a tiny firm, and something I could conceivably setup). Or would keeping the webserver on the same subnet be ok, if some sort of firewall software were properly configured?

Any help and guidance greatly appreciated.

link|improve this question
1  
provide the public ip, provide the public ip !! It's a joke of course, don't do that at all! – Mathieu Chateau Jun 11 '09 at 9:29
feedback

5 Answers

up vote 1 down vote

Public aviable services should always be separated from the internal LAN (and above).

I'd convince them to buy a cheap firewall with 3 interfaces (or two interfaces+vlan+a switch). I know Linksys has some very cheap business firewalls wich would suit their needs perfectly.

Edit: To the poster above; same IP subnet but separate VLANS? Thats not possible.

link|improve this answer
Thanks pauska. I'll investigate what Linksys has to offer and let you know how I get on. – Valerion Jun 11 '09 at 14:49
>same IP subnet but separate VLANS The Draytek routers support VLANs on their embedded switch. That allows you to have two servers attached to the router, both of which can see the router and the Internet beyond it but cannot see each other even though they are in the same subnet. I expect this is what Alakdae meant. This seems a reasonable solution provided the two srevers don't need to transfer any data between them. – John Rennie Jun 11 '09 at 17:09
Sorry, thats still not right. A router can not have the same IP adress on two different VLANS, it's no logic in it and its not psossible. Creating one VLAN for each subnet is however very possible and the normal procedure to solve something like the original poster asked about. – pauska Jun 12 '09 at 11:16
I suspect we have a problem with terminology. I'm using a VLAN in sense of en.wikipedia.org/wiki/Vlan. The VKLAN operates at layer 2 i.e. by MAC address and has no concept of IP address. My own router uses just this type of VLAN. I'd be happy to demo it. – John Rennie Jun 13 '09 at 8:46
feedback
up vote 1 down vote

I think you are (or may be) worrying unnecessarily. After all if you set up an SBS Server you'll find it's (intended to be) available from the Internet so that Outlook Web Access and Remote Web Workplace work. The millions of SBS installations out there don't seem to be heralding a wave of hacked servers.

If you are just forwarding ports 80 and 443 you're going to have to work to introduce any serious security issues. I suppose there is a risk that the next Code Red virus will come along and allow someone to crack the server, but that seems to me a small risk these days.

If you think the web stuff will be a drain on resources, which is unlikey since they're a small company, you could put the web server in and keep it on the same subnet. Just change the port forwarding. Is it really worth it though?

JR

link|improve this answer
I see what you're saying (although they don't use OWA or Exchange for that matter). The data is sensitive medical data for some extremely well-known (in the UK!) persons - I feel some extra security is better than none... – Valerion Jun 11 '09 at 14:47
OK how about using Alakdae's idea of VLANs. With Drayteks, and I'm sure other routers, you can put different ports on the embedded switch in different VLANs so packets cannot be switched between them. Both servers would see the Internet normally through the router but would have no access to each other. – John Rennie Jun 11 '09 at 17:11
The servers DO need see each other though, as the current server has the DB on it and will continue to have the DB on it. I presume one port attached to a different switch to the rest of the LAN with the main server multi-homed with a connection to each switch would work though? – Valerion Jun 12 '09 at 14:09
"The servers DO need see each other". Ah OK. I would just put the web server on the same subnet as everything else, but note that if someone managed to put Code Red on it you would allow the virus access to the rest of your network. If you really don't want this you need a firewall with a DMZ port. Then you can put in firewall rules to restrict the access from your web server in the DMZ to your LAN as well as to the Internet. – John Rennie Jun 13 '09 at 8:50
If you connect your web server to the main server, even if it's on a different NIC, you expose your server to any viruses running on the web server just as if you dropped it onto the LAN. If you're that serious about security you need a firewall between the two servers. – John Rennie Jun 13 '09 at 8:52
feedback
up vote 0 down vote

You can put them on the same subnet and use VLANs.

link|improve this answer
Why was this marked down? This seems to me an entirely reasonable suggestion. – John Rennie Jun 11 '09 at 14:11
Maybe someone doesn't know how to use VLANs. – Alakdae Jun 11 '09 at 15:14
feedback
up vote 0 down vote

Fortigate make a pretty simple firewall/router that allows two internal networks, and an external. Some models have WiFi too. They aren't the cheapest around, but are reliable, and full-featured.

You'll be able to configure it to support DHCP etc, and it will secure your web-server in a DMZ, allowing access from both internal and external users with differing security levels.

You won't need to multi-home the main server then, it'll just be connecting internally as before.

Might be a good time to start discussing back-ups too.

link|improve this answer
feedback
up vote 0 down vote

A Mikrotik RB450 (http://routerboard.com/comparison.html) would handle segmenting the networks, firewalling, providing NAT functionality, etc. You should be able to get it for ~$100, or $130 if you want the gigabit capable RB450G.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.