Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are running Windows Server 2008 R2 in a virtual, public facing environment. The server was provisioned with one IP address, which I, the developer, have used as the default IP address for an IIS website.

Is this best practice? Should the server's IP and the website's IP be different?

It is my intent to use only one IP address in IIS and user host headers to route incoming traffic.

share|improve this question
add comment

2 Answers

up vote 3 down vote accepted

It depends on what ports are open and what's firewalled off and not.

I'm sure there are plenty of machines setup just like this around but you asked about best practice and certainly I think most sysadmins would be much happier to see either two IPs on the NIC, one for external traffic and one for internal management traffic - or two different physical or virtual NICs. This doesn't eradicate any security risk inherent in using a single IP but it does help to lower the risk and that would be my recommendation to you.

share|improve this answer
add comment

It is very common for a webserver to only have 1 IP address. IPv4 addresses are getting scarce, and people don't want to use more than they need.

From a security point of view, it makes it slightly easier for an attacker to find other services on that machine, but it makes little difference. A seperate network card on a different network for management can be a security measure, but just a second IP address on the same network and interface isn't.

In any case, you want to make sure you have properly configured your firewall, as well as secured services like remote desktop - if remote desktop is opened to the internet at large, it will get hammered with attacks, and some may eventually succeed.

One reason you might want to have multiple IP addresses is if you are running multiple HTTPS sites, since it is much easier to setup and better supported if they are using separate IP addresses, not name based hosting.

share|improve this answer
    
IPv4 address scarcity has little or nothing to do with this, since you'd (hopefully) be putting one IP address externally-facing and one IP address on a private subnet. And those aren't exactly scarce or getting scarcer. –  HopelessN00b Jul 20 '12 at 17:57
    
It does matter if the server is not local to the people who are managing it (either people work from off site, or it is in a datacenter). A private IP address will do you no good there. Since they didn't specify if it is hosted locally, I assume it's in a datacenter. –  Grant Jul 21 '12 at 1:14
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.