We are moving to a new office, and part is to review our current LAN/WAN and server access to/from the web.
I understand how the DMZ works, but can't figure out if I need a physical server/host to be placed between my 2 firewalls, or I can do with subnetting/vNic the DMZ and the servers/virtual servers with vNic.
Today we have a single router and single firewall. Which behind it are all our servers, application servers, DC, VM hosts etc.
I have 2 applications today (on virtual servers), that are accessible from the web (firewall hole punches). Both do NOT use AD credentials, and are working with local DB users (remove the need for AD credentials).
- Both are virtual servers in (currently) 1 of 3 VM Hosts.
- I want to move these 2 applications into the DMZ.
- That will require at least an IIS as well.
Placing a physical VM Host server that has 2 NIC's seems bit weird (that host will hold as many servers/applications servers that I need)
- it's a single point of fail
- and doesn't feel right (even though it can/should work)
and on the other hand, I can create a vNic in one of my hosts, and mapping it's IP to both Firwalls.
router > wan_firewall_dmz > vNic to server > dmz_firewall_lan > gives me less feeling of the security that the prior option does, and for some reason, I have a feeling I "miss" the DMZ idea.
Is that correct?
What is it that I am missing?