Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

For now, I have one Web/App server and a database server. I want to have a private network in addition to the external network. I want my Database to be accessible only on the internal domain by the Web Application service. I began by making my WEB/app server a Domain Controller and simply added the Database to the domain named differently from the external domain.

Should I have made the Database server the Domain Controller instead? My DataServer also has a public IP for RDC. How do I proceed in structuring the domains so that I can be sure that external requests will only end up running the WebApplication on the WebServer and not in my private network?

It all seems to close for comfort. I would appreciate some guidance how to configure taking into to account that I made add more servers down the road.

share|improve this question
add comment

1 Answer

Usually you would have a DMZ for something like this. Have the DCs and database server in the trusted side of your firewall.

Then put your web server in the DMZ and only open the ports from DMZ to Trust that are needed for the domain to work properly (DNS, etc) and for the web server to communicate with the database server.

Then you would open the ports needed for your web server from Untrust (outside traffic) to DMZ.

There are some debates about whether or not critical database servers should actually be on the trusted side of a firewall or in a DMZ, it really depends but I prefer to keep them out of a DMZ of possible if they contain critical data.

The pros and cons with the database server placement are that DMZ servers are more likely to be compromised because they generally have more services facing the Internet. This would make your database server more likely to be compromised, even if it has no Internet facing services. So it is safer inside the trusted interface (internal network). However, you are then connecting a server from your trusted side to the DMZ which can potentially expose your trusted network to malicious activity. If you only expose the ports needed for database connectivity this risk is usually minimal. This is why I, personally, prefer database servers to remain inside of the trusted interface and just open the necessary ports to the DMZ only.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.