In computer security, a DMZ, or demilitarized zone is a physical or logical subnetwork that contains and exposes an organization's external services to a larger untrusted network, usually the Internet. The term is normally referred to as a DMZ by information technology professionals. It is sometimes ...
0
votes
0answers
15 views
Configuring DMZ for wireless hosts on OpenWRT Backfire 10.03.1-rc4
I'm not entirely sure about whether this post belongs here or not, but here I go: I have a TP-LINK WR841ND router, running OpenWRT Backfire r24038 (allegedly the release which works best with my ...
0
votes
1answer
14 views
Connecting to a server inside a DMZ
in this scenario
[ net2 / 10.0.1.1 ] ---- [ net1 / 10.0.0.1 ] --- ( Internet )
| |
< pc2 > < ...
1
vote
2answers
66 views
What would a simple DMZ look like for scenario of database server and (web server+middle tier)?
I have two Linux servers:
The first contains an Oracle 11G database that includes an Oracle HTTP Server
The second contains a Java middle tier plus Apache webserver and Apache Tomcat.
Someone ...
0
votes
1answer
91 views
Exsposing owa to internet but not via DMZ?
I need to give internet access to my test Exchange 2003 milieu via owa, which is on my internal network (10-network) which is a milieu whith 5 virtual machines on hyper-V!
How do I do that when using ...
0
votes
1answer
38 views
Combine two NIC's into one preserving routing (DMZ server / Windows or Linux)
We have a DMZ server with two NIC's, one is accessed from the Internet (public IP) and one from behind the internal firewall (private IP).
One application has problems to cope with a 2 IP's / 2 NIC's ...
-2
votes
1answer
115 views
Can an attacker exploit the vulnerability of the firewall to access the www server?
What happens if an attacker has found a technique for sending packets through the firewall to the DMZ without the packets being checked?
Suppose the attacker doesn't know the internal addresses of ...
1
vote
1answer
92 views
Tomato and port forwarding/dmz not working…?
I've been running Tomato 1.28 on my wireless router for a while now without issue. I am trying to SSH to one of my servers behind the router, and can't seem to get through.
First, I went to ...
2
votes
3answers
59 views
ASA: How to connect server with a external IP address already assigned?
Any ideas how this can be done on a ASA? There was a sonicwall in place but it just died and we do not have a replacement besides this ASA. The 24.172.x.132 is a spam filter and I can't change the ...
0
votes
2answers
88 views
force a strict nat on linksys router
I'm trying to force a strict NAT on a Linksys E2500, but I'm unsure how to do that. Normally with my old Linksys router, I would have to do some port forwarding to get an open NAT, however I didn't ...
3
votes
3answers
147 views
How to collect logs with syslog-ng from www servers in dmz and send them to server behind firewall(NAT). Can Zabbix proxy solve this?
I have several www servers in DMZ. My monitoring and log gathering server lays in my LAN. There is no comunication like
WWW server in DMZ ----> monitor server in LAN.
I can connect DMZ from my ...
0
votes
0answers
82 views
Sharepoint 2010 web front end servers and services configuration
I have a sharepoint insfrastructure where a document library is made available both locally and on the internet. I have a few web front end servers facing the public (in the DMZ) while having another ...
1
vote
3answers
100 views
Find all internet facing servers
We have a large network with many servers. What is the easiest way to find all the servers that are Internet facing? Manually checking each server is not an option.
-1
votes
1answer
62 views
Are Network, or Port Assignments the physical router port as opposed to the logical (software configuration) router port?
I've been looking at the port assignments on my router in the linked Open-WRT Wiki, and I'm not sure if the column that reads Network is the actual physical port, or if the Port Assignment is the ...
2
votes
2answers
190 views
Exposing IMAP server to Internet: DMZ or Port Forwarding?
We currently have all our email stored on a Dovecot IMAP server in our internal network. Client machines on the network are able to connect and access their email.
Now we want to allow certain users ...
1
vote
3answers
81 views
Accessing Internet from the DMZ
I am trying to configure a DMZ using IPCop but it looks like the default configuration for a DMZ in IPCop is no DHCP and no access to Internet.
Even when I manually configure IPCop as my default ...
1
vote
2answers
95 views
Multiple blades in one chassis, some in DMZ, some in internal network
This question is similar to:
Blade Enclosure, Multiple Blade Servers, Whats the closest approximation to a DMZ?
In my case, I don't have virtualization so I cannot use vLANs as suggested in answers ...
4
votes
2answers
146 views
Is there a secure way to allow IIS 7 in a DMZ to access a DB server behind the firewall?
Our network admins are adamant that it is insecure for our web servers, which are hosted in the DMZ, to access the DB server behind our firewall. To get round the problem, we access the data via web ...
0
votes
1answer
94 views
Selecting a switch for DMZ [closed]
I'm looking to select a switch solely for use in a DMZ. It's a small business network (around 30 users), with mail, VPN, Sharepoint, etc in the DMZ. Nothing too complicated. All connected to a leased ...
0
votes
1answer
97 views
DNS (Bind9) Behind Firewall
Im running ubuntu 10.04 and Bind9 behind a firewall. I have forwarded Ports 53 (UDP/TCP) to the local server (192.168.0.4).
The DNS system seems to be hit-and-miss when the firewall is enabled, ...
4
votes
2answers
297 views
DMZ subnet: to NAT or not to NAT?
I'm looking at setting up a DMZ behind a Cisco ASA that will contain a large number of HTTP front-end load balancers and SSL offload services - over 100 IPs, concentrated on a smaller number of hosts.
...
2
votes
3answers
522 views
Cisco ASA 5505 DMZ Setup Issue
I have an ASA 5505 running v8.4. I have one static IP that my ISP gives me and I need to use that for my INSIDE network as well as my DMZ. This becomes a PAT issue as I need some ports to terminate ...
1
vote
1answer
104 views
FTPS server in DMZ. Force different IP addresses for passive mode
I'm setting up an FTP server with TLS/SSL encryption (FTPS, not SFTP). The server would be placed in DMZ. This means that it has tho interfaces: one for connections from the company's network and the ...
0
votes
2answers
72 views
Name Resolution in a DMZ
We're building a new set of web servers to be located in a DMZ, but we want them to be able to use our internal mail server. The mail server has a CNAME of smtp.uk.ourdomain.com - our existing servers ...
0
votes
2answers
205 views
Port Forwarding failing only to Ubuntu servers from Draytek router
I know this is a kinda unusal question, but Draytek support (..which is very eager to solve the issue) seems to reach its limits.
Scenario:
Draytek Vigor Multiwan router with current firmware.
...
0
votes
0answers
44 views
Can SQL Server Cluster work in DMZ with just LDAP protocol available from LAN?
Can SQL Server Cluster (2008+) work in DMZ with access to only clean LDAP protocol (and nothing else) into LAN? What would be minimal traffic required to pass thru firewall between DMZ and LAN for SQL ...
1
vote
2answers
298 views
Should I Run TMG as a Hyper-V Guest
Okay here's an interesting question. In two parts:
Is it advisable to run TMG as a hyper-v guest in production? (something is nagging me that it's not a good idea, but it's possible to give a VM ...
2
votes
4answers
247 views
To DMZ or not-DMZ on new web site
We are about to release a web application for our users, and are trying to figure out if others put their servers in a DMZ, or just keep it off the domain behind the firewall and greatly restrict ...
1
vote
1answer
110 views
Windows Vpn Server Role in DMZ?
I work on a small business network that runs on a windows server 2008 R2 domain. Right now we use a Cisco (Linksys) RV042 router to handle both VPN connections and a single Site-Site vpn. However, ...
13
votes
2answers
344 views
How big of a problem is it to punch a hole in the DMZ to one web server?
We currently have our web server in a DMZ. The web server cannot see anything within the internal network, but the internal network can see the web server. How safe would it be to punch a hole in the ...
1
vote
1answer
210 views
What is a DMZ in the simplest of examples?
I am new to the world of networking and am having a hard time understanding what a DMZ is. I understand a DMZ is where you place publicly accessible servers such as Web servers, Mail servers, etc. ...
0
votes
2answers
175 views
Connecting from DMZ machine to Server 2003 on a domain?
We have a web server on a DMZ that needs to read/write to a single file location on our Server 2003 Domain. What is the best way to do this?
0
votes
1answer
137 views
port forwarding to server outside dmz from one inside dmz
we are running mysql replication between a server outside dmz and one inside dmz, for this we need port forwarding. We have had it set up, but it recently stopped working. Just before we added a rule ...
0
votes
2answers
319 views
How to share a SAN(Storage Area Network) Environment between servers in DMZ and a internal Network?
My current (imaginary) setup has a DMZ with two servers and an internal network with two more servers
Servers in DMZ- Webserver (Company Website), Proxy
Servers in the internal Network - Messaging ...
2
votes
3answers
348 views
Placing a server in the DMZ vs opening firewall ports
When should you place a server in a DMZ vs opening ports on the firewall and keeping it within the network? I'm referring to active directory servers, IIS servers, and mostly things on a windows based ...
0
votes
1answer
499 views
Sonicwall NSA 240, Configured for LAN and DMZ, X0 and X2 on same switch - ping issues
Our Sonicwall vendor supplied and networked the NSA240 when we required a DMZ in our infrastructure. This was configured and appeared correct although VPN users periodically dropped DNS and Terminal ...
0
votes
2answers
139 views
Network topology question
We currently have three networks, X.X.163.1, X.X.93.1 and 192.168.1.1.
Today's setup is like this:
http://i.stack.imgur.com/tkKWy.jpg
We now have PPT VPN from internet to the X.X.163.1-network, but ...
2
votes
3answers
160 views
network topology including many services
I know this is yet another question on how to setup network but I hope you are not bored of such questions yet.
The site is also an office, so it includes windows dc, windows ad, exchange, sql, file ...
1
vote
4answers
252 views
Putting a Windows DC, Exchange in a DMZ
I have one guy at my company telling me that I should put FF:TMG in between my main Internet-facing firewall (Cisco 5510) and put my Exchange server and DC on the internal network.
I have another guy ...
0
votes
1answer
124 views
DMZ setup and firewall throughput limit
I am in the process of moving server room into the datacenter and it is a good time to review current setup for security zones.We are using Vsphere 4 Standard and Cisco ASA 5510 firewall.
At the ...
1
vote
3answers
125 views
Securing VPN access from users machines (home office)
We already have a couple of people working from home, accessing some internal servers via VPN. They're all using company provided laptops or PCs which we have complete control over. Now we're faced ...
0
votes
1answer
104 views
Securing internal data accessed by a website on the big, bad internet
A close relative of this question on Stack Overflow:
When you have a web site in your DMZ that needs to access production data stored on an internal DB, what strategies do you recommend using to ...
2
votes
5answers
351 views
SFTP: How to keep data out of the DMZ
We are investigating solutions to the following problem:
We have external (Internet) users who need access to sensitive information. We could offer it to them via SFTP which would offer a secure ...
0
votes
2answers
186 views
Reverse Proxy - Can I use one IP for multiple hosts?
I would like to setup an internal box that all all external traffic gets forwarded to, and then onto the relevant boxes in-house.
I would like to know the following:
If I have two servers in-house, ...
1
vote
5answers
592 views
DMZ configuration and firewall throughput
I've been asked to look into placing a firewall between a webserver (Debian/Apache/PHP) in the DMZ and a backend MySQL database to achieve "isolation". Right now, iptables is running on the MySQL ...
0
votes
1answer
84 views
is opening DNZ will cause security problem?
I build a home server with Xampp. When route my local ip addres with NAT there is virtual server and DNZ. If I only full fiel virtual server my http port not opens.if I enable DNZ then I can reach my ...
2
votes
1answer
290 views
What's the best method of achieving device isolation in a DMZ?
I have an ADSL connection which has a /29 subnet allocated to it, giving me 6 usable IP addresses. Currently this has a cheap Netgear ADSL router attached, which has a built in switch. There are 3 ...
4
votes
6answers
671 views
Does Wireshark pose a threat when installed on a server in the DMZ?
If you install wireshark on a web server sitting in the DMZ, is there a hack that can be used to get backdoor entrace to that server even when RDP is disblaed? I'm trying to monitor the wire on the ...
2
votes
1answer
219 views
Is it necessary to have DMZ machine or zone on a network?
Is it necessary to have DMZ machine or zone on a network?
What reasons are there for having a DMZ machine or zone?
If the DMZ zone cannot communicate with the normal network at a site, why have it?
1
vote
3answers
381 views
Blade Enclosure, Multiple Blade Servers, Whats the closest approximation to a DMZ?
I appreciate that to get a proper DMZ, one should have a physical separation between the DMZ servers and the LAN servers, with a firewall server in between.
But, in a network consisting of a single ...
1
vote
1answer
123 views
Persistent TCP connection in DMZ
A vendor is requesting to allow persistent tcp (not port 80) connection between a server in the DMZ and the internal network. I don't have much experience with this setting. Can anyone shed some light ...
