In computer security, a DMZ, or demilitarized zone is a physical or logical subnetwork that contains and exposes an organization's external services to a larger untrusted network, usually the Internet. The term is normally referred to as a DMZ by information technology professionals. It is sometimes ...

learn more… | top users | synonyms

1
vote
1answer
477 views

DMZ config on RV082 router

We are connecting 2 offices with a dedicated point to point connection. Both offices have the Cisco RV082 router. In both offices, the routers are being used for internet on the WAN1 port. This ...
0
votes
1answer
291 views

SMB for specific user from DMZ to internal

I've got one server in a DMZ which has limited access via SMB to another one in the internal network. A web server on that external machine needs access to a whole partition on that internal server. ...
1
vote
1answer
753 views

Subversion server behind firewall and Apache reverse proxy exhibits intermittent hanging

Here's my situation: 1) DMZ: I have an self-signed SSL Cert on an Apache server (our bastion host) configured to run as a reverse proxy for 7 other LAN servers (subversion, ldap, jenkins, ...
0
votes
1answer
1k views

Where to put OpenVPN server - DMZ or LAN?

We have a Smoothwall firewall with both a "green" network (LAN) and an "orange" network (DMZ), and we would like to use OpenVPN access server as our VPN server. The question is: Should the VPN server ...
1
vote
1answer
981 views

Setup DMZ in Pfsense with virtual servers, physical Pfsense server

I am looking for some networking tips on how to set up a DMZ in Pfsense and place some virtual servers in that DMZ. Right now my network looks like: Uverse (Static IPs) -> Pfsense -> WAN -> (Virtual ...
2
votes
1answer
3k views

VLAN security compared to DMZ

I found this question very illuminating about DMZs and when to place a server in one. We're re-organizing our internal company network (keeping the same external IPs and domains), our mainly Windows ...
2
votes
0answers
236 views

Deploying a ASP.Net WebAPI website and DMZ

I have a set of RESTful services developed using ASP.Net WebAPI which is a single project. I handle authentication via ASP.Net's built in Forms Authentication (cookie based) mechanism which is also ...
0
votes
2answers
87 views

Google Analytics: No stats from DMZ network segment

We need to track hits on a particular page for usage stats, evaluate client need, etc. More specifically we need to track an internal DMZ network segment for hits on this page. Google Analytics ...
1
vote
1answer
656 views

Servers in DMZ will not communicate with each other

(Full disclosure: I rate barely above "noob" when it comes to networking.) My workplace recent got a new web server. Since we're nearing the end of an overhaul of our website, we're doing a slooooow ...
1
vote
1answer
3k views

Cisco adaptive security appliance is dropping packets where SYN flag is not set

We have an apache instance sitting inside our DMZ which is configured to proxy requests to an internal NATed tomcat instance inside our network. It works fine, but then all of a sudden requests from ...
2
votes
1answer
1k views

How to Deploy an ASP.NET Web API- and Browser-based Application to a Production Environment [closed]

(Please forgive if this is posted in an incorrect forum. We didn’t know exactly where to post it.) We have an ASP.NET Web API single page application - a browser-based app running in IIS to serve up ...
1
vote
1answer
201 views

API exposing services running on LAN to serve website in DMZ

I have a team of developers who are writing both an intranet and external website. The website consists of two servers and a load balancer, inside a DMZ. The DMZ has a pinhole open to the LAN ...
0
votes
2answers
246 views

Do I need to place a physical server/host within the DMZ to host servers/applications?

We are moving to a new office, and part is to review our current LAN/WAN and server access to/from the web. I understand how the DMZ works, but can't figure out if I need a physical server/host to be ...
1
vote
2answers
505 views

Linux - Get Outbound/Inbound Traffic by IP address

I am hosting a website and I found that the traffic on my server is quite high. My Linux server is behind a router in a DMZ. I would like to see the traffic made on my Linux box on the eth0 ...
1
vote
1answer
686 views

How to configure totally open DMZ with OpenWRT?

I have OpenWRT router. I have NAS in my LAN, which i need to access from WAN and from all computers in the LAN. So, it should be accessible from any computer and it needs to access some of them, too. ...
3
votes
1answer
86 views

How can I tell if a host is bridged and acting as a router

I would like to scan my DMZ for hosts that are bridged between subnets and have routing enabled. Since I have everything from VMWare servers, to load balancers on the DMZ I'm unsure if every host is ...
3
votes
1answer
936 views

How to place a virtual machine in DMZ?

I have an Ubuntu 12.04 server running few virtual machines with KVM. I would like to expose some of these virtual machines on the internet, to make it possible for customers to test the products ...
7
votes
4answers
265 views

Security for university research lab systems

Being responsible for security in a university computer science department is no fun at all. And I explain: It is often the case that I get a request for installation of new hw systems or software ...
2
votes
1answer
646 views

Best practices for LDAP and DMZ

We are in the process of setting up a DMZ and I have stumbled into the question of how to handle machines that need to have ports exposed to the internet, but at the same time be able to make LDAP ...
2
votes
2answers
419 views

Internal traffic card and external traffic cards on the same server… how to configure?

This might sound like a noob question, but here is what I have to configure: FreeBSD 1 server with 2 network cards 1 network card for internal IP addresses (5 of them) 1 network card for external IP ...
0
votes
1answer
161 views

Centralizing our FTP processes via an SFTP server in our DMZ

We have a number of various FTP processes, running on various internal servers, that connect with outside vendors to send or receive sensitive data files. As such, we don't have one centralized place ...
0
votes
1answer
1k views

Giving a VM access to a physical NIC on the host

I am running VMware Server 2.0.2 with 2 VM's. One of the VM's I want to have bridged with the domain/primary NIC of the host which I have done successfully. I want the other VM to have access to only ...
4
votes
1answer
5k views

DMZ Setup with two firewalls - Traffic from DMZ to LAN and LAN to DMZ

I am setting up a network with machines that need to be accessible from the internet. I'm planning on putting these in a DMZ. Some of the machines in the DMZ need access to machines on the private ...
0
votes
2answers
936 views

Reverse Proxy - should it be a different technology stack?

Got a skeptical question about a reverse proxy setup I'm considering. I've currently got a pair of load balanced application servers in the DMZ (S1,S2 in figure below). These accept inbound requests ...
2
votes
1answer
458 views

Howto maximize utilization of assigned subnet block for DMZ

I'm part time sysadmin for a small hosting company with currently 20 different public servers. We have a 27 subnet block that gives us a maximum of 30 usable IP addresses. That much I know, but how do ...
0
votes
2answers
5k views

Fortigate 40c Firewall Configuration

Does anybody know if is it possible to Un-bridge ports on forgiate 40c? I want to use the fortigate 40c to define and control (block/allow) port traffic for the following 4 ip ranges (each ip range ...
1
vote
4answers
765 views

Looking for low cost VPN/DMZ solution [closed]

I am looking to set up a VPN and DMZ solution for a small business. Here is some background and some of their requirements: The is a small business with maybe a dozen servers and another half-dozen ...
0
votes
2answers
6k views

Fortigate Firewall - DMZ vs Interface ports

I'm considering buying a Fortigate 50b (or Fortigate 60b) firewall to separate my web (iis) machine from the DB machine. (See http://www.fortinet.com/doc/FGT50_100DS.pdf) Till now the two servers ...
5
votes
1answer
419 views

Backing up a server on the DMZ

We have a somewhat-static web app with a large amount of media files that runs on a 2008 R2, non-domain server on the DMZ. I need to backup the media files on the server. The current backup mechanism ...
4
votes
2answers
3k views

public ip resolves externally but not internally

I have a one to one NAT on pfsense that assigns a public IP to an internal IP (running a web server). When I open the public IP from an internal machine, it will not resolve to the internal IP, ...
0
votes
1answer
71 views

Connecting to a server inside a DMZ

in this scenario [ net2 / 10.0.1.1 ] ---- [ net1 / 10.0.0.1 ] --- ( Internet ) | | < pc2 > < ...
2
votes
2answers
723 views

What would a simple DMZ look like for scenario of database server and (web server+middle tier)?

I have two Linux servers: The first contains an Oracle 11G database that includes an Oracle HTTP Server The second contains a Java middle tier plus Apache webserver and Apache Tomcat. Someone ...
0
votes
1answer
129 views

Exsposing owa to internet but not via DMZ?

I need to give internet access to my test Exchange 2003 milieu via owa, which is on my internal network (10-network) which is a milieu whith 5 virtual machines on hyper-V! How do I do that when using ...
0
votes
1answer
354 views

Combine two NIC's into one preserving routing (DMZ server / Windows or Linux)

We have a DMZ server with two NIC's, one is accessed from the Internet (public IP) and one from behind the internal firewall (private IP). One application has problems to cope with a 2 IP's / 2 NIC's ...
-2
votes
1answer
494 views

Can an attacker exploit the vulnerability of the firewall to access the www server?

What happens if an attacker has found a technique for sending packets through the firewall to the DMZ without the packets being checked? Suppose the attacker doesn't know the internal addresses of ...
2
votes
3answers
221 views

ASA: How to connect server with a external IP address already assigned?

Any ideas how this can be done on a ASA? There was a sonicwall in place but it just died and we do not have a replacement besides this ASA. The 24.172.x.132 is a spam filter and I can't change the ...
3
votes
3answers
973 views

How to collect logs with syslog-ng from www servers in dmz and send them to server behind firewall(NAT). Can Zabbix proxy solve this?

I have several www servers in DMZ. My monitoring and log gathering server lays in my LAN. There is no comunication like WWW server in DMZ ----> monitor server in LAN. I can connect DMZ from my ...
1
vote
3answers
496 views

Find all internet facing servers

We have a large network with many servers. What is the easiest way to find all the servers that are Internet facing? Manually checking each server is not an option.
-1
votes
1answer
123 views

Are Network, or Port Assignments the physical router port as opposed to the logical (software configuration) router port?

I've been looking at the port assignments on my router in the linked Open-WRT Wiki, and I'm not sure if the column that reads Network is the actual physical port, or if the Port Assignment is the ...
5
votes
2answers
2k views

Exposing IMAP server to Internet: DMZ or Port Forwarding?

We currently have all our email stored on a Dovecot IMAP server in our internal network. Client machines on the network are able to connect and access their email. Now we want to allow certain users ...
1
vote
3answers
355 views

Accessing Internet from the DMZ

I am trying to configure a DMZ using IPCop but it looks like the default configuration for a DMZ in IPCop is no DHCP and no access to Internet. Even when I manually configure IPCop as my default ...
1
vote
2answers
545 views

Multiple blades in one chassis, some in DMZ, some in internal network

This question is similar to: Blade Enclosure, Multiple Blade Servers, Whats the closest approximation to a DMZ? In my case, I don't have virtualization so I cannot use vLANs as suggested in answers ...
6
votes
2answers
3k views

Is there a secure way to allow IIS 7 in a DMZ to access a DB server behind the firewall?

Our network admins are adamant that it is insecure for our web servers, which are hosted in the DMZ, to access the DB server behind our firewall. To get round the problem, we access the data via web ...
0
votes
1answer
523 views

DNS (Bind9) Behind Firewall

Im running ubuntu 10.04 and Bind9 behind a firewall. I have forwarded Ports 53 (UDP/TCP) to the local server (192.168.0.4). The DNS system seems to be hit-and-miss when the firewall is enabled, ...
6
votes
2answers
3k views

DMZ subnet: to NAT or not to NAT?

I'm looking at setting up a DMZ behind a Cisco ASA that will contain a large number of HTTP front-end load balancers and SSL offload services - over 100 IPs, concentrated on a smaller number of hosts. ...
2
votes
3answers
3k views

Cisco ASA 5505 DMZ Setup Issue

I have an ASA 5505 running v8.4. I have one static IP that my ISP gives me and I need to use that for my INSIDE network as well as my DMZ. This becomes a PAT issue as I need some ports to terminate ...
1
vote
1answer
705 views

FTPS server in DMZ. Force different IP addresses for passive mode

I'm setting up an FTP server with TLS/SSL encryption (FTPS, not SFTP). The server would be placed in DMZ. This means that it has tho interfaces: one for connections from the company's network and the ...
0
votes
2answers
694 views

Name Resolution in a DMZ

We're building a new set of web servers to be located in a DMZ, but we want them to be able to use our internal mail server. The mail server has a CNAME of smtp.uk.ourdomain.com - our existing servers ...
0
votes
2answers
621 views

Port Forwarding failing only to Ubuntu servers from Draytek router

I know this is a kinda unusal question, but Draytek support (..which is very eager to solve the issue) seems to reach its limits. Scenario: Draytek Vigor Multiwan router with current firmware. ...
1
vote
2answers
1k views

Should I Run TMG as a Hyper-V Guest

Okay here's an interesting question. In two parts: Is it advisable to run TMG as a hyper-v guest in production? (something is nagging me that it's not a good idea, but it's possible to give a VM ...