In computer security, a DMZ, or demilitarized zone is a physical or logical subnetwork that contains and exposes an organization's external services to a larger untrusted network, usually the Internet. The term is normally referred to as a DMZ by information technology professionals. It is sometimes ...

learn more… | top users | synonyms

0
votes
0answers
943 views

Internal but no external Citrix Access?

We recently had to reload our configuration of Citrix on our server Server1, and since we have, we can access Citrix internally, but not externally. Normally we access Citrix from ...
1
vote
1answer
585 views

Servers in DMZ will not communicate with each other

(Full disclosure: I rate barely above "noob" when it comes to networking.) My workplace recent got a new web server. Since we're nearing the end of an overhaul of our website, we're doing a slooooow ...
1
vote
1answer
2k views

Cisco adaptive security appliance is dropping packets where SYN flag is not set

We have an apache instance sitting inside our DMZ which is configured to proxy requests to an internal NATed tomcat instance inside our network. It works fine, but then all of a sudden requests from ...
2
votes
1answer
1k views

How to Deploy an ASP.NET Web API- and Browser-based Application to a Production Environment [closed]

(Please forgive if this is posted in an incorrect forum. We didn’t know exactly where to post it.) We have an ASP.NET Web API single page application - a browser-based app running in IIS to serve up ...
1
vote
1answer
176 views

API exposing services running on LAN to serve website in DMZ

I have a team of developers who are writing both an intranet and external website. The website consists of two servers and a load balancer, inside a DMZ. The DMZ has a pinhole open to the LAN ...
0
votes
2answers
215 views

Do I need to place a physical server/host within the DMZ to host servers/applications?

We are moving to a new office, and part is to review our current LAN/WAN and server access to/from the web. I understand how the DMZ works, but can't figure out if I need a physical server/host to be ...
1
vote
2answers
465 views

Linux - Get Outbound/Inbound Traffic by IP address

I am hosting a website and I found that the traffic on my server is quite high. My Linux server is behind a router in a DMZ. I would like to see the traffic made on my Linux box on the eth0 ...
1
vote
0answers
525 views

How to configure totally open DMZ with OpenWRT?

I have OpenWRT router. I have NAS in my LAN, which i need to access from WAN and from all computers in the LAN. So, it should be accessible from any computer and it needs to access some of them, too. ...
3
votes
1answer
84 views

How can I tell if a host is bridged and acting as a router

I would like to scan my DMZ for hosts that are bridged between subnets and have routing enabled. Since I have everything from VMWare servers, to load balancers on the DMZ I'm unsure if every host is ...
3
votes
1answer
843 views

How to place a virtual machine in DMZ?

I have an Ubuntu 12.04 server running few virtual machines with KVM. I would like to expose some of these virtual machines on the internet, to make it possible for customers to test the products ...
7
votes
4answers
263 views

Security for university research lab systems

Being responsible for security in a university computer science department is no fun at all. And I explain: It is often the case that I get a request for installation of new hw systems or software ...
2
votes
1answer
590 views

Best practices for LDAP and DMZ

We are in the process of setting up a DMZ and I have stumbled into the question of how to handle machines that need to have ports exposed to the internet, but at the same time be able to make LDAP ...
2
votes
2answers
399 views

Internal traffic card and external traffic cards on the same server… how to configure?

This might sound like a noob question, but here is what I have to configure: FreeBSD 1 server with 2 network cards 1 network card for internal IP addresses (5 of them) 1 network card for external IP ...
0
votes
1answer
151 views

Centralizing our FTP processes via an SFTP server in our DMZ

We have a number of various FTP processes, running on various internal servers, that connect with outside vendors to send or receive sensitive data files. As such, we don't have one centralized place ...
0
votes
1answer
1k views

Giving a VM access to a physical NIC on the host

I am running VMware Server 2.0.2 with 2 VM's. One of the VM's I want to have bridged with the domain/primary NIC of the host which I have done successfully. I want the other VM to have access to only ...
4
votes
1answer
4k views

DMZ Setup with two firewalls - Traffic from DMZ to LAN and LAN to DMZ

I am setting up a network with machines that need to be accessible from the internet. I'm planning on putting these in a DMZ. Some of the machines in the DMZ need access to machines on the private ...
0
votes
2answers
884 views

Reverse Proxy - should it be a different technology stack?

Got a skeptical question about a reverse proxy setup I'm considering. I've currently got a pair of load balanced application servers in the DMZ (S1,S2 in figure below). These accept inbound requests ...
2
votes
1answer
429 views

Howto maximize utilization of assigned subnet block for DMZ

I'm part time sysadmin for a small hosting company with currently 20 different public servers. We have a 27 subnet block that gives us a maximum of 30 usable IP addresses. That much I know, but how do ...
0
votes
2answers
5k views

Fortigate 40c Firewall Configuration

Does anybody know if is it possible to Un-bridge ports on forgiate 40c? I want to use the fortigate 40c to define and control (block/allow) port traffic for the following 4 ip ranges (each ip range ...
1
vote
4answers
749 views

Looking for low cost VPN/DMZ solution [closed]

I am looking to set up a VPN and DMZ solution for a small business. Here is some background and some of their requirements: The is a small business with maybe a dozen servers and another half-dozen ...
0
votes
2answers
5k views

Fortigate Firewall - DMZ vs Interface ports

I'm considering buying a Fortigate 50b (or Fortigate 60b) firewall to separate my web (iis) machine from the DB machine. (See http://www.fortinet.com/doc/FGT50_100DS.pdf) Till now the two servers ...
4
votes
1answer
385 views

Backing up a server on the DMZ

We have a somewhat-static web app with a large amount of media files that runs on a 2008 R2, non-domain server on the DMZ. I need to backup the media files on the server. The current backup mechanism ...
1
vote
0answers
474 views

Static NAT with 2 ISPs on CISCO router

Our company has a block of real ip addresses 91.xxx.xxx.0/24 and have bgp sessions with 2 upstream ISPs. The problem I ran into is that we need to configure static nat on a cisco router, so that 2 ...
4
votes
2answers
2k views

public ip resolves externally but not internally

I have a one to one NAT on pfsense that assigns a public IP to an internal IP (running a web server). When I open the public IP from an internal machine, it will not resolve to the internal IP, ...
0
votes
1answer
69 views

Connecting to a server inside a DMZ

in this scenario [ net2 / 10.0.1.1 ] ---- [ net1 / 10.0.0.1 ] --- ( Internet ) | | < pc2 > < ...
1
vote
2answers
649 views

What would a simple DMZ look like for scenario of database server and (web server+middle tier)?

I have two Linux servers: The first contains an Oracle 11G database that includes an Oracle HTTP Server The second contains a Java middle tier plus Apache webserver and Apache Tomcat. Someone ...
0
votes
1answer
129 views

Exsposing owa to internet but not via DMZ?

I need to give internet access to my test Exchange 2003 milieu via owa, which is on my internal network (10-network) which is a milieu whith 5 virtual machines on hyper-V! How do I do that when using ...
0
votes
1answer
341 views

Combine two NIC's into one preserving routing (DMZ server / Windows or Linux)

We have a DMZ server with two NIC's, one is accessed from the Internet (public IP) and one from behind the internal firewall (private IP). One application has problems to cope with a 2 IP's / 2 NIC's ...
-2
votes
1answer
468 views

Can an attacker exploit the vulnerability of the firewall to access the www server?

What happens if an attacker has found a technique for sending packets through the firewall to the DMZ without the packets being checked? Suppose the attacker doesn't know the internal addresses of ...
2
votes
3answers
215 views

ASA: How to connect server with a external IP address already assigned?

Any ideas how this can be done on a ASA? There was a sonicwall in place but it just died and we do not have a replacement besides this ASA. The 24.172.x.132 is a spam filter and I can't change the ...
3
votes
3answers
893 views

How to collect logs with syslog-ng from www servers in dmz and send them to server behind firewall(NAT). Can Zabbix proxy solve this?

I have several www servers in DMZ. My monitoring and log gathering server lays in my LAN. There is no comunication like WWW server in DMZ ----> monitor server in LAN. I can connect DMZ from my ...
1
vote
3answers
429 views

Find all internet facing servers

We have a large network with many servers. What is the easiest way to find all the servers that are Internet facing? Manually checking each server is not an option.
-1
votes
1answer
120 views

Are Network, or Port Assignments the physical router port as opposed to the logical (software configuration) router port?

I've been looking at the port assignments on my router in the linked Open-WRT Wiki, and I'm not sure if the column that reads Network is the actual physical port, or if the Port Assignment is the ...
4
votes
2answers
2k views

Exposing IMAP server to Internet: DMZ or Port Forwarding?

We currently have all our email stored on a Dovecot IMAP server in our internal network. Client machines on the network are able to connect and access their email. Now we want to allow certain users ...
1
vote
3answers
320 views

Accessing Internet from the DMZ

I am trying to configure a DMZ using IPCop but it looks like the default configuration for a DMZ in IPCop is no DHCP and no access to Internet. Even when I manually configure IPCop as my default ...
1
vote
2answers
526 views

Multiple blades in one chassis, some in DMZ, some in internal network

This question is similar to: Blade Enclosure, Multiple Blade Servers, Whats the closest approximation to a DMZ? In my case, I don't have virtualization so I cannot use vLANs as suggested in answers ...
6
votes
2answers
3k views

Is there a secure way to allow IIS 7 in a DMZ to access a DB server behind the firewall?

Our network admins are adamant that it is insecure for our web servers, which are hosted in the DMZ, to access the DB server behind our firewall. To get round the problem, we access the data via web ...
0
votes
1answer
515 views

DNS (Bind9) Behind Firewall

Im running ubuntu 10.04 and Bind9 behind a firewall. I have forwarded Ports 53 (UDP/TCP) to the local server (192.168.0.4). The DNS system seems to be hit-and-miss when the firewall is enabled, ...
6
votes
2answers
2k views

DMZ subnet: to NAT or not to NAT?

I'm looking at setting up a DMZ behind a Cisco ASA that will contain a large number of HTTP front-end load balancers and SSL offload services - over 100 IPs, concentrated on a smaller number of hosts. ...
2
votes
3answers
3k views

Cisco ASA 5505 DMZ Setup Issue

I have an ASA 5505 running v8.4. I have one static IP that my ISP gives me and I need to use that for my INSIDE network as well as my DMZ. This becomes a PAT issue as I need some ports to terminate ...
1
vote
1answer
641 views

FTPS server in DMZ. Force different IP addresses for passive mode

I'm setting up an FTP server with TLS/SSL encryption (FTPS, not SFTP). The server would be placed in DMZ. This means that it has tho interfaces: one for connections from the company's network and the ...
0
votes
2answers
625 views

Name Resolution in a DMZ

We're building a new set of web servers to be located in a DMZ, but we want them to be able to use our internal mail server. The mail server has a CNAME of smtp.uk.ourdomain.com - our existing servers ...
0
votes
2answers
599 views

Port Forwarding failing only to Ubuntu servers from Draytek router

I know this is a kinda unusal question, but Draytek support (..which is very eager to solve the issue) seems to reach its limits. Scenario: Draytek Vigor Multiwan router with current firmware. ...
1
vote
2answers
980 views

Should I Run TMG as a Hyper-V Guest

Okay here's an interesting question. In two parts: Is it advisable to run TMG as a hyper-v guest in production? (something is nagging me that it's not a good idea, but it's possible to give a VM ...
2
votes
4answers
2k views

To DMZ or not-DMZ on new web site

We are about to release a web application for our users, and are trying to figure out if others put their servers in a DMZ, or just keep it off the domain behind the firewall and greatly restrict ...
1
vote
1answer
427 views

Windows Vpn Server Role in DMZ?

I work on a small business network that runs on a windows server 2008 R2 domain. Right now we use a Cisco (Linksys) RV042 router to handle both VPN connections and a single Site-Site vpn. However, ...
14
votes
2answers
612 views

How big of a problem is it to punch a hole in the DMZ to one web server?

We currently have our web server in a DMZ. The web server cannot see anything within the internal network, but the internal network can see the web server. How safe would it be to punch a hole in the ...
3
votes
1answer
4k views

What is a DMZ in the simplest of examples?

I am new to the world of networking and am having a hard time understanding what a DMZ is. I understand a DMZ is where you place publicly accessible servers such as Web servers, Mail servers, etc. ...
0
votes
2answers
351 views

Connecting from DMZ machine to Server 2003 on a domain?

We have a web server on a DMZ that needs to read/write to a single file location on our Server 2003 Domain. What is the best way to do this?
0
votes
1answer
290 views

port forwarding to server outside dmz from one inside dmz

we are running mysql replication between a server outside dmz and one inside dmz, for this we need port forwarding. We have had it set up, but it recently stopped working. Just before we added a rule ...