In computer security, a DMZ, or demilitarized zone is a physical or logical subnetwork that contains and exposes an organization's external services to a larger untrusted network, usually the Internet. The term is normally referred to as a DMZ by information technology professionals. It is sometimes ...

learn more… | top users | synonyms

-1
votes
1answer
130 views

Are Network, or Port Assignments the physical router port as opposed to the logical (software configuration) router port?

I've been looking at the port assignments on my router in the linked Open-WRT Wiki, and I'm not sure if the column that reads Network is the actual physical port, or if the Port Assignment is the ...
5
votes
2answers
3k views

Exposing IMAP server to Internet: DMZ or Port Forwarding?

We currently have all our email stored on a Dovecot IMAP server in our internal network. Client machines on the network are able to connect and access their email. Now we want to allow certain users ...
1
vote
3answers
472 views

Accessing Internet from the DMZ

I am trying to configure a DMZ using IPCop but it looks like the default configuration for a DMZ in IPCop is no DHCP and no access to Internet. Even when I manually configure IPCop as my default ...
1
vote
2answers
654 views

Multiple blades in one chassis, some in DMZ, some in internal network

This question is similar to: Blade Enclosure, Multiple Blade Servers, Whats the closest approximation to a DMZ? In my case, I don't have virtualization so I cannot use vLANs as suggested in answers ...
8
votes
2answers
4k views

Is there a secure way to allow IIS 7 in a DMZ to access a DB server behind the firewall?

Our network admins are adamant that it is insecure for our web servers, which are hosted in the DMZ, to access the DB server behind our firewall. To get round the problem, we access the data via web ...
0
votes
1answer
640 views

DNS (Bind9) Behind Firewall

Im running ubuntu 10.04 and Bind9 behind a firewall. I have forwarded Ports 53 (UDP/TCP) to the local server (192.168.0.4). The DNS system seems to be hit-and-miss when the firewall is enabled, ...
6
votes
2answers
3k views

DMZ subnet: to NAT or not to NAT?

I'm looking at setting up a DMZ behind a Cisco ASA that will contain a large number of HTTP front-end load balancers and SSL offload services - over 100 IPs, concentrated on a smaller number of hosts. ...
2
votes
3answers
3k views

Cisco ASA 5505 DMZ Setup Issue

I have an ASA 5505 running v8.4. I have one static IP that my ISP gives me and I need to use that for my INSIDE network as well as my DMZ. This becomes a PAT issue as I need some ports to terminate ...
1
vote
1answer
922 views

FTPS server in DMZ. Force different IP addresses for passive mode

I'm setting up an FTP server with TLS/SSL encryption (FTPS, not SFTP). The server would be placed in DMZ. This means that it has tho interfaces: one for connections from the company's network and the ...
0
votes
2answers
932 views

Name Resolution in a DMZ

We're building a new set of web servers to be located in a DMZ, but we want them to be able to use our internal mail server. The mail server has a CNAME of smtp.uk.ourdomain.com - our existing servers ...
0
votes
2answers
659 views

Port Forwarding failing only to Ubuntu servers from Draytek router

I know this is a kinda unusal question, but Draytek support (..which is very eager to solve the issue) seems to reach its limits. Scenario: Draytek Vigor Multiwan router with current firmware. ...
1
vote
2answers
1k views

Should I Run TMG as a Hyper-V Guest

Okay here's an interesting question. In two parts: Is it advisable to run TMG as a hyper-v guest in production? (something is nagging me that it's not a good idea, but it's possible to give a VM ...
2
votes
4answers
3k views

To DMZ or not-DMZ on new web site

We are about to release a web application for our users, and are trying to figure out if others put their servers in a DMZ, or just keep it off the domain behind the firewall and greatly restrict ...
1
vote
1answer
609 views

Windows Vpn Server Role in DMZ?

I work on a small business network that runs on a windows server 2008 R2 domain. Right now we use a Cisco (Linksys) RV042 router to handle both VPN connections and a single Site-Site vpn. However, ...
14
votes
2answers
767 views

How big of a problem is it to punch a hole in the DMZ to one web server?

We currently have our web server in a DMZ. The web server cannot see anything within the internal network, but the internal network can see the web server. How safe would it be to punch a hole in the ...
3
votes
1answer
7k views

What is a DMZ in the simplest of examples?

I am new to the world of networking and am having a hard time understanding what a DMZ is. I understand a DMZ is where you place publicly accessible servers such as Web servers, Mail servers, etc. ...
0
votes
2answers
429 views

Connecting from DMZ machine to Server 2003 on a domain?

We have a web server on a DMZ that needs to read/write to a single file location on our Server 2003 Domain. What is the best way to do this?
0
votes
1answer
354 views

port forwarding to server outside dmz from one inside dmz

we are running mysql replication between a server outside dmz and one inside dmz, for this we need port forwarding. We have had it set up, but it recently stopped working. Just before we added a rule ...
0
votes
2answers
1k views

How to share a SAN(Storage Area Network) Environment between servers in DMZ and a internal Network?

My current (imaginary) setup has a DMZ with two servers and an internal network with two more servers Servers in DMZ- Webserver (Company Website), Proxy Servers in the internal Network - Messaging ...
4
votes
3answers
8k views

Placing a server in the DMZ vs opening firewall ports

When should you place a server in a DMZ vs opening ports on the firewall and keeping it within the network? I'm referring to active directory servers, IIS servers, and mostly things on a windows based ...
0
votes
1answer
1k views

Sonicwall NSA 240, Configured for LAN and DMZ, X0 and X2 on same switch - ping issues

Our Sonicwall vendor supplied and networked the NSA240 when we required a DMZ in our infrastructure. This was configured and appeared correct although VPN users periodically dropped DNS and Terminal ...
1
vote
2answers
224 views

How to redesign our network?

We currently have three networks, X.X.163.1, X.X.93.1 and 192.168.1.1. Today's setup is like this: We now have PPT VPN from internet to the X.X.163.1-network, but really need to access the files ...
2
votes
3answers
263 views

network topology including many services

I know this is yet another question on how to setup network but I hope you are not bored of such questions yet. The site is also an office, so it includes windows dc, windows ad, exchange, sql, file ...
1
vote
4answers
727 views

Putting a Windows DC, Exchange in a DMZ

I have one guy at my company telling me that I should put FF:TMG in between my main Internet-facing firewall (Cisco 5510) and put my Exchange server and DC on the internal network. I have another guy ...
0
votes
1answer
328 views

DMZ setup and firewall throughput limit

I am in the process of moving server room into the datacenter and it is a good time to review current setup for security zones.We are using Vsphere 4 Standard and Cisco ASA 5510 firewall. At the ...
1
vote
3answers
182 views

Securing VPN access from users machines (home office)

We already have a couple of people working from home, accessing some internal servers via VPN. They're all using company provided laptops or PCs which we have complete control over. Now we're faced ...
0
votes
1answer
258 views

Securing internal data accessed by a website on the big, bad internet

A close relative of this question on Stack Overflow: When you have a web site in your DMZ that needs to access production data stored on an internal DB, what strategies do you recommend using to ...
2
votes
5answers
2k views

SFTP: How to keep data out of the DMZ

We are investigating solutions to the following problem: We have external (Internet) users who need access to sensitive information. We could offer it to them via SFTP which would offer a secure ...
0
votes
2answers
386 views

Reverse Proxy - Can I use one IP for multiple hosts?

I would like to setup an internal box that all all external traffic gets forwarded to, and then onto the relevant boxes in-house. I would like to know the following: If I have two servers in-house, ...
2
votes
5answers
1k views

DMZ configuration and firewall throughput

I've been asked to look into placing a firewall between a webserver (Debian/Apache/PHP) in the DMZ and a backend MySQL database to achieve "isolation". Right now, iptables is running on the MySQL ...
-1
votes
1answer
166 views

is opening DNZ will cause security problem? [closed]

I build a home server with Xampp. When route my local ip addres with NAT there is virtual server and DNZ. If I only full fiel virtual server my http port not opens.if I enable DNZ then I can reach my ...
2
votes
1answer
537 views

What's the best method of achieving device isolation in a DMZ?

I have an ADSL connection which has a /29 subnet allocated to it, giving me 6 usable IP addresses. Currently this has a cheap Netgear ADSL router attached, which has a built in switch. There are 3 ...
5
votes
6answers
5k views

Does Wireshark pose a threat when installed on a server in the DMZ?

If you install wireshark on a web server sitting in the DMZ, is there a hack that can be used to get backdoor entrace to that server even when RDP is disblaed? I'm trying to monitor the wire on the ...
2
votes
1answer
827 views

Is it necessary to have DMZ machine or zone on a network?

Is it necessary to have DMZ machine or zone on a network? What reasons are there for having a DMZ machine or zone? If the DMZ zone cannot communicate with the normal network at a site, why have it?
1
vote
3answers
897 views

Blade Enclosure, Multiple Blade Servers, Whats the closest approximation to a DMZ?

I appreciate that to get a proper DMZ, one should have a physical separation between the DMZ servers and the LAN servers, with a firewall server in between. But, in a network consisting of a single ...
1
vote
1answer
310 views

Persistent TCP connection in DMZ

A vendor is requesting to allow persistent tcp (not port 80) connection between a server in the DMZ and the internal network. I don't have much experience with this setting. Can anyone shed some light ...
-1
votes
1answer
587 views

FTP in DMZ, TCP Ports for LDAP Auth

szenario: (outside)---(ASA5510)---(inside) ->Windows2008 DC .....................(dmz) ..........->Win2008 FTP Server Which Ports do I need to open from DMZ->Inside that FTP Users can ...
1
vote
3answers
2k views

Cisco Multi-DMZ firewall

I need to find a firewall that will give me 1 LAN port, and 5-7 DMZ ports. I have a requirement to replace some FreeBSD systems that are used to run some testing equipment. It is essential that the ...
7
votes
4answers
12k views

Should a webserver in the DMZ be allowed to access MSSQL in the LAN?

This should be a very basic question and I tried to research it and couldn't find a solid answer. Say you have a web server in the DMZ and a MSSQL server in the LAN. IMO, and what I've always ...
2
votes
2answers
206 views

Just LB or also Web Servers in Demilitarized Zone?

In a load balanced environment, is it necessary to have all of the web servers in the DMZ? Or will just having the Load Balancer in the DMZ achieve the desired security? If it matters, the web ...
1
vote
2answers
1k views

Proper Network Infastructure Setup DMZ, VPN, Routing Hardware Question

Greetings Server Fault Universe, So here's a quick background. Two weeks ago I started a new position as the systems administrator for an expanding health services company of just over 100 persons. ...
1
vote
4answers
2k views

ESX servers in a DMZ

I have two ESX 3.5 servers in a DMZ. I can access these servers on any port from my LAN via a VPN. Servers in the DMZ are unable to initiate connections back to the LAN, for obvious reasons. I have a ...
0
votes
1answer
96 views

New router messed up server 2003 setup

Hey, We were sent a new 2wire router today configured it as best we can to match the old bt voyager. We've also got X static IP's. We've manage to get our webserver on one of the new IP's public ...
1
vote
1answer
503 views

Virtual firewall in existing network DMZ?

A network configuration question from a relative newbie... We have an existing LAN setup, with a hardware firewall (D-Link DIR-655) and a Microsoft Small Business Server (which does the DHCP). We ...
1
vote
1answer
480 views

ISA Server: How to troubleshoot DHCP problem?

I've added a DHCP Server to my ISA Server. The purpose of the DHCP server is to provide addresses to a DMZ (on its own interface) for misc computers that need internet access but don't need to be part ...
1
vote
1answer
581 views

DMZ - LAN and Webserver

i know that DMZ should contain servers that acts as a middle point between the trusted area like LAN and the other semi or non trusted area like internet or another DMZ. based on this declaration our ...
1
vote
2answers
4k views

Cisco VPN Client dropping connection

Using Windows XP and Cisco VPN client version 5.0.4.xxx to connect to a remote customer site. We are able to establish the connection and start an RDP session, but within 1-2 minutes the connection ...
0
votes
2answers
200 views

Can I make VM's accessible over VPN, but not LAN?

In the near future, my firm will begin hosting Terminal Services systems for a few business customers. The Terminal Services Servers will be VM's on one of two large VM hosts. To provide secure ...
2
votes
4answers
7k views

If you need to open ports from DMZ to LAN, at what point is the separation no longer worth it?

If you have a DMZ with one or more servers/services (maybe FTP, HTTP en SMTP). And you have a LAN with typical serversservices (like file sharing, Active Directory, database server). Depending on ...
0
votes
1answer
651 views

IIS FTP - Users Last Logon

How would you determine the last FTP logon time/date for a bunch of local user accounts on a DMZ (standalone/workgroup) server running IIS FTP? I know I could use a log aggregator and sift through it ...