In computer security, a DMZ, or demilitarized zone is a physical or logical subnetwork that contains and exposes an organization's external services to a larger untrusted network, usually the Internet. The term is normally referred to as a DMZ by information technology professionals. It is sometimes ...

learn more… | top users | synonyms

2
votes
2answers
1k views

What would a simple DMZ look like for scenario of database server and (web server+middle tier)?

I have two Linux servers: The first contains an Oracle 11G database that includes an Oracle HTTP Server The second contains a Java middle tier plus Apache webserver and Apache Tomcat. Someone ...
0
votes
1answer
131 views

Exsposing owa to internet but not via DMZ?

I need to give internet access to my test Exchange 2003 milieu via owa, which is on my internal network (10-network) which is a milieu whith 5 virtual machines on hyper-V! How do I do that when using ...
0
votes
1answer
481 views

Combine two NIC's into one preserving routing (DMZ server / Windows or Linux)

We have a DMZ server with two NIC's, one is accessed from the Internet (public IP) and one from behind the internal firewall (private IP). One application has problems to cope with a 2 IP's / 2 NIC's ...
-2
votes
1answer
625 views

Can an attacker exploit the vulnerability of the firewall to access the www server?

What happens if an attacker has found a technique for sending packets through the firewall to the DMZ without the packets being checked? Suppose the attacker doesn't know the internal addresses of ...
2
votes
3answers
264 views

ASA: How to connect server with a external IP address already assigned?

Any ideas how this can be done on a ASA? There was a sonicwall in place but it just died and we do not have a replacement besides this ASA. The 24.172.x.132 is a spam filter and I can't change the IP ...
3
votes
3answers
1k views

How to collect logs with syslog-ng from www servers in dmz and send them to server behind firewall(NAT). Can Zabbix proxy solve this?

I have several www servers in DMZ. My monitoring and log gathering server lays in my LAN. There is no comunication like WWW server in DMZ ----> monitor server in LAN. I can connect DMZ from my ...
1
vote
3answers
990 views

Find all internet facing servers

We have a large network with many servers. What is the easiest way to find all the servers that are Internet facing? Manually checking each server is not an option.
-1
votes
1answer
131 views

Are Network, or Port Assignments the physical router port as opposed to the logical (software configuration) router port?

I've been looking at the port assignments on my router in the linked Open-WRT Wiki, and I'm not sure if the column that reads Network is the actual physical port, or if the Port Assignment is the ...
5
votes
2answers
3k views

Exposing IMAP server to Internet: DMZ or Port Forwarding?

We currently have all our email stored on a Dovecot IMAP server in our internal network. Client machines on the network are able to connect and access their email. Now we want to allow certain users ...
1
vote
3answers
481 views

Accessing Internet from the DMZ

I am trying to configure a DMZ using IPCop but it looks like the default configuration for a DMZ in IPCop is no DHCP and no access to Internet. Even when I manually configure IPCop as my default ...
1
vote
2answers
672 views

Multiple blades in one chassis, some in DMZ, some in internal network

This question is similar to: Blade Enclosure, Multiple Blade Servers, Whats the closest approximation to a DMZ? In my case, I don't have virtualization so I cannot use vLANs as suggested in answers ...
8
votes
2answers
4k views

Is there a secure way to allow IIS 7 in a DMZ to access a DB server behind the firewall?

Our network admins are adamant that it is insecure for our web servers, which are hosted in the DMZ, to access the DB server behind our firewall. To get round the problem, we access the data via web ...
0
votes
1answer
646 views

DNS (Bind9) Behind Firewall

Im running ubuntu 10.04 and Bind9 behind a firewall. I have forwarded Ports 53 (UDP/TCP) to the local server (192.168.0.4). The DNS system seems to be hit-and-miss when the firewall is enabled, ...
6
votes
2answers
3k views

DMZ subnet: to NAT or not to NAT?

I'm looking at setting up a DMZ behind a Cisco ASA that will contain a large number of HTTP front-end load balancers and SSL offload services - over 100 IPs, concentrated on a smaller number of hosts. ...
2
votes
3answers
3k views

Cisco ASA 5505 DMZ Setup Issue

I have an ASA 5505 running v8.4. I have one static IP that my ISP gives me and I need to use that for my INSIDE network as well as my DMZ. This becomes a PAT issue as I need some ports to terminate ...
1
vote
1answer
936 views

FTPS server in DMZ. Force different IP addresses for passive mode

I'm setting up an FTP server with TLS/SSL encryption (FTPS, not SFTP). The server would be placed in DMZ. This means that it has tho interfaces: one for connections from the company's network and the ...
0
votes
2answers
968 views

Name Resolution in a DMZ

We're building a new set of web servers to be located in a DMZ, but we want them to be able to use our internal mail server. The mail server has a CNAME of smtp.uk.ourdomain.com - our existing servers ...
0
votes
2answers
659 views

Port Forwarding failing only to Ubuntu servers from Draytek router

I know this is a kinda unusal question, but Draytek support (..which is very eager to solve the issue) seems to reach its limits. Scenario: Draytek Vigor Multiwan router with current firmware. ...
1
vote
2answers
1k views

Should I Run TMG as a Hyper-V Guest

Okay here's an interesting question. In two parts: Is it advisable to run TMG as a hyper-v guest in production? (something is nagging me that it's not a good idea, but it's possible to give a VM ...
2
votes
4answers
3k views

To DMZ or not-DMZ on new web site

We are about to release a web application for our users, and are trying to figure out if others put their servers in a DMZ, or just keep it off the domain behind the firewall and greatly restrict ...
1
vote
1answer
619 views

Windows Vpn Server Role in DMZ?

I work on a small business network that runs on a windows server 2008 R2 domain. Right now we use a Cisco (Linksys) RV042 router to handle both VPN connections and a single Site-Site vpn. However, ...
14
votes
2answers
777 views

How big of a problem is it to punch a hole in the DMZ to one web server?

We currently have our web server in a DMZ. The web server cannot see anything within the internal network, but the internal network can see the web server. How safe would it be to punch a hole in the ...
3
votes
1answer
7k views

What is a DMZ in the simplest of examples?

I am new to the world of networking and am having a hard time understanding what a DMZ is. I understand a DMZ is where you place publicly accessible servers such as Web servers, Mail servers, etc. ...
0
votes
2answers
434 views

Connecting from DMZ machine to Server 2003 on a domain?

We have a web server on a DMZ that needs to read/write to a single file location on our Server 2003 Domain. What is the best way to do this?
0
votes
1answer
358 views

port forwarding to server outside dmz from one inside dmz

we are running mysql replication between a server outside dmz and one inside dmz, for this we need port forwarding. We have had it set up, but it recently stopped working. Just before we added a rule (...
0
votes
2answers
1k views

How to share a SAN(Storage Area Network) Environment between servers in DMZ and a internal Network?

My current (imaginary) setup has a DMZ with two servers and an internal network with two more servers Servers in DMZ- Webserver (Company Website), Proxy Servers in the internal Network - Messaging (...
5
votes
3answers
8k views

Placing a server in the DMZ vs opening firewall ports

When should you place a server in a DMZ vs opening ports on the firewall and keeping it within the network? I'm referring to active directory servers, IIS servers, and mostly things on a windows based ...
0
votes
1answer
1k views

Sonicwall NSA 240, Configured for LAN and DMZ, X0 and X2 on same switch - ping issues

Our Sonicwall vendor supplied and networked the NSA240 when we required a DMZ in our infrastructure. This was configured and appeared correct although VPN users periodically dropped DNS and Terminal ...
1
vote
2answers
225 views

How to redesign our network?

We currently have three networks, X.X.163.1, X.X.93.1 and 192.168.1.1. Today's setup is like this: We now have PPT VPN from internet to the X.X.163.1-network, but really need to access the files ...
2
votes
3answers
265 views

network topology including many services

I know this is yet another question on how to setup network but I hope you are not bored of such questions yet. The site is also an office, so it includes windows dc, windows ad, exchange, sql, file ...
1
vote
4answers
743 views

Putting a Windows DC, Exchange in a DMZ

I have one guy at my company telling me that I should put FF:TMG in between my main Internet-facing firewall (Cisco 5510) and put my Exchange server and DC on the internal network. I have another guy ...
1
vote
1answer
330 views

DMZ setup and firewall throughput limit

I am in the process of moving server room into the datacenter and it is a good time to review current setup for security zones.We are using Vsphere 4 Standard and Cisco ASA 5510 firewall. At the ...
1
vote
3answers
184 views

Securing VPN access from users machines (home office)

We already have a couple of people working from home, accessing some internal servers via VPN. They're all using company provided laptops or PCs which we have complete control over. Now we're faced ...
0
votes
1answer
276 views

Securing internal data accessed by a website on the big, bad internet

A close relative of this question on Stack Overflow: When you have a web site in your DMZ that needs to access production data stored on an internal DB, what strategies do you recommend using to ...
2
votes
5answers
2k views

SFTP: How to keep data out of the DMZ

We are investigating solutions to the following problem: We have external (Internet) users who need access to sensitive information. We could offer it to them via SFTP which would offer a secure ...
0
votes
2answers
388 views

Reverse Proxy - Can I use one IP for multiple hosts?

I would like to setup an internal box that all all external traffic gets forwarded to, and then onto the relevant boxes in-house. I would like to know the following: If I have two servers in-house, ...
2
votes
5answers
1k views

DMZ configuration and firewall throughput

I've been asked to look into placing a firewall between a webserver (Debian/Apache/PHP) in the DMZ and a backend MySQL database to achieve "isolation". Right now, iptables is running on the MySQL ...
-1
votes
1answer
178 views

is opening DNZ will cause security problem? [closed]

I build a home server with Xampp. When route my local ip addres with NAT there is virtual server and DNZ. If I only full fiel virtual server my http port not opens.if I enable DNZ then I can reach my ...
2
votes
1answer
543 views

What's the best method of achieving device isolation in a DMZ?

I have an ADSL connection which has a /29 subnet allocated to it, giving me 6 usable IP addresses. Currently this has a cheap Netgear ADSL router attached, which has a built in switch. There are 3 ...
5
votes
6answers
5k views

Does Wireshark pose a threat when installed on a server in the DMZ?

If you install wireshark on a web server sitting in the DMZ, is there a hack that can be used to get backdoor entrace to that server even when RDP is disblaed? I'm trying to monitor the wire on the ...
2
votes
1answer
843 views

Is it necessary to have DMZ machine or zone on a network?

Is it necessary to have DMZ machine or zone on a network? What reasons are there for having a DMZ machine or zone? If the DMZ zone cannot communicate with the normal network at a site, why have it?
1
vote
3answers
911 views

Blade Enclosure, Multiple Blade Servers, Whats the closest approximation to a DMZ?

I appreciate that to get a proper DMZ, one should have a physical separation between the DMZ servers and the LAN servers, with a firewall server in between. But, in a network consisting of a single ...
1
vote
1answer
316 views

Persistent TCP connection in DMZ

A vendor is requesting to allow persistent tcp (not port 80) connection between a server in the DMZ and the internal network. I don't have much experience with this setting. Can anyone shed some light ...
-1
votes
1answer
591 views

FTP in DMZ, TCP Ports for LDAP Auth

szenario: (outside)---(ASA5510)---(inside) ->Windows2008 DC .....................(dmz) ..........->Win2008 FTP Server Which Ports do I need to open from DMZ->Inside that FTP Users can ...
1
vote
3answers
2k views

Cisco Multi-DMZ firewall

I need to find a firewall that will give me 1 LAN port, and 5-7 DMZ ports. I have a requirement to replace some FreeBSD systems that are used to run some testing equipment. It is essential that the ...
7
votes
4answers
12k views

Should a webserver in the DMZ be allowed to access MSSQL in the LAN?

This should be a very basic question and I tried to research it and couldn't find a solid answer. Say you have a web server in the DMZ and a MSSQL server in the LAN. IMO, and what I've always ...
2
votes
2answers
207 views

Just LB or also Web Servers in Demilitarized Zone?

In a load balanced environment, is it necessary to have all of the web servers in the DMZ? Or will just having the Load Balancer in the DMZ achieve the desired security? If it matters, the web ...
1
vote
2answers
1k views

Proper Network Infastructure Setup DMZ, VPN, Routing Hardware Question

Greetings Server Fault Universe, So here's a quick background. Two weeks ago I started a new position as the systems administrator for an expanding health services company of just over 100 persons. ...
1
vote
4answers
2k views

ESX servers in a DMZ

I have two ESX 3.5 servers in a DMZ. I can access these servers on any port from my LAN via a VPN. Servers in the DMZ are unable to initiate connections back to the LAN, for obvious reasons. I have a ...
0
votes
1answer
96 views

New router messed up server 2003 setup

Hey, We were sent a new 2wire router today configured it as best we can to match the old bt voyager. We've also got X static IP's. We've manage to get our webserver on one of the new IP's public ...