Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [dmz]

In computer security, a DMZ, or demilitarized zone is a physical or logical subnetwork that contains and exposes an organization's external services to a larger untrusted network, usually the Internet. The term is normally referred to as a DMZ by information technology professionals. It is sometimes referred to as a perimeter network.

1
vote
1answer
741 views

API exposing services running on LAN to serve website in DMZ

I have a team of developers who are writing both an intranet and external website. The website consists of two servers and a load balancer, inside a DMZ. The DMZ has a pinhole open to the LAN (http/...
1
vote
2answers
740 views

Do I need to place a physical server/host within the DMZ to host servers/applications?

We are moving to a new office, and part is to review our current LAN/WAN and server access to/from the web. I understand how the DMZ works, but can't figure out if I need a physical server/host to be ...
1
vote
2answers
872 views

Linux - Get Outbound/Inbound Traffic by IP address

I am hosting a website and I found that the traffic on my server is quite high. My Linux server is behind a router in a DMZ. I would like to see the traffic made on my Linux box on the eth0 interface,...
2
votes
2answers
11k views

How to configure totally open DMZ with OpenWRT?

I have OpenWRT router. I have NAS in my LAN, which i need to access from WAN and from all computers in the LAN. So, it should be accessible from any computer and it needs to access some of them, too. ...
3
votes
1answer
94 views

How can I tell if a host is bridged and acting as a router

I would like to scan my DMZ for hosts that are bridged between subnets and have routing enabled. Since I have everything from VMWare servers, to load balancers on the DMZ I'm unsure if every host is ...
4
votes
1answer
2k views

How to place a virtual machine in DMZ?

I have an Ubuntu 12.04 server running few virtual machines with KVM. I would like to expose some of these virtual machines on the internet, to make it possible for customers to test the products we'...
7
votes
4answers
282 views

Security for university research lab systems

Being responsible for security in a university computer science department is no fun at all. And I explain: It is often the case that I get a request for installation of new hw systems or software ...
3
votes
1answer
1k views

Best practices for LDAP and DMZ

We are in the process of setting up a DMZ and I have stumbled into the question of how to handle machines that need to have ports exposed to the internet, but at the same time be able to make LDAP ...
2
votes
2answers
634 views

Internal traffic card and external traffic cards on the same server… how to configure?

This might sound like a noob question, but here is what I have to configure: FreeBSD 1 server with 2 network cards 1 network card for internal IP addresses (5 of them) 1 network card for external IP ...
0
votes
1answer
331 views

Centralizing our FTP processes via an SFTP server in our DMZ

We have a number of various FTP processes, running on various internal servers, that connect with outside vendors to send or receive sensitive data files. As such, we don't have one centralized place ...
0
votes
1answer
2k views

Giving a VM access to a physical NIC on the host

I am running VMware Server 2.0.2 with 2 VM's. One of the VM's I want to have bridged with the domain/primary NIC of the host which I have done successfully. I want the other VM to have access to only ...
4
votes
1answer
15k views

DMZ Setup with two firewalls - Traffic from DMZ to LAN and LAN to DMZ

I am setting up a network with machines that need to be accessible from the internet. I'm planning on putting these in a DMZ. Some of the machines in the DMZ need access to machines on the private ...
2
votes
2answers
2k views

Reverse Proxy - should it be a different technology stack?

Got a skeptical question about a reverse proxy setup I'm considering. I've currently got a pair of load balanced application servers in the DMZ (S1,S2 in figure below). These accept inbound requests ...
2
votes
1answer
609 views

Howto maximize utilization of assigned subnet block for DMZ

I'm part time sysadmin for a small hosting company with currently 20 different public servers. We have a 27 subnet block that gives us a maximum of 30 usable IP addresses. That much I know, but how do ...
0
votes
2answers
7k views

Fortigate 40c Firewall Configuration

Does anybody know if is it possible to Un-bridge ports on forgiate 40c? I want to use the fortigate 40c to define and control (block/allow) port traffic for the following 4 ip ranges (each ip range ...
1
vote
4answers
1k views

Looking for low cost VPN/DMZ solution [closed]

I am looking to set up a VPN and DMZ solution for a small business. Here is some background and some of their requirements: The is a small business with maybe a dozen servers and another half-dozen ...
0
votes
2answers
16k views

Fortigate Firewall - DMZ vs Interface ports

I'm considering buying a Fortigate 50b (or Fortigate 60b) firewall to separate my web (iis) machine from the DB machine. (See http://www.fortinet.com/doc/FGT50_100DS.pdf) Till now the two servers ...
5
votes
1answer
995 views

Backing up a server on the DMZ

We have a somewhat-static web app with a large amount of media files that runs on a 2008 R2, non-domain server on the DMZ. I need to backup the media files on the server. The current backup mechanism ...
5
votes
2answers
8k views

public ip resolves externally but not internally

I have a one to one NAT on pfsense that assigns a public IP to an internal IP (running a web server). When I open the public IP from an internal machine, it will not resolve to the internal IP, ...
0
votes
1answer
98 views

Connecting to a server inside a DMZ

in this scenario [ net2 / 10.0.1.1 ] ---- [ net1 / 10.0.0.1 ] --- ( Internet ) | | < pc2 > < ...
2
votes
2answers
1k views

What would a simple DMZ look like for scenario of database server and (web server+middle tier)?

I have two Linux servers: The first contains an Oracle 11G database that includes an Oracle HTTP Server The second contains a Java middle tier plus Apache webserver and Apache Tomcat. Someone ...
0
votes
1answer
137 views

Exsposing owa to internet but not via DMZ?

I need to give internet access to my test Exchange 2003 milieu via owa, which is on my internal network (10-network) which is a milieu whith 5 virtual machines on hyper-V! How do I do that when using ...
0
votes
1answer
660 views

Combine two NIC's into one preserving routing (DMZ server / Windows or Linux)

We have a DMZ server with two NIC's, one is accessed from the Internet (public IP) and one from behind the internal firewall (private IP). One application has problems to cope with a 2 IP's / 2 NIC's ...
-2
votes
1answer
991 views

Can an attacker exploit the vulnerability of the firewall to access the www server?

What happens if an attacker has found a technique for sending packets through the firewall to the DMZ without the packets being checked? Suppose the attacker doesn't know the internal addresses of ...
2
votes
3answers
474 views

ASA: How to connect server with a external IP address already assigned?

Any ideas how this can be done on a ASA? There was a sonicwall in place but it just died and we do not have a replacement besides this ASA. The 24.172.x.132 is a spam filter and I can't change the IP ...
3
votes
3answers
2k views

How to collect logs with syslog-ng from www servers in dmz and send them to server behind firewall(NAT). Can Zabbix proxy solve this?

I have several www servers in DMZ. My monitoring and log gathering server lays in my LAN. There is no comunication like WWW server in DMZ ----> monitor server in LAN. I can connect DMZ from my ...
1
vote
3answers
2k views

Find all internet facing servers

We have a large network with many servers. What is the easiest way to find all the servers that are Internet facing? Manually checking each server is not an option.
-1
votes
1answer
146 views

Are Network, or Port Assignments the physical router port as opposed to the logical (software configuration) router port?

I've been looking at the port assignments on my router in the linked Open-WRT Wiki, and I'm not sure if the column that reads Network is the actual physical port, or if the Port Assignment is the ...
6
votes
2answers
4k views

Exposing IMAP server to Internet: DMZ or Port Forwarding?

We currently have all our email stored on a Dovecot IMAP server in our internal network. Client machines on the network are able to connect and access their email. Now we want to allow certain users ...
1
vote
3answers
777 views

Accessing Internet from the DMZ

I am trying to configure a DMZ using IPCop but it looks like the default configuration for a DMZ in IPCop is no DHCP and no access to Internet. Even when I manually configure IPCop as my default ...
1
vote
2answers
920 views

Multiple blades in one chassis, some in DMZ, some in internal network

This question is similar to: Blade Enclosure, Multiple Blade Servers, Whats the closest approximation to a DMZ? In my case, I don't have virtualization so I cannot use vLANs as suggested in answers ...
12
votes
2answers
6k views

Is there a secure way to allow IIS 7 in a DMZ to access a DB server behind the firewall?

Our network admins are adamant that it is insecure for our web servers, which are hosted in the DMZ, to access the DB server behind our firewall. To get round the problem, we access the data via web ...
0
votes
1answer
806 views

DNS (Bind9) Behind Firewall

Im running ubuntu 10.04 and Bind9 behind a firewall. I have forwarded Ports 53 (UDP/TCP) to the local server (192.168.0.4). The DNS system seems to be hit-and-miss when the firewall is enabled, ...
7
votes
2answers
4k views

DMZ subnet: to NAT or not to NAT?

I'm looking at setting up a DMZ behind a Cisco ASA that will contain a large number of HTTP front-end load balancers and SSL offload services - over 100 IPs, concentrated on a smaller number of hosts. ...
3
votes
3answers
4k views

Cisco ASA 5505 DMZ Setup Issue

I have an ASA 5505 running v8.4. I have one static IP that my ISP gives me and I need to use that for my INSIDE network as well as my DMZ. This becomes a PAT issue as I need some ports to terminate ...
1
vote
1answer
1k views

FTPS server in DMZ. Force different IP addresses for passive mode

I'm setting up an FTP server with TLS/SSL encryption (FTPS, not SFTP). The server would be placed in DMZ. This means that it has tho interfaces: one for connections from the company's network and the ...
0
votes
2answers
1k views

Name Resolution in a DMZ

We're building a new set of web servers to be located in a DMZ, but we want them to be able to use our internal mail server. The mail server has a CNAME of smtp.uk.ourdomain.com - our existing servers ...
0
votes
2answers
730 views

Port Forwarding failing only to Ubuntu servers from Draytek router

I know this is a kinda unusal question, but Draytek support (..which is very eager to solve the issue) seems to reach its limits. Scenario: Draytek Vigor Multiwan router with current firmware. ...
1
vote
2answers
1k views

Should I Run TMG as a Hyper-V Guest

Okay here's an interesting question. In two parts: Is it advisable to run TMG as a hyper-v guest in production? (something is nagging me that it's not a good idea, but it's possible to give a VM ...
2
votes
4answers
4k views

To DMZ or not-DMZ on new web site

We are about to release a web application for our users, and are trying to figure out if others put their servers in a DMZ, or just keep it off the domain behind the firewall and greatly restrict ...
1
vote
1answer
1k views

Windows Vpn Server Role in DMZ?

I work on a small business network that runs on a windows server 2008 R2 domain. Right now we use a Cisco (Linksys) RV042 router to handle both VPN connections and a single Site-Site vpn. However, ...
15
votes
2answers
1k views

How big of a problem is it to punch a hole in the DMZ to one web server?

We currently have our web server in a DMZ. The web server cannot see anything within the internal network, but the internal network can see the web server. How safe would it be to punch a hole in the ...
5
votes
1answer
13k views

What is a DMZ in the simplest of examples?

I am new to the world of networking and am having a hard time understanding what a DMZ is. I understand a DMZ is where you place publicly accessible servers such as Web servers, Mail servers, etc. ...
0
votes
2answers
466 views

Connecting from DMZ machine to Server 2003 on a domain?

We have a web server on a DMZ that needs to read/write to a single file location on our Server 2003 Domain. What is the best way to do this?
0
votes
1answer
450 views

port forwarding to server outside dmz from one inside dmz

we are running mysql replication between a server outside dmz and one inside dmz, for this we need port forwarding. We have had it set up, but it recently stopped working. Just before we added a rule (...
0
votes
2answers
2k views

How to share a SAN(Storage Area Network) Environment between servers in DMZ and a internal Network?

My current (imaginary) setup has a DMZ with two servers and an internal network with two more servers Servers in DMZ- Webserver (Company Website), Proxy Servers in the internal Network - Messaging (...
5
votes
3answers
15k views

Placing a server in the DMZ vs opening firewall ports

When should you place a server in a DMZ vs opening ports on the firewall and keeping it within the network? I'm referring to active directory servers, IIS servers, and mostly things on a windows based ...
0
votes
1answer
2k views

Sonicwall NSA 240, Configured for LAN and DMZ, X0 and X2 on same switch - ping issues

Our Sonicwall vendor supplied and networked the NSA240 when we required a DMZ in our infrastructure. This was configured and appeared correct although VPN users periodically dropped DNS and Terminal ...
1
vote
2answers
261 views

How to redesign our network?

We currently have three networks, X.X.163.1, X.X.93.1 and 192.168.1.1. Today's setup is like this: We now have PPT VPN from internet to the X.X.163.1-network, but really need to access the files ...
2
votes
3answers
299 views

network topology including many services

I know this is yet another question on how to setup network but I hope you are not bored of such questions yet. The site is also an office, so it includes windows dc, windows ad, exchange, sql, file ...