Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [dmz]

In computer security, a DMZ, or demilitarized zone is a physical or logical subnetwork that contains and exposes an organization's external services to a larger untrusted network, usually the Internet. The term is normally referred to as a DMZ by information technology professionals. It is sometimes referred to as a perimeter network.

15
votes
2answers
1k views

How big of a problem is it to punch a hole in the DMZ to one web server?

We currently have our web server in a DMZ. The web server cannot see anything within the internal network, but the internal network can see the web server. How safe would it be to punch a hole in the ...
12
votes
2answers
6k views

Is there a secure way to allow IIS 7 in a DMZ to access a DB server behind the firewall?

Our network admins are adamant that it is insecure for our web servers, which are hosted in the DMZ, to access the DB server behind our firewall. To get round the problem, we access the data via web ...
11
votes
1answer
54 views

Redundant web servers - 1 public addres

I'd like to host redundant internet accessible (NATed) web servers behind a f/w on the same standard ports. If I only have 1 publicly available address do i have to use a reverse proxy or load ...
10
votes
4answers
17k views

Should a webserver in the DMZ be allowed to access MSSQL in the LAN?

This should be a very basic question and I tried to research it and couldn't find a solid answer. Say you have a web server in the DMZ and a MSSQL server in the LAN. IMO, and what I've always ...
8
votes
3answers
6k views

Distinction between an extranet and a DMZ [closed]

I've been reading about intranets, extranets, DMZs and VPNs now, and I'd need some clarifications related to extranets and DMZs. I understand that they are different types of concepts - extranet ...
7
votes
6answers
8k views

Does Wireshark pose a threat when installed on a server in the DMZ?

If you install wireshark on a web server sitting in the DMZ, is there a hack that can be used to get backdoor entrace to that server even when RDP is disblaed? I'm trying to monitor the wire on the ...
7
votes
4answers
282 views

Security for university research lab systems

Being responsible for security in a university computer science department is no fun at all. And I explain: It is often the case that I get a request for installation of new hw systems or software ...
7
votes
2answers
4k views

DMZ subnet: to NAT or not to NAT?

I'm looking at setting up a DMZ behind a Cisco ASA that will contain a large number of HTTP front-end load balancers and SSL offload services - over 100 IPs, concentrated on a smaller number of hosts. ...
6
votes
2answers
2k views

Virtual host on LAN - VMs on DMZ, separate NICs - is this a bad idea?

Just kicking this idea around, and wanted to see if you'll be so kind as to point out the problems I don't see. If I set up this new HyperV host as a normal domain member, the benefits are obvious. ...
6
votes
3answers
7k views

Active Directory in a DMZ

What is the best way to manage user accounts for Windows servers in a DMZ? We are expanding our web presence and adding several IIS servers to our DMZ. I would prefer not to manage a bunch of local ...
6
votes
2answers
4k views

Exposing IMAP server to Internet: DMZ or Port Forwarding?

We currently have all our email stored on a Dovecot IMAP server in our internal network. Client machines on the network are able to connect and access their email. Now we want to allow certain users ...
5
votes
3answers
15k views

Placing a server in the DMZ vs opening firewall ports

When should you place a server in a DMZ vs opening ports on the firewall and keeping it within the network? I'm referring to active directory servers, IIS servers, and mostly things on a windows based ...
5
votes
1answer
990 views

Backing up a server on the DMZ

We have a somewhat-static web app with a large amount of media files that runs on a 2008 R2, non-domain server on the DMZ. I need to backup the media files on the server. The current backup mechanism ...
5
votes
1answer
4k views

Disable EdgeRouter Lite GUI on DMZ interface

I'm using the Ubiquiti EdgeRouter in a SOHO network. I've configured it using the "WAN+2LAN2" wizard, without bridging the LAN ports. This sets up the three port router with eth0 assigned to the WAN,...
5
votes
2answers
8k views

public ip resolves externally but not internally

I have a one to one NAT on pfsense that assigns a public IP to an internal IP (running a web server). When I open the public IP from an internal machine, it will not resolve to the internal IP, ...
5
votes
1answer
12k views

What is a DMZ in the simplest of examples?

I am new to the world of networking and am having a hard time understanding what a DMZ is. I understand a DMZ is where you place publicly accessible servers such as Web servers, Mail servers, etc. ...
4
votes
1answer
15k views

DMZ Setup with two firewalls - Traffic from DMZ to LAN and LAN to DMZ

I am setting up a network with machines that need to be accessible from the internet. I'm planning on putting these in a DMZ. Some of the machines in the DMZ need access to machines on the private ...
4
votes
1answer
4k views

Should I dual home our webservers (DMZ/Internal network) or just do 1-to-1 NAT?

I'm setting up a rack of servers which will have 2 webservers and 10 internal servers that provide back end application support (migrating from an AWS environment). We'll have virtual machine ...
4
votes
1answer
2k views

How to place a virtual machine in DMZ?

I have an Ubuntu 12.04 server running few virtual machines with KVM. I would like to expose some of these virtual machines on the internet, to make it possible for customers to test the products we'...
3
votes
7answers
4k views

Should databases containing customer information go in a DMZ?

We're deploying a simple newsletter webapp on a stand-alone LAMP platform in the company DMZ. There is some discussion as to whether the MySQL server should be removed from the DMZ and put in the ...
3
votes
1answer
13k views

VLAN security compared to DMZ

I found this question very illuminating about DMZs and when to place a server in one. We're re-organizing our internal company network (keeping the same external IPs and domains), our mainly Windows ...
3
votes
1answer
1k views

Will you allow NetBIOS into your DMZ?

Is it secure for a firewall to allow NetBIOS connections from the internal network to the DMZ? If not secure, what are the risks? If secure, what is the FUD about and what are the counterarguments?
3
votes
3answers
5k views

Active Directory Domain Controllers in a DMZ

I am looking to deploy 2 additional Windows Server 2003 domain controllers into a separate confidential DMZ alongside 6 DCs that are installed in the regular network, making a total of 8 DCs. The 2 ...
3
votes
3answers
2k views

How to collect logs with syslog-ng from www servers in dmz and send them to server behind firewall(NAT). Can Zabbix proxy solve this?

I have several www servers in DMZ. My monitoring and log gathering server lays in my LAN. There is no comunication like WWW server in DMZ ----> monitor server in LAN. I can connect DMZ from my ...
3
votes
3answers
2k views

Allow internal DNS to be queried from the DMZ?

We have a mail gateway running in a DMZ, which is a relay for our internal mail server holding all the mail. We have come accross the need to use DNS from the DMZ to resolve names of internal services ...
3
votes
1answer
94 views

How can I tell if a host is bridged and acting as a router

I would like to scan my DMZ for hosts that are bridged between subnets and have routing enabled. Since I have everything from VMWare servers, to load balancers on the DMZ I'm unsure if every host is ...
3
votes
1answer
7k views

Where to put OpenVPN server - DMZ or LAN?

We have a Smoothwall firewall with both a "green" network (LAN) and an "orange" network (DMZ), and we would like to use OpenVPN access server as our VPN server. The question is: Should the VPN server ...
3
votes
1answer
1k views

Best practices for LDAP and DMZ

We are in the process of setting up a DMZ and I have stumbled into the question of how to handle machines that need to have ports exposed to the internet, but at the same time be able to make LDAP ...
3
votes
3answers
4k views

Cisco ASA 5505 DMZ Setup Issue

I have an ASA 5505 running v8.4. I have one static IP that my ISP gives me and I need to use that for my INSIDE network as well as my DMZ. This becomes a PAT issue as I need some ports to terminate ...
3
votes
0answers
692 views

Kubernetes - Best Practices for Physical Network Segmentation

Based on the following design constraint, does anyone have any best practices or recommendations regarding how to deploy Kubernetes across multiple network zones? What is the most common and accepted ...
3
votes
0answers
6k views

Allowing LDAP authentication from DMZ to Active Directory. Is my idea secure?

I have a internet-facing application server that I want to use AD authentication. This is my first time doing this for a none MS application or without some sort of proxy. I already have a idea in my ...
2
votes
4answers
10k views

If you need to open ports from DMZ to LAN, at what point is the separation no longer worth it?

If you have a DMZ with one or more servers/services (maybe FTP, HTTP en SMTP). And you have a LAN with typical serversservices (like file sharing, Active Directory, database server). Depending on ...
2
votes
2answers
11k views

How to configure totally open DMZ with OpenWRT?

I have OpenWRT router. I have NAS in my LAN, which i need to access from WAN and from all computers in the LAN. So, it should be accessible from any computer and it needs to access some of them, too. ...
2
votes
4answers
995 views

Putting a Windows DC, Exchange in a DMZ

I have one guy at my company telling me that I should put FF:TMG in between my main Internet-facing firewall (Cisco 5510) and put my Exchange server and DC on the internal network. I have another guy ...
2
votes
5answers
2k views

SFTP: How to keep data out of the DMZ

We are investigating solutions to the following problem: We have external (Internet) users who need access to sensitive information. We could offer it to them via SFTP which would offer a secure ...
2
votes
4answers
4k views

To DMZ or not-DMZ on new web site

We are about to release a web application for our users, and are trying to figure out if others put their servers in a DMZ, or just keep it off the domain behind the firewall and greatly restrict ...
2
votes
2answers
1k views

What would a simple DMZ look like for scenario of database server and (web server+middle tier)?

I have two Linux servers: The first contains an Oracle 11G database that includes an Oracle HTTP Server The second contains a Java middle tier plus Apache webserver and Apache Tomcat. Someone ...
2
votes
3answers
299 views

network topology including many services

I know this is yet another question on how to setup network but I hope you are not bored of such questions yet. The site is also an office, so it includes windows dc, windows ad, exchange, sql, file ...
2
votes
2answers
634 views

Internal traffic card and external traffic cards on the same server… how to configure?

This might sound like a noob question, but here is what I have to configure: FreeBSD 1 server with 2 network cards 1 network card for internal IP addresses (5 of them) 1 network card for external IP ...
2
votes
5answers
1k views

DMZ configuration and firewall throughput

I've been asked to look into placing a firewall between a webserver (Debian/Apache/PHP) in the DMZ and a backend MySQL database to achieve "isolation". Right now, iptables is running on the MySQL ...
2
votes
3answers
291 views

Webservers - Attached to AD or not?

Do you prefer to run their IIS webservers inside a DMZ that is part of the greater organisation's AD or do you prefer to sacrifice ease of management and user control over (possibly perceived) ...
2
votes
3answers
260 views

WinRM Publicly Available

I am looking for specific feedback on WinRM. There are ::still:: debates out there about whether or not making RDP publicly available without a VPN is a good idea--There are no debates on whether or ...
2
votes
1answer
86 views

Web server with access to internet and internet Active Directory [closed]

This might sound like a stupid and unsecure question, but we're front-end web delopers and don't know that much about these things. So here goes.. We're creating a web app where we want to log in ...
2
votes
2answers
2k views

Reverse Proxy - should it be a different technology stack?

Got a skeptical question about a reverse proxy setup I'm considering. I've currently got a pair of load balanced application servers in the DMZ (S1,S2 in figure below). These accept inbound requests ...
2
votes
1answer
659 views

What's the best method of achieving device isolation in a DMZ?

I have an ADSL connection which has a /29 subnet allocated to it, giving me 6 usable IP addresses. Currently this has a cheap Netgear ADSL router attached, which has a built in switch. There are 3 ...
2
votes
1answer
960 views

Is it necessary to have DMZ machine or zone on a network?

Is it necessary to have DMZ machine or zone on a network? What reasons are there for having a DMZ machine or zone? If the DMZ zone cannot communicate with the normal network at a site, why have it?
2
votes
1answer
171 views

Managing ServerCore 2008 R2 in DMZ

I am looking to replace our DMZ servers with Server Core editions but am struggling with remote management. The computers in the DMZ are in a workgroup while the client I am connecting from is on our ...
2
votes
2answers
2k views

Setup DMZ in Pfsense with virtual servers, physical Pfsense server

I am looking for some networking tips on how to set up a DMZ in Pfsense and place some virtual servers in that DMZ. Right now my network looks like: Uverse (Static IPs) -> Pfsense -> WAN -> (Virtual ...
2
votes
3answers
471 views

ASA: How to connect server with a external IP address already assigned?

Any ideas how this can be done on a ASA? There was a sonicwall in place but it just died and we do not have a replacement besides this ASA. The 24.172.x.132 is a spam filter and I can't change the IP ...
2
votes
2answers
273 views

Just LB or also Web Servers in Demilitarized Zone?

In a load balanced environment, is it necessary to have all of the web servers in the DMZ? Or will just having the Load Balancer in the DMZ achieve the desired security? If it matters, the web ...