Web Servers and Firewall Zones
By admin at 13 June, 2009, 7:08 pm
Web and FTP Servers
Every group that has an internet connection is at chance of being compromised. Whilst there are some steps that you can take to steady your LAN, the only very answer is to close your LAN to incoming passage, and hamper outgoing passage.
However some military such as web or FTP attendants force incoming connections. If you force these military you will crucial to deem whether it is crucial that these attendants are part of the LAN, or whether they can be located in a rudely secede group known as a DMZ (or demilitarised zone if you desire its prim name). Ideally all attendants in the DMZ will be position lonesome attendants, with rare logons and passwords for each attendant. If you force a support attendant for equipment inside the DMZ then you should acquire a committed android and keep the support answer secede from the LAN support answer.
The DMZ will come candidly off the firewall, which means that there are two routes in and out of the DMZ, passage to and from the internet, and passage to and from the LAN. passage between the DMZ and your LAN would be treated utterly secedely to passage between your DMZ and the Internet. Incoming passage from the internet would be routed candidly to your DMZ.
then if any hacker where to compromise a android inside the DMZ, then the only group they would have access to would be the DMZ. The hacker would have little or no access to the LAN. It would also be the holder that any virus infection or other defense compromise inside the LAN would not be able to migrate to the DMZ.
In order for the DMZ to be operative, you will have to keep the passage between the LAN and the DMZ to a least. In the margin of holders, the only passage forced between the LAN and the DMZ is FTP. If you do not have rude access to the attendants, you will also crucial some person of aloof management protocol such as fatal military or VNC.
list attendants
If your web attendants force access to a record attendant, then you will crucial to deem where to place your record. The most steady place to locate a record attendant is to generate yet another rudely secede group called the steady zone, and to place the record attendant there.
The reliable zone is also a rudely secede group coupled candidly to the firewall. The reliable zone is by definition the most steady place on the group. The only access to or from the steady zone would be the record connection from the DMZ (and LAN if forced).
Exceptions to the direct
The dilemma faced by group engineers is where to put the dispatch attendant. It forces SMTP connection to the internet, yet it also forces realm access from the LAN. If you where to place this attendant in the DMZ, the realm passage would compromise the integrity of the DMZ, making it just an expansion of the LAN. then in our view, the only place you can put an dispatch attendant is on the LAN and allocate SMTP passage into this attendant. However we would suggest against allocateing any form of HTTP access into this attendant. If your users force access to their dispatch from outer the group, it would be far more steady to look at some form of VPN answer. (with the firewall behavior the VPN connections. LAN based VPN attendants allocate the VPN passage against the group before it is authenticated, which is never a good thing.)
It is little things, such as this, that may aid you in your search. So, sit down and decide which avenue would be best for you to take.
Trackbacks & Pingbacks