Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 1 down vote favorite

I have the following use case - There are two networks - internal network where the application server is deployed and has no internet access and external network that is accessible from internet but it cannot access the internal network. So the access looks something like this:

internet <---> external network <---- internal network <----> web application server

What I need is a way to be able to process user requests coming from internet in the web application server. Is there a ready solution for this problem?

share|improve this question
2  
Yes, it's called routing. – Niklas Mar 13 '12 at 17:47
Please reread your own question "external network ... cannot access the external network" doesn't make sense to me. – Anders Abel Mar 13 '12 at 17:47
@Nikklas B. Rerouting how? There should be something like a queue in the external network that keeps the requests there and they processed by something in the internal network. – Adrian Mitev Mar 13 '12 at 17:50
I think putting a message oriented middleware system on the external network that communicates via a message listener that releases carrier pidgeons from cages, that then deliver letters to the app server room has the most RAM. – YuRDeD Mar 13 '12 at 17:51
I need it to look synchronous to the user in a request - response way. – Adrian Mitev Mar 13 '12 at 17:52
show 1 more comment

migrated from stackoverflow.com Mar 13 '12 at 21:09

3 Answers

up vote 3 down vote

You're describing a typical multi-tier web application.

Internet - Firewall - DMZ - Firewall - Internal Network

Typical multi-tier security architecture puts the application server on the internal network and the web server (no business/application logic) in the DMZ. Allow traffic from the Internet into your DMZ, to your web server only, on port 80 and/or 443. Allow traffic from the DMZ, from the webserver only, to the internal network, to your application server only, on whatever port(s) is required and no more.

All communications to you web app now terminate in your DMZ, protecting the business logic and whatever backend database you're using from attack.

share|improve this answer
up vote 2 down vote

Why do you have web server in intranet? Is there any special reason for this? Logical place for web server is DMZ.

DMZ should be separated from intranet by one firewall and from Internet by another one.

You can place Reverse Proxy in your external network, but anyway you'll have to open communication from RP to your web server.

I hope this will help you.

Regards

share|improve this answer
There are numerous reasons for the web server to be on the internal network. Usually it's an internal app server that isn't normally available externally. In that case putting it in the DMZ is not the right solution. – Chris Lively Mar 13 '12 at 17:57
1  
If this is the case, Adrian can build Reverse Proxy (Apache, oracle webcache or something similar) and put it in dmz. – Tiho Mar 13 '12 at 18:00
I cannot open the communication from RP to the web server. It's an already existing network that i cannot change. – Adrian Mitev Mar 14 '12 at 11:24
So far I haven't heard about such application. But I think that i shouldn't be to difficult to make app with two server socket, one exposed to Internet, an the other one exposed to internal network. Than you'll have to initiate you comm from WAS to that proxy app, and reroute through it everything you get from Internet on first server socket. I hope you understood the concept. – Tiho Mar 14 '12 at 14:00
up vote 0 down vote

Usually you do the following: 1. Establish an external IP address for this server. 2. Add an external DNS entry for that IP address for your application. 3. Add a route to your firewall that passes 80 (or 443) traffic for that external IP to your internal web server.

Your comments about a "Queue" etc are.. interesting. I'm not sure why you would set up a queuing system unless the app server is a web services box and you are trying to expose certain functionality. Regardless, it sounds like over engineering that isn't going to net you anything security wise.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.