The Stack Overflow podcast is back! Listen to an interview with our new CEO.
2 added 4 characters in body
source | link

There is no single correct answer, it depends very much on your traffic volume, security policies and internal network structure. I will just answer how I would do it on general level.

1) If role of the proxy is just to load balance and cache, you can put proxy and app servers to same DMZ network. Then make a separate DMZ network for the DB servers. DB is where your assets are, so in that sense it deserves a network that is isolated from all other networks. You can use private addresses in the DB server DMZ, but treat it as DMZ network. By this I mean separate network segment and interface on your firewall. If you use the proxy and app servers for other services too, it would be feasible to separate proxies to their own DMZ network as well. Modular highly segmented network will require more throughput from firewall, but will increase security and scale better for future. I would say application server is more vulnerable than proxy, but still I would count them in the same category by their role and then DB server in its own category and separate DMZ network.

If you are taking more than 1 GB/sec traffic, it is reasonable to rethink the architecture and probably ditch the firewall completely.

2) I wouldn’t worry too much about syslog, NTP and SMTP, these are quite old protocols with well-known implementations. In these cases you could allow DMZ devices to use same services as internal devices use. Many people will say that DMZ should not open connections towards internal networks, but I don’t see problem when using this kind of protocols. The benefits outweigh the small security risk.

If you want to separate DNS and you don’t have your own public DNS servers for resolving external addresses, just buy the DNS resolver service from your ISP or some other service provider. Shouldn’t cost too much and will provide extra security.

There is no single correct answer, it depends very much on your traffic volume, security policies and internal network structure. I will just answer how I would do it on general level.

1) If role of the proxy is just to load balance and cache, you can put proxy and app servers to same DMZ network. Then make a separate DMZ network for the DB servers. DB is where your assets are, so in that sense it deserves a network that is isolated from all other networks. You can use private addresses in the DB server DMZ, but treat it as DMZ network. By this I mean separate network segment and interface on your firewall. If you use the proxy and app servers for other services too, it would be feasible to separate proxies to their own DMZ network as well. Modular highly segmented network will require more throughput from firewall, but will increase security and scale better for future. I would say application server is more vulnerable than proxy, but still I would count them in the same category by their role and then DB server in its own category and separate DMZ network.

If you are taking more than 1 GB/sec traffic, it is reasonable to rethink the architecture and probably ditch the firewall completely.

2) I wouldn’t worry too much about syslog, NTP and SMTP, these are quite old protocols with well-known implementations. In these cases you could allow DMZ devices to use same services as internal devices use. Many people will say that DMZ should open connections towards internal networks, but I don’t see problem when using this kind of protocols. The benefits outweigh the small security risk.

If you want to separate DNS and you don’t have your own public DNS servers for resolving external addresses, just buy the DNS resolver service from your ISP or some other service provider. Shouldn’t cost too much and will provide extra security.

There is no single correct answer, it depends very much on your traffic volume, security policies and internal network structure. I will just answer how I would do it on general level.

1) If role of the proxy is just to load balance and cache, you can put proxy and app servers to same DMZ network. Then make a separate DMZ network for the DB servers. DB is where your assets are, so in that sense it deserves a network that is isolated from all other networks. You can use private addresses in the DB server DMZ, but treat it as DMZ network. By this I mean separate network segment and interface on your firewall. If you use the proxy and app servers for other services too, it would be feasible to separate proxies to their own DMZ network as well. Modular highly segmented network will require more throughput from firewall, but will increase security and scale better for future. I would say application server is more vulnerable than proxy, but still I would count them in the same category by their role and then DB server in its own category and separate DMZ network.

If you are taking more than 1 GB/sec traffic, it is reasonable to rethink the architecture and probably ditch the firewall completely.

2) I wouldn’t worry too much about syslog, NTP and SMTP, these are quite old protocols with well-known implementations. In these cases you could allow DMZ devices to use same services as internal devices use. Many people will say that DMZ should not open connections towards internal networks, but I don’t see problem when using this kind of protocols. The benefits outweigh the small security risk.

If you want to separate DNS and you don’t have your own public DNS servers for resolving external addresses, just buy the DNS resolver service from your ISP or some other service provider. Shouldn’t cost too much and will provide extra security.

1
source | link

There is no single correct answer, it depends very much on your traffic volume, security policies and internal network structure. I will just answer how I would do it on general level.

1) If role of the proxy is just to load balance and cache, you can put proxy and app servers to same DMZ network. Then make a separate DMZ network for the DB servers. DB is where your assets are, so in that sense it deserves a network that is isolated from all other networks. You can use private addresses in the DB server DMZ, but treat it as DMZ network. By this I mean separate network segment and interface on your firewall. If you use the proxy and app servers for other services too, it would be feasible to separate proxies to their own DMZ network as well. Modular highly segmented network will require more throughput from firewall, but will increase security and scale better for future. I would say application server is more vulnerable than proxy, but still I would count them in the same category by their role and then DB server in its own category and separate DMZ network.

If you are taking more than 1 GB/sec traffic, it is reasonable to rethink the architecture and probably ditch the firewall completely.

2) I wouldn’t worry too much about syslog, NTP and SMTP, these are quite old protocols with well-known implementations. In these cases you could allow DMZ devices to use same services as internal devices use. Many people will say that DMZ should open connections towards internal networks, but I don’t see problem when using this kind of protocols. The benefits outweigh the small security risk.

If you want to separate DNS and you don’t have your own public DNS servers for resolving external addresses, just buy the DNS resolver service from your ISP or some other service provider. Shouldn’t cost too much and will provide extra security.