Is it safe to open ports 80 and 443 in a home network

Question

The intention behind this is that I'll be able to host a website from a home server (another pc with ECC ram etc.), but what worries me is that the network I'm using is also the same network which I use in my normal daily activities (my home network).

Before sending a request to my housing company to open those ports I want to make sure that it really is safe to open those ports as I do not have access to the "sharing center" nor its infrastructure (I do not know the correct term in English but it's the place where the internet is distributed(?) between tenants), although I do have my own router with its own firewall.

Currently: Sharing center (closed, need to open a few ports) -> router (port forwarded) -> pc (open ports)

On a side note, I suppose you can host multiple different websites under different domains on the same port? (no need for explanation here, I can look that up)

Answer 1

Generally the best practice for this is to have a DMZ. The DMZ is a subnet for any servers (like web servers) which will service requests from clients off your network. In addition any databases or other devices/servers that are needed to provide services for the web servers should live in the DMZ (preferably each on their own VLANs). These external facing servers sit behind a firewall (which only allows proper http or https traffic to go to your DMZ). Additionally, if you are protecting sensitive information I would use a Web Application Firewall (WAF). There are good free ones out there. The WAF will inspect the http/https traffic and filter out a huge collection of known malicious http/https sql etc attacks common to web servers.

One major purpose of this design is to limit the damage in the (reasonably likely) event that somebody manages to compromise your web server.

note* The DMZ should not be able to initiate connections into your internal network. You only want internal to DMZ traffic (not DMZ to internal).