1

I have the following use case - There are two networks - internal network where the application server is deployed and has no internet access and external network that is accessible from internet but it cannot access the internal network. So the access looks something like this:

internet <---> external network <---- internal network <----> web application server

What I need is a way to be able to process user requests coming from internet in the web application server. Is there a ready solution for this problem?

Improve this question
6
  • 2
    Yes, it's called routing.
    – Niklas B.
    Mar 13, 2012 at 17:47
  • Please reread your own question "external network ... cannot access the external network" doesn't make sense to me.
    – Anders Abel
    Mar 13, 2012 at 17:47
  • @Nikklas B. Rerouting how? There should be something like a queue in the external network that keeps the requests there and they processed by something in the internal network.
    – Adrian Mitev
    Mar 13, 2012 at 17:50
  • I think putting a message oriented middleware system on the external network that communicates via a message listener that releases carrier pidgeons from cages, that then deliver letters to the app server room has the most RAM.
    – YuRDeD
    Mar 13, 2012 at 17:51
  • I need it to look synchronous to the user in a request - response way.
    – Adrian Mitev
    Mar 13, 2012 at 17:52

3 Answers 3

Reset to default
4

You're describing a typical multi-tier web application.

Internet - Firewall - DMZ - Firewall - Internal Network

Typical multi-tier security architecture puts the application server on the internal network and the web server (no business/application logic) in the DMZ. Allow traffic from the Internet into your DMZ, to your web server only, on port 80 and/or 443. Allow traffic from the DMZ, from the webserver only, to the internal network, to your application server only, on whatever port(s) is required and no more.

All communications to you web app now terminate in your DMZ, protecting the business logic and whatever backend database you're using from attack.

Improve this answer
2

Why do you have web server in intranet? Is there any special reason for this? Logical place for web server is DMZ.

DMZ should be separated from intranet by one firewall and from Internet by another one.

You can place Reverse Proxy in your external network, but anyway you'll have to open communication from RP to your web server.

I hope this will help you.

Regards

Improve this answer
4
  • There are numerous reasons for the web server to be on the internal network. Usually it's an internal app server that isn't normally available externally. In that case putting it in the DMZ is not the right solution.
    – NotMe
    Mar 13, 2012 at 17:57
  • 1
    If this is the case, Adrian can build Reverse Proxy (Apache, oracle webcache or something similar) and put it in dmz.
    – Tiho
    Mar 13, 2012 at 18:00
  • I cannot open the communication from RP to the web server. It's an already existing network that i cannot change.
    – Adrian Mitev
    Mar 14, 2012 at 11:24
  • So far I haven't heard about such application. But I think that i shouldn't be to difficult to make app with two server socket, one exposed to Internet, an the other one exposed to internal network. Than you'll have to initiate you comm from WAS to that proxy app, and reroute through it everything you get from Internet on first server socket. I hope you understood the concept.
    – Tiho
    Mar 14, 2012 at 14:00
1

Usually you do the following: 1. Establish an external IP address for this server. 2. Add an external DNS entry for that IP address for your application. 3. Add a route to your firewall that passes 80 (or 443) traffic for that external IP to your internal web server.

Your comments about a "Queue" etc are.. interesting. I'm not sure why you would set up a queuing system unless the app server is a web services box and you are trying to expose certain functionality. Regardless, it sounds like over engineering that isn't going to net you anything security wise.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .