What network topology should be used in a SOHO environment with a publicly available web server?

Question

My home office setup currently has a wireless router running DD-WRT NXT connected to a cable modem. Connected to this router are a number of workstations which I do not have to deal with that I assume are all infected with viruses, malware and root kits, one workstation that I do my best to keep secure, and a NAS that I also do my best to keep secure.

Right now I believe the major threats are from the crap on other people's workstations and someone on the outside attacking the router. I am not worried about malicious users attacking from within the intranet.

I would like to add a web server to the network, but do not know how to best layout the network to minimize the additional risks. While the plan right now is to only host static webpages, I am betting it will be running wordpress in the future if I demonstrate that I can keep a web server running. While it would be nice to host the files for the web server on the NAS, I am willing to host them directly on the server if this improves security.

I was thinking about was simply adding the web server to the network and forwarding the appropriate ports from the router. Does putting the web server on a separate subnet provide any additional security? What about adding a second router between the web server and the main network (i.e., the cable modem is attached to router A which is connect to the web server and router B which is connected to the NAS and workstations).

Answer 1

There's two aspects you should consider:

• The web server will be accessible from internet. That's a pretty big attack surface compared to all the other internal hosts.
• Your internal network might be as dangerous as the internet, the web server should treat it as hostile as well.

You can address both aspects with a simple setup like this:

                   .--.               
               _ -(    )- _           
          .--,(            ),--.      
      _.-(                       )-._ 
     (           INTERNET            )
      '-._(                     )_.-' 
        |  '__,(            ),__'     
        |       - ._(__)_. -          
                     \           \
        |             \            
                       \           \
        |               \
        |           _____\____       \
  Only port 80     [_.Router.°]        
        |           /        \         \
        |          /          \        No incoming traffic
                  /            \         \
        |        /              \          
        |       /                \         \
        v      /                  \         v
     .Public network----.         .Private network.
     |  ________        |         |  ____   __    |
     | |==|=====|       |         | |    | |==|   |
     | |  |     |       |         | |____| |  |   |
     | |  |     |       |         | /::::/ |__|   |
     | |  |     |       |         |               |
     | |  |     |       |<- - - - |               |
     | |  |====°|       |         '---------------'
     | |__|_____|       |  Pt 80 only
     '------------------'

The dotted lines represent logical connections and the full lines are physical connections.

You just setup a separate subnet for the webserver and only allow access to it on port 80 (and perhaps 443).

You should be aware that this makes your router a single point of failure. In a SOHO environment this is usually the case anyway, but it doesn't necessarily have to.

Once this gets beyond the "just to see how it goes" phase you may want to consider hosting it on AWS or other cloud provider. You get the same level of control, much better redundancy, amazing scalability and great security for pennies.