I'm wondering if a web load balancer can take over the duties of what would normally be considered the front end server in a DMZ?
In our current environment, we have the classic DMZ setup as illustrated below.
Internet --> Firewall --> DMZ front end server --> Firewall --> Lan Server data
We have a new application coming online that does not have a purpose built front end server from the vendor. Although no data will live on this server, it will be located on the lan. When asked about how to make the application secure, their response was to use a reverse proxy as the front end.
So my question is this- can I simply use our web load balancer to be the "server" in the dmz? Does this pass the sniff test? Does this work in an audit?
Here is an illustration.
Internet --> Firewall --> Load Balancer --> Lan Server
The load balancer by its nature operates as a firewall as port numbers need to be specified. However, the inside interface of the firewall as well as all interfaces of the load balancer (single arm) and the interface of the lan server are all on the same lan network. However, the load balancer does end and create new sessions.
Or do I need to employ a reverse proxy and a load balancer as illustrated below?
Internet --> Firewall --> Load Balancer --> NGINX rev proxy --> Lan Server
The NGINX reverse proxy would do nothing essentially except exist and forward packets.
What really makes a DMZ? Is it two different subnets with firewalling that is most important or is it the termination and recreation of the session prior to reaching the lan? Or is it something else?
Another project I've been needing to button up is an open SSH to a server in the lan. It has no front end server, but we could potentially use the load balancer to serve this purpose, but only if it can legitimately pass an SOC audit.
Thanks for any meaningful discussion!