Proxy between web server in DMZ and SOAP-service in internal network?

Question

I have a web server which is located in a DMZ, and exposed to the internet.

I also have an application server hosting a SOAP-service in the internal network.

I need to access the SOAP-service from the web server.

I know could open a port and allow direct https access from the web server to the SOAP-service, but I don't want to do that.

Does it make sense to add a proxy-server in the internal network, and allow the web server to access only the proxy, via https?

The proxy would then forward the requests to the SOAP-service.

Is that an improvement in security at all?

Answer 1

Web Proxy vs Port Forwarding:

Proxy is easier to hijack and reconfigure (it's an application) then kernel routing tables etc. Additionally web proxy will create more load then kernel TCP/IP stack. So proxy i worse from security and machine load point of view.

Architecture Problem:

Every configuration where you allow connections from DMZ to internal network is bad and should be avoided. The problem is in

I need to access the SOAP-service (internal network) from the web server (DMZ).

It's not how DMZ should work. We create DMZ to separate outside world (internet) facing services from internal network, so when (because it really is WHEN, not IF) they got compromised, attacker can't move easily to exloit local network.

Suggested Solution:

You can create second, restricted DMZ for SOAP-service and cofigure port forwarding only for traffic comming from your web service in DMZ and internal network. This way SOAP-service is protected in the same way as when it's in internal network, but in addition, when compromised, you don't open internal network to attacker.