Here is my situation:

I have a typical network setup, with DMZ and internal segment, with a VPN concentrator. Because we have external collaborators, the GIT/SVN servers are in the DMZ. Individual collaborators are given credentials for the GIT/SVN servers (but not for the internal network / VPN).

I would like to move the GIT/SVN servers out of the DMZ in order to reduce their exposure. But external collaborators will still need access. How can I do this?

The only idea I've had, and I don't quite know how to express it or if it's possible, is to move the GIT/SVN server to a separate internal network segment, and give collaborators VPN accounts that are limited to that network segment. Would this work? Other ideas?


1 Answer 1


That plan should work, yes.

For git, at least, you have a number of other options afforded by its distributed nature. External collaborators can work on their own forks (in fact, they must, given how git works), and someone who has access to the internal server can then pull in their changes to the internal canonical server. Git was built with the core idea of mailing patches to a list, and git am still supports that flow. Or if the internal user has access to the external user's repo, they can add it as a remote and merge the commits in directly.

Why do external people need access? Why are you moving the repo internally?

  • Well, I actually left out a detail. We have the same issue with our Nexus server. External people need access because we collaborate with other companies / schools, and they need to be able to access code and build projects, using Maven with artifacts from our Nexus server. We want to move the repo internally to reduce our attack surface, given that source code is our main IP.
    – Ryan O.
    Commented Apr 9, 2017 at 0:26
  • You've kinda painted yourself into a corner; essentially your question is "how do I make this service only accessible to set A of people, but then open it back up to group B (who previously had access)". The simplest thing is to leave it the way it is - after all, that's why we have network segments that aren't open only to the LAN. If your goal is really going from "open to everyone" to "open to not everyone", then you need to whitelist access - either with a VPN, as you've suggested, or with more traditional firewalling methods. Commented Apr 13, 2017 at 18:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .