Consider that the two cities A and B have offices of a company and both these offices have their own isolated networks. People at site B used to communicate using an application which has its server located inside the same network. Considering that the server has been moved to site A for some reason and the employees at site B still want access to that server as if it were a part of their own network, what would be the best possible was to achieve this?

So far I have studied about putting the server in DMZ so that it could be accessed over internet and the rest of site A still remains isolated. The other was that I studied is to create a site to site VPN. This would ensure the safety of server from internet.

I want to know if there's any other way to do it? If not, which among the two would be better?


In terms of enterprise IT best practices:

1) A DMZ should be used if the application requires access from the public internet. This means that users may not have VPN credentials or any other way to get into the private network, and must be exposed to the internet in order to be used.

2) Private resources should stay on private networks. If the application only need be used by a limited group who already have access to a private network, then the best thing to do is setup a VPN. Then, the VPN encapsulates the traffic and ensures that the application/servers cannot be port-scanned or hack-attempted without first getting on the VPN -- making it an order of magnitude more difficult for an adversary to attempt to compromise.

The reason for this is because while a DMZ does isolate the server in question, it does open up the DMZ server for hack attempts on the public internet. From here, a hacker can steal credentials etc that might allow them to traverse beyond the DMZ into the real corporate network. In addition, many DMZs have "holes" in them for things like Active Directory Authentication, that leave open additional attack surface area if the DMZ server is compromised.

In short, private systems should stay on private networks. So, if this system only requires access from a finite group of people who all have VPN access already, then requiring VPN access is certainly the best practice.


In practical senses, I rarely see this being handled by the company infrastructure and instead what happens is the company signs up for WAN to a provider which will make access between sites transparent and absolutely guarantee that the companies traffic is not co-mingled in any way that other customers of that provider can hack into the traffic.

If you don't have that service and need to roll your own, or perhaps you don't fully trust the service, a site-to-site VPN encrypted with AES256 would be generally considered a good practice. The network router might have the ability to do this, and would be considered a good practice -- especially if those features are built into the network gear of a good name brand.

Another option would be firewalls on each site which establish the site-to-site vpn. Whether that is "better" than using IPSec features in the routers is a big "it depends".

From a cost perspective, less boxes costs less, sucks less power, throws off less heat, and takes up less rack space. From a security operations perspective more boxes means more things to worry about being mis-configured and introducing security holes, or less boxes to make sure are patched regularly, less boxes means smaller attack surface.

Not sure why you would opt to put the server on the public Internet in a DMZ if the only access comes from within the company from site A or B. Putting it in a DMZ on the public Internet would make it susceptible to security bugs in your DMZ firewall, configuration errors (which either are there from day one or get introduced through changes), etc.

DMZ's are meant to be places where you put servers that absolutely have to be exposed to the public Internet and there is no alternative. If there is an alternative, the alternative is always going to be the better route. There is nothing in the question that justifies taking this risk.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.