1

we have a local network where some services run. Currently they aren‘t connected to the Internet. But now we want be able to reach those servers from the internet. Since those services are under development and have some kind of sensible data, we want a secure and easy to use network concept.

We thought about something like that: From the internet you can access a website like secure-example.com. If you go to this page the user needs to login and will see and have access to all services. On the other hand you can access like serviceone.secure-example.com, need to login and have direct access to the service.

I thought some kind of DMZ or DNS ALG should do the trick but I‘m not sure about that.

1

Generally, this is done with some sort of bastion host that has access to both networks (internet and intranet). At the simplest, you allow SSH access to the bastion host (for authenticated users only, of course) and then people tunnel through the bastion to reach the internal hosts. That requires setting up SSH tunnels, though, which isn't always convenient or user-friendly. An alternative is to have a login web app on the bastion (or even just use something like TLS mutual authentication with client certificates), and after the user is authenticated the bastion acts as an invisible or reverse proxy, taking requests meant for the back-end hosts and getting their responses, then passing those responses back to the (authenticated) users via a secure connection (probably just HTTPS, unless you're using a non-HTTP protocol in which case you might have to get fancier).

You could also use a VPN server to bridge into the intranet. Users authenticate to the VPN, after which it's basically as though they are on the same local network the VPN server is on (i.e. the same one as your internal services) until the VPN tunnel is closed or broken. There are a number of VPN technologies and they aren't all equally secure (anything using MS-CHAPv2, for example, is pretty easy to break), but most OSes support a number of VPN technologies out of the box, and there's also third-party software like OpenVPN (F/LOSS) or various commercial options.

The bastion host / VPN server, being a bridge between sensitive and untrusted networks, should of course be as hardened as possible. Don't run any more services on it than needed (good advice for any server, really), keep the program logic running on it minimal (to minimize attack surface; no need to by fancy), and so on. Keep it updated, maintain audit logs, and all that good stuff.

  • Thank you so much for your answer. With it I was able to search around for more information. It helped a lot. :) Is a VPN-Server more secure than a bastion host with HTTP-Authentication (or TLS)? – Zeekrey Mar 5 '18 at 21:39
  • I'm afraid network security isn't my forte. A few points though: (1) HTTP auth without TLS (over a public network) is never secure. Even using DIGEST auth - which nobody seems to do - an attacker can still see and control everything you do. (2) Mutual TLS (client certs) provide a lot of security, if done correctly, but I'm not sure using then and then forwarding the request to the internal hosts isn't going to run into problems with web security. Can be done, I'm sure, but probably not the best. (3) A well-configured VPN is, as far as I know, the Correct Way to do this. – CBHacking Mar 5 '18 at 23:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.