I understand that you place public facing servers in a DMZ and so if they are compromised, it doesn't compromise the inner network. In order to do so, the outer firewall forwards ports (80 and 443 in my case) to web servers. From this, I understand that opening ports = allowing untrusted traffic to come in.
However, in the case of a two firewalls DMZ, you place a DB server in the inner network because it doesn't need to face the internet (I get that). If one of these web servers needs access to a DB in the inner network, the second firewall will forward a port from this server to the DB. I found that allowing DMZ systems to connect to systems in the LAN is inherently risky. which makes sense. By forwarding a port to the internal network, doesn't it make the inner network opened to attack if the DMZ gets compromised? If so, what's the point of a DMZ? Is it just to add an extra layer?
I am using a reverse proxy, so my web servers aren't directly accessible from the internet:
- Should the reverse proxy be the only server in the DMZ and forward traffic to web servers in the internal network through the second firewall?
- Is it really unsafe to place a database, which has no port forwarded to, as long as the reverse proxy doesn't redirect anything to it, in the DMZ?
I came across these diagrams which makes the design much clearer. But why isn't the network designed like this?
*untrusted* Internet | ====Firewall==== | DMZ Reverse Proxy | ====Firewall==== | DMZ2 Webserver | ====Firewall==== | DMZ3 DBserver | ====Firewall==== | Internal Network Employees
I guess because it implies a lot of firewalls and it might be unnecessary but where's the middle ground with this design (we can imagine 3 or even 4 separates VLAN for the reverse proxy, DB and/or web servers and LAN)?
*untrusted* | ==========Firewall========== | | | Reverse Proxy | Employees DBserver - Webservers
Thanks in advance!