I was wondering what would be the correct way to isolate servers in order to protect them and us from too much harm.

Let's have two scenarios:

1) Access to Application Server from the world

We have

  • an Apache Proxy distributes access to Tomcat application servers,
  • Tomcat application servers, as well as
  • DB servers accessed by the Tomcats.

What I would do:

  • Put the proxy behind a first firewall.
  • Put the Tomcats and DB servers behind a second firewall.

In that case if the proxy was hacked, no connections to the DB would be possible at least.

However, what is more probable? The proxying Apache being hacked or the Tomcat?

If this were e.g. an SQL injection issue, how would the proxy protect the Tomcat behind it? Probably not at all.

The question arises: aside from getting torn apart by an audit that would discover that there are no firewalls at all, what are we trying to protect anyway? In case the application layer is compromised I can put up all the firewalls in the world. They won't help.

2) Infrastructure services like syslog, dns, ntp, mail, you name it.

Servers in the DMZs may need those services.

One could put the syslog server in an own DMZ (let syslog in from anywhere but nothing out)?

In fact to be on the safe side you could put each server in its own DMZ but of course that again would be overkill... And what if the syslog server needs to send mails because it generates reports about the logs it carries?

What about DNS? Well you shouldn't need internal DNSs because you don't access internal resources. Everything internal you need to access you can use the IP or an entry in the hosts file.

What about NTP? One could make those requests out to the Internet...

Let's go, what do you think about these reflections and those 2 scenarios in particular?

  • Hi Marki - welcome to Security. This question is currently very difficult to read, and in fact I couldn't decide whether to go with Too Localised, Not a Real Question or Not Constructive. I think I can see 6 questions in there. Can you look at the related questions to the right - there are some on DMZ structure that may answer your question. If not, edit this to focus on the specific issue you have, and we may be able to reopen – Rory Alsop Dec 18 '12 at 14:05

There is no single correct answer, it depends very much on your traffic volume, security policies and internal network structure. I will just answer how I would do it on general level.

1) If role of the proxy is just to load balance and cache, you can put proxy and app servers to same DMZ network. Then make a separate DMZ network for the DB servers. DB is where your assets are, so in that sense it deserves a network that is isolated from all other networks. You can use private addresses in the DB server DMZ, but treat it as DMZ network. By this I mean separate network segment and interface on your firewall. If you use the proxy and app servers for other services too, it would be feasible to separate proxies to their own DMZ network as well. Modular highly segmented network will require more throughput from firewall, but will increase security and scale better for future. I would say application server is more vulnerable than proxy, but still I would count them in the same category by their role and then DB server in its own category and separate DMZ network.

If you are taking more than 1 GB/sec traffic, it is reasonable to rethink the architecture and probably ditch the firewall completely.

2) I wouldn’t worry too much about syslog, NTP and SMTP, these are quite old protocols with well-known implementations. In these cases you could allow DMZ devices to use same services as internal devices use. Many people will say that DMZ should not open connections towards internal networks, but I don’t see problem when using this kind of protocols. The benefits outweigh the small security risk.

If you want to separate DNS and you don’t have your own public DNS servers for resolving external addresses, just buy the DNS resolver service from your ISP or some other service provider. Shouldn’t cost too much and will provide extra security.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.