Questions tagged [dmz]

In computer security, a DMZ or demilitarized zone (sometimes referred to as a perimeter network) is a physical or logical subnetwork that contains and exposes an organization's external-facing services to a usually larger and untrusted network, usually the Internet.

-4
votes
0answers
42 views

How to scan DMZ Zone? What is DMZ zone? [closed]

How to scan Hosts in DMZ Zone? with Network Scanning Vulnerability tools?(Nessus or NMAP)
2
votes
3answers
129 views

2 vs 3 tier network architecture

I am interested in how a 3-tier network topology (web/app/data) provides improved security than a 2-tier topology (web-app/data). I understand the concept of a DMZ as the initial contact point with ...
0
votes
1answer
119 views

What's the safest way to make home server available from outside the network?

I have an old laptop that I decided to use as a server, with some samba shares and whatnot (making available some dvd rips and the like), and I'd like to be able to access the files in it from not ...
1
vote
2answers
256 views

Firewalls vs DMZ

What's the difference between Firewalls and DMZs? These terms seem to overlap at time and I'm not clear on the difference. Maybe a DMZ is achieved using firewalls?
0
votes
0answers
67 views

Database in DMZ and SMTP relay

I have an application that talks with a database in the DMZ. There is a firewall between the apps and the db but our developer thought that they require a mail notification that is triggered from the ...
0
votes
0answers
42 views

Distributed network with one host behind dmz and the other without

Context: This a question from my homework assignment. There is a company with two sites A and B. B is behind DMZ (firewall - proxy mail server - firewall) and A is just behind a firewall Network A ...
0
votes
1answer
74 views

Relying on internal DNS server (Domain Controller) on a DMZ Server

A couple of questions regarding DNS traffic between TRUST and DMZ and best practices. Are there any significant risks in relying on internal DNS from a web server hosted in a DMZ zone? Has the DNS ...
0
votes
1answer
270 views

DMZ to Virtualbox VM with pfSense

It is safe to make a DMZ to a VirtualBox VM that has pfSense installed with two network cards one on bridge and one on intnet. The DMZ would do this by indicating the ip of pfSense to the router. ...
2
votes
2answers
667 views

Windows Servers in DMZ - managed via AD or standalone?

From a security point of view, does it make sense to connect the Windows servers that are running within the DMZ and should be reachable from the Web to the AD (running within the core network)? Or ...
1
vote
1answer
66 views

How to protect a LAN from WAN with some kind of authentication

we have a local network where some services run. Currently they aren‘t connected to the Internet. But now we want be able to reach those servers from the internet. Since those services are under ...
1
vote
1answer
356 views

Secure data transfer to internal network

I need to transfer data originally from the internet that is first transported to a DMZ, then from the DMZ into an internal network. The data is basically real-time data that is needed on the internal ...
1
vote
0answers
52 views

Is it best to have HIPAA data pushed to me or to pull it and how do those solutions differ from an infrastructure and security perspective?

Long time reader first time asking. I have HIPAA data I need to get from point A to point B. Point A can either securely host the file to be pulled by Point B or push the data to Point B. I am ...
0
votes
1answer
115 views

network traffic decryption with proxy devices

How is data decryption handled with proxy devices in perimeter networks (DMZ) in companies? Let's assume we host hundreds of web sites on our DMZ servers, how can we get the data decrypted or even ...
2
votes
3answers
1k views

Best practice for connecting publicly available server to internal LDAP/Active Directory?

We have a public website. The site also contains the intranet (although none of the data on the intranet pages are terribly secret). Users have to login to the website using their Active Directory ...
1
vote
1answer
371 views

tunnelling HTTP request through DMZ from a secured area

In my topology I have a secured area where all the servers are. There is also a DMZ with a few reverse proxy servers. I now need to make one of the servers in the secure area open to make HTTP calls ...
8
votes
2answers
4k views

Why is forwarding port 80 more insecure than the others?

I'm doing an internship in a very little company and I need to configure the network. They have a Cisco router. I couldn't find the logs to login so I called their internet provider. Apparently they ...
1
vote
0answers
177 views

Sql Server access from DMZ

I'm developing a B2B website open to the internet. I've deployed the website on an application server that is in its own network and is only allowed to communicate to the intranet on two ports: To ...
-1
votes
1answer
652 views

Can a reverse proxy protect from web-server exploit? [closed]

I'm looking for a security solution for my web-server Apache in windows enviroment for an authenticated services published to internet, I cannot setup a DMZ because it is heavily connect to all other ...
1
vote
2answers
1k views

Comparing Site to Site VPN with DMZ

Consider that the two cities A and B have offices of a company and both these offices have their own isolated networks. People at site B used to communicate using an application which has its server ...
2
votes
2answers
848 views

DMZ layer for web server/presentation layer

I need help explaining to non security people why I want to require the webserver/presentation layer in a dmz. I've given options for a tier two (presentation/logic -> logic/data in zones) ...
0
votes
1answer
64 views

Internal process to recertify DMZ zones

How would a DMZ zone recertification process look like? Say we create a separate security zone for each application hosted in DMZ. Now we would like to get in touch with the person in charge for the ...
0
votes
1answer
653 views

Network isolation for a single device

I'm planning to set up a local server (Minecraft) accessible by only one other person connecting from a static IP. It's on a dedicated machine that I can easily wipe (Raspberry Pi). I'm looking to ...
1
vote
1answer
609 views

Do AWS and GAE use DMZ?

The system I am working on primarily use Google App Engine for my main web app and Amazon Cloudfront/S3 for hosting static data. Now as an audit exercise this question is out to me: Are the ...
1
vote
0answers
580 views

LDAP (Active Directory) Authentication from DMZ

I have a web application hosted in a DMZ on a non-domain server. The app is primarily an intranet site, but also needs to be available publicly. The app authenticates users using LDAP to the internal ...
1
vote
0answers
518 views

Port forwarding and DMZ not working

Am trying to run a tor-relay on my raspberry-pi. I have a static IP configured on my pi and enabled the tor service. But when I tried to do port forwarding for my pi's static ip on my ORport, it is ...
2
votes
1answer
101 views

Moving GIT/SVN servers to internal network segment while still allowing external collaboration

Here is my situation: I have a typical network setup, with DMZ and internal segment, with a VPN concentrator. Because we have external collaborators, the GIT/SVN servers are in the DMZ. Individual ...
1
vote
1answer
195 views

How would a DMZ work

I have a problem understanding how a DMZ would be implemented. I've read two different answers regarding the communication between the DMZ and the internal network. Some people suggest that you can ...
1
vote
1answer
1k views

Proxy between web server in DMZ and SOAP-service in internal network?

I have a web server which is located in a DMZ, and exposed to the internet. I also have an application server hosting a SOAP-service in the internal network. I need to access the SOAP-service from ...
0
votes
2answers
419 views

Protecting data within the intranet from internet

i want to build an internet facing website that interact with internal resource such as referential data. We have a DMZ zone and intranet zone. When users logs in to the website, the http web server ...
2
votes
2answers
799 views

By how much does virtualizing a perimeter firewall reduce network security?

I am looking to set up a hardware firewall for my home network. However, I am but a poor lowly student so I'm looking to virtualise to reduce hardware costs. Now for a diagram to explain what I have ...
1
vote
0answers
82 views

Simple DMZ Question Regarding Physical Hardware

So when talking about at setting up a DMZ, if you are currently running a web server, app server, and a database server on the same physical host, you need to migrate them to separate physical hosts ...
1
vote
0answers
73 views

I am trying to create DMZ but I have problem with the wired and wireless [closed]

I am trying to create DMZ but I still have problem with wired and wireless connections. Especially when the manager's Laptop connects to wired and wireless? [![enter image description here][1]][1] ...
2
votes
2answers
434 views

Applications with no front end server

We are bringing up a server that will be exposed to the Internet from a vendor who's application has no official vendor front end server. Although this web application server will pull data from ...
0
votes
1answer
2k views

Can a load balancer “BE” the computer in the DMZ?

I'm wondering if a web load balancer can take over the duties of what would normally be considered the front end server in a DMZ? In our current environment, we have the classic DMZ setup as ...
0
votes
3answers
877 views

Understanding a DMZ with multiple servers

I get the general principle of a DMZ i.e. place public facing servers in the DMZ to isolate and protect the corporate LAN. I have a web application which is to be public facing, this web app needs to ...
1
vote
2answers
1k views

What is a firewall and its DMZ?

My question is in regards to network security. I understand that there should be a demilitarization zone at the border for your network. It is there where the perimeter firewall should live and ...
4
votes
2answers
1k views

Risk to Domain members in a Domain that's extended into the DMZ

I am an AD administrator trying to look at things from an application server owner's perspective. Imagine a scenario where an AD domain covers authentication in both the corporate LAN and the DMZ. ...
1
vote
1answer
107 views

Terminology - DMZ

The term DMZ is used to describe a separation area between a trusted zone and an untrusted zone. Ex: internal network vs internet. Can it be used to refer to a separation area between a trusted zone ...
7
votes
1answer
7k views

Would a DMZ be safe to use with a software firewall for home networking?

If I set up a Windows 10 PC with a software firewall (TinyWall, which is a front end for Windows Firewall) and blocked all traffic except for a few applications and ports I would be using (Minecraft ...
2
votes
1answer
70 views

Counting on firewalls only : sound security strategy to prevent intrusion?

I had this discussion with a friend of mine who is a windows sysadmin. He said to me that for his company's IT security, he is doing only updates on the windows server. But except these system ...
1
vote
2answers
500 views

additional network security benefits from double hop dmz?

Core network --> Firewall Internal Zone --> Inner DMZ Firewall --> Outer Firewall --> Internet Based User I can't think of any reason why "Inner DMZ firewall" would make this topology more secured ...
3
votes
2answers
811 views

Database Protection : External & Internal

My company is using a weird database setup and I can't really figure what it is adding in term of security. Our Setup Outside World [Firewall] DMZ – Web Server [Firewall] External Database [...
0
votes
3answers
632 views

DNS in DMZ or not and mail server architecture

I wonder what server I put in DMZ zone. I know the DMZ zone is for all servers or services who must be accessed from the internet, like Web Server, or mail server and sometimes DNS servers. But I ...
3
votes
2answers
1k views

Reverse Proxy or direct?

imagine I have an architecture as shown. In order to get to the internal web server, should I use a reverse proxy like as shown and redirect traffic to my web server? Is this a more secure way ...
7
votes
3answers
361 views

Non-Sensitive/Non-Critical Database and Web server protections?

I have an unrestricted DMZ that is currently set up with a non-critical/non-sensitive web server and database server inside. The database server gets interfaces from two critical systems but does not ...
2
votes
1answer
275 views

Access documents on internal network with website securely

I have a large document store of client data on my internal network. I am in the process of engaging some developers to build a website to make this data available to my clients externally. I also ...
4
votes
2answers
1k views

DMZ for outbound connections

From a design perspective, is it a good idea to put servers that need to perform outbound connections to internet in a separate DMZ? These servers would be servers like web filters, WSUS servers, etc....
5
votes
2answers
6k views

DMZ and mail servers

I've seen a few DMZ related questions here in the past, but wanted to ask one directly related to email. I've done some research on this, but wanted to ask the forums opinion. I know it's best ...
0
votes
2answers
446 views

Is it safe to put my own router in my neighbour's DMZ?

I use my next door WiFi for a small charge as I am unable to install my own broadband connection. I have a 300Mbps WISP router connected with a fixed IP to my next doors router (192.168.0.2). My ...
2
votes
1answer
2k views

Safety of exposing an internal web application to the internet using a reverse proxy in the DMZ

I am creating a web application which needs to make direct connections to internal resources (e.g. database servers), but will also need to be accessed from the internet. The web app exposes web ...