Questions tagged [dmz]
In computer security, a DMZ or demilitarized zone (sometimes referred to as a perimeter network) is a physical or logical subnetwork that contains and exposes an organization's external-facing services to a usually larger and untrusted network, usually the Internet.
74
questions
0
votes
0
answers
75
views
Where is the safest place to put servers
Currently, I have modem with built-in NAT and DMZ. I have 250Mb of webspace and unlimited emails supplied by my ISP on WAN. I want to move the webspace to my own PC on a LAN along with the emails so I ...
- 1
1
vote
1
answer
140
views
Why it is so widely tolerated to allow SMTP server in DMZ to initiate connection to the LAN
I was surprised to see that the French cybersecurity agency tolerates an SMTP relay server in the DMZ (which collects emails received from the Internet) to reach the Email server in the LAN.
In my ...
- 1,348
1
vote
1
answer
43
views
Web app architecture- set a new password for a on-premises AD setup
I need to implement a web app for a self-service change password use case for on-premise Active Directory users,
which is accessible over the internet.
The service must allow the users to set a new ...
- 111
0
votes
0
answers
24
views
Server placement for vendor verification check over the internet. DMZ or Private?
I have various servers on-premises on a private network. Some of these servers need to reach out to vendor websites to check for patch status, license verification etc.
Where should these servers be ...
- 641
1
vote
0
answers
76
views
Do i place this service in the DMZ or datacentre(internal)?
I have setup a VM on our internal network and it is assigned an internal IP address. The VM requires connectivity to a couple of internet sites mainly Microsoft and ports are generally 80 and 443. ...
- 641
3
votes
1
answer
294
views
Setup network with IoT devices
I bought a new router and I'm thinking to make my network a bit smarter from the security aspect.
My question is now: How can I make sure that an attacker cannot get into my "secure" network ...
- 133
1
vote
0
answers
247
views
Is there any value in using macvlan/VLANs to create router aware networks to segment internet exposed containers vs non exposed containers?
I have a single home server with a single NIC. I intend to run numerous Docker containers -- some will be internet exposed, some will not.
The way I see it, I have two options:
Use the normal bridge ...
- 145
0
votes
1
answer
187
views
VPN from inside a company
I recently had to bypass my company policy by establishing a VPN connection from a LAN device (raspberry pi) located inside my company, to a WAN server.
As devices accessible from outside must be ...
- 347
6
votes
2
answers
2k
views
What's the point of a DMZ if it has access to a DB inside inner network?
I understand that you place public facing servers in a DMZ and so if they are compromised, it doesn't compromise the inner network. In order to do so, the outer firewall forwards ports (80 and 443 in ...
- 61
1
vote
0
answers
126
views
Left port 80 exposed, several IPs accessed phpmyadmin
A few days ago while messing around with a web server, I put my server into a DMZ via my router and forgot to disable it. I opened port 80 and 3306 on the server's firewall (Windows Server) to access ...
- 111
1
vote
1
answer
1k
views
Secure File Replication between LAN and DMZ
Our support staff established remote access connection from jumphosts that are isolated within a DMZ. To provide support they need project files (up to a few GB of size) which are stored on a file ...
- 21
2
votes
1
answer
342
views
Separate server between web server and database server
Possibly basic question from a developer, not a security expert.
AFAIK, a very common setup for web sites is to have 1 or more web servers behind a firewall and load balancer, with the web servers ...
- 121
0
votes
1
answer
1k
views
DMZ an additional router
Recently I had an idea to test use a server (with ubuntu) and I need it to be accessible from the outside with port forwarding.
I'm not often at home, but the internet provider doesn't like their ...
2
votes
3
answers
3k
views
2 vs 3 tier network architecture
I am interested in how a 3-tier network topology (web/app/data) provides improved security than a 2-tier topology (web-app/data). I understand the concept of a DMZ as the initial contact point with ...
- 53
0
votes
1
answer
1k
views
What's the safest way to make home server available from outside the network?
I have an old laptop that I decided to use as a server, with some samba shares and whatnot (making available some dvd rips and the like), and I'd like to be able to access the files in it from not ...
- 3
2
votes
2
answers
8k
views
Firewalls vs DMZ
What's the difference between Firewalls and DMZs? These terms seem to overlap at time and I'm not clear on the difference. Maybe a DMZ is achieved using firewalls?
0
votes
0
answers
227
views
Database in DMZ and SMTP relay
I have an application that talks with a database in the DMZ. There is a firewall between the apps and the db but our developer thought that they require a mail notification that is triggered from the ...
- 1
0
votes
1
answer
915
views
Relying on internal DNS server (Domain Controller) on a DMZ Server
A couple of questions regarding DNS traffic between TRUST and DMZ and best practices.
Are there any significant risks in relying on internal DNS from a web server hosted in a DMZ zone? Has the DNS ...
- 703
0
votes
1
answer
1k
views
DMZ to Virtualbox VM with pfSense
It is safe to make a DMZ to a VirtualBox VM that has pfSense installed with two network cards one on bridge and one on intnet. The DMZ would do this by indicating the ip of pfSense to the router.
...
- 1
3
votes
2
answers
6k
views
Windows Servers in DMZ - managed via AD or standalone?
From a security point of view, does it make sense to connect the Windows servers that are running within the DMZ and should be reachable from the Web to the AD (running within the core network)? Or ...
- 49
1
vote
1
answer
199
views
How to protect a LAN from WAN with some kind of authentication
we have a local network where some services run. Currently they aren‘t connected to the Internet. But now we want be able to reach those servers from the internet. Since those services are under ...
- 113
1
vote
1
answer
824
views
Secure data transfer to internal network
I need to transfer data originally from the internet that is first transported to a DMZ, then from the DMZ into an internal network. The data is basically real-time data that is needed on the internal ...
- 11
1
vote
0
answers
107
views
Is it best to have HIPAA data pushed to me or to pull it and how do those solutions differ from an infrastructure and security perspective?
Long time reader first time asking.
I have HIPAA data I need to get from point A to point B. Point A can either securely host the file to be pulled by Point B or push the data to Point B. I am ...
- 11
0
votes
1
answer
330
views
network traffic decryption with proxy devices
How is data decryption handled with proxy devices in perimeter networks (DMZ) in companies? Let's assume we host hundreds of web sites on our DMZ servers, how can we get the data decrypted or even ...
- 1,548
2
votes
3
answers
3k
views
Best practice for connecting publicly available server to internal LDAP/Active Directory?
We have a public website. The site also contains the intranet (although none of the data on the intranet pages are terribly secret). Users have to login to the website using their Active Directory ...
- 21
2
votes
2
answers
770
views
tunnelling HTTP request through DMZ from a secured area
In my topology I have a secured area where all the servers are. There is also a DMZ with a few reverse proxy servers. I now need to make one of the servers in the secure area open to make HTTP calls ...
- 55
8
votes
2
answers
17k
views
Why is forwarding port 80 more insecure than the others?
I'm doing an internship in a very little company and I need to configure the network. They have a Cisco router. I couldn't find the logs to login so I called their internet provider. Apparently they ...
- 2,884
1
vote
0
answers
310
views
Sql Server access from DMZ
I'm developing a B2B website open to the internet.
I've deployed the website on an application server that is in its own network and is only allowed to communicate to the intranet on two ports:
To ...
- 141
-1
votes
1
answer
1k
views
Can a reverse proxy protect from web-server exploit? [closed]
I'm looking for a security solution for my web-server Apache in windows enviroment for an authenticated services published to internet, I cannot setup a DMZ because it is heavily connect to all other ...
- 107
1
vote
2
answers
3k
views
Comparing Site to Site VPN with DMZ
Consider that the two cities A and B have offices of a company and both these offices have their own isolated networks. People at site B used to communicate using an application which has its server ...
- 626
2
votes
2
answers
2k
views
DMZ layer for web server/presentation layer
I need help explaining to non security people why I want to require the webserver/presentation layer in a dmz. I've given options for a tier two (presentation/logic -> logic/data in zones) ...
- 21
0
votes
1
answer
99
views
Internal process to recertify DMZ zones
How would a DMZ zone recertification process look like? Say we create a separate security zone for each application hosted in DMZ. Now we would like to get in touch with the person in charge for the ...
- 1,548
0
votes
1
answer
1k
views
Network isolation for a single device
I'm planning to set up a local server (Minecraft) accessible by only one other person connecting from a static IP. It's on a dedicated machine that I can easily wipe (Raspberry Pi).
I'm looking to ...
- 103
1
vote
1
answer
981
views
Do AWS and GAE use DMZ?
The system I am working on primarily use Google App Engine for my main web app and Amazon Cloudfront/S3 for hosting static data.
Now as an audit exercise this question is out to me:
Are the ...
- 209
1
vote
0
answers
1k
views
LDAP (Active Directory) Authentication from DMZ
I have a web application hosted in a DMZ on a non-domain server. The app is primarily an intranet site, but also needs to be available publicly. The app authenticates users using LDAP to the internal ...
- 130
1
vote
0
answers
782
views
Port forwarding and DMZ not working
Am trying to run a tor-relay on my raspberry-pi. I have a static IP configured on my pi and enabled the tor service.
But when I tried to do port forwarding for my pi's static ip on my ORport, it is ...
- 141
2
votes
1
answer
149
views
Moving GIT/SVN servers to internal network segment while still allowing external collaboration
Here is my situation:
I have a typical network setup, with DMZ and internal segment, with a VPN concentrator. Because we have external collaborators, the GIT/SVN servers are in the DMZ. Individual ...
- 175
1
vote
1
answer
289
views
How would a DMZ work
I have a problem understanding how a DMZ would be implemented. I've read two different answers regarding the communication between the DMZ and the internal network. Some people suggest that you can ...
- 21
1
vote
1
answer
2k
views
Proxy between web server in DMZ and SOAP-service in internal network?
I have a web server which is located in a DMZ, and exposed to the internet.
I also have an application server hosting a SOAP-service in the internal network.
I need to access the SOAP-service from ...
- 143
1
vote
2
answers
634
views
Protecting data within the intranet from internet
i want to build an internet facing website that interact with internal resource such as referential data.
We have a DMZ zone and intranet zone. When users logs in to the website, the http web server ...
- 13
2
votes
2
answers
1k
views
By how much does virtualizing a perimeter firewall reduce network security?
I am looking to set up a hardware firewall for my home network. However, I am but a poor lowly student so I'm looking to virtualise to reduce hardware costs.
Now for a diagram to explain what I have ...
- 145
1
vote
0
answers
133
views
Simple DMZ Question Regarding Physical Hardware
So when talking about at setting up a DMZ, if you are currently running a web server, app server, and a database server on the same physical host, you need to migrate them to separate physical hosts ...
- 223
1
vote
0
answers
114
views
I am trying to create DMZ but I have problem with the wired and wireless [closed]
I am trying to create DMZ but I still have problem with wired and wireless connections. Especially when the manager's Laptop connects to wired and wireless?
[![enter image description here][1]][1]
...
- 11
2
votes
2
answers
696
views
Applications with no front end server
We are bringing up a server that will be exposed to the Internet from a vendor who's application has no official vendor front end server.
Although this web application server will pull data from ...
- 31
1
vote
1
answer
3k
views
Can a load balancer "BE" the computer in the DMZ?
I'm wondering if a web load balancer can take over the duties of what would normally be considered the front end server in a DMZ?
In our current environment, we have the classic DMZ setup as ...
- 31
0
votes
3
answers
2k
views
Understanding a DMZ with multiple servers
I get the general principle of a DMZ i.e. place public facing servers in the DMZ to isolate and protect the corporate LAN. I have a web application which is to be public facing, this web app needs to ...
- 1,102
1
vote
2
answers
2k
views
What is a firewall and its DMZ?
My question is in regards to network security.
I understand that there should be a demilitarization zone at the border for your network. It is there where the perimeter firewall should live and ...
- 11
4
votes
2
answers
2k
views
Risk to Domain members in a Domain that's extended into the DMZ
I am an AD administrator trying to look at things from an application server owner's perspective.
Imagine a scenario where an AD domain covers authentication in both the corporate LAN and the DMZ. ...
- 113
1
vote
1
answer
167
views
Terminology - DMZ
The term DMZ is used to describe a separation area between a trusted zone and an untrusted zone. Ex: internal network vs internet.
Can it be used to refer to a separation area between a trusted zone ...
- 577
9
votes
1
answer
12k
views
Would a DMZ be safe to use with a software firewall for home networking?
If I set up a Windows 10 PC with a software firewall (TinyWall, which is a front end for Windows Firewall) and blocked all traffic except for a few applications and ports I would be using (Minecraft ...
- 93