Questions tagged [dmz]

In computer security, a DMZ or demilitarized zone (sometimes referred to as a perimeter network) is a physical or logical subnetwork that contains and exposes an organization's external-facing services to a usually larger and untrusted network, usually the Internet.

Filter by
Sorted by
Tagged with
61
votes
8answers
13k views

How do you explain to experts that a database server should not reside in the DMZ?

Our security experts, database administrators, network team and infrastructure team are all saying it's OK to have the database server located in the DMZ along with the HTTP server and middle-ware ...
9
votes
1answer
11k views

Would a DMZ be safe to use with a software firewall for home networking?

If I set up a Windows 10 PC with a software firewall (TinyWall, which is a front end for Windows Firewall) and blocked all traffic except for a few applications and ports I would be using (Minecraft ...
8
votes
2answers
13k views

Why is forwarding port 80 more insecure than the others?

I'm doing an internship in a very little company and I need to configure the network. They have a Cisco router. I couldn't find the logs to login so I called their internet provider. Apparently they ...
7
votes
3answers
388 views

Non-Sensitive/Non-Critical Database and Web server protections?

I have an unrestricted DMZ that is currently set up with a non-critical/non-sensitive web server and database server inside. The database server gets interfaces from two critical systems but does not ...
5
votes
2answers
854 views

What's the point of a DMZ if it has access to a DB inside inner network?

I understand that you place public facing servers in a DMZ and so if they are compromised, it doesn't compromise the inner network. In order to do so, the outer firewall forwards ports (80 and 443 in ...
5
votes
2answers
8k views

DMZ and mail servers

I've seen a few DMZ related questions here in the past, but wanted to ask one directly related to email. I've done some research on this, but wanted to ask the forums opinion. I know it's best ...
4
votes
1answer
4k views

Is vmware vulnerable to shellshock?

We have tons of vmware hosted servers in our DMZ environment, with the recent shellshock bash bug, what do I need to do to protect our environment?
4
votes
2answers
1k views

Risk to Domain members in a Domain that's extended into the DMZ

I am an AD administrator trying to look at things from an application server owner's perspective. Imagine a scenario where an AD domain covers authentication in both the corporate LAN and the DMZ. ...
4
votes
2answers
2k views

DMZ for outbound connections

From a design perspective, is it a good idea to put servers that need to perform outbound connections to internet in a separate DMZ? These servers would be servers like web filters, WSUS servers, etc....
4
votes
1answer
340 views

DMZ Firewall settings

I am involved in project where I have to install a new server for a new application to a preexisting production network. The new server shall sit in the DMZ and two controllers will sit on the ...
3
votes
2answers
11k views

Any network related security benefits using RODC (Read Only DC) in DMZ?

Windows servers in the DMZ need to communicate with the Active Directory. I do not like that the servers will have direct communication with my Active Directory, so I consider installing a Read-Only ...
3
votes
2answers
1k views

Reverse Proxy or direct?

imagine I have an architecture as shown. In order to get to the internal web server, should I use a reverse proxy like as shown and redirect traffic to my web server? Is this a more secure way ...
3
votes
1answer
712 views

Internal IP addresses allowed access to all DMZ hosts

Hi basically I'm doing a vulnerability assessment for at the moment. The setup includes a DMZ with a single firewall and an internal network (3 legged network model employing a single DMZ) but on the ...
3
votes
2answers
3k views

Windows Servers in DMZ - managed via AD or standalone?

From a security point of view, does it make sense to connect the Windows servers that are running within the DMZ and should be reachable from the Web to the AD (running within the core network)? Or ...
3
votes
2answers
1k views

Database Protection : External & Internal

My company is using a weird database setup and I can't really figure what it is adding in term of security. Our Setup Outside World [Firewall] DMZ – Web Server [Firewall] External Database [...
2
votes
2answers
3k views

Firewalls vs DMZ

What's the difference between Firewalls and DMZs? These terms seem to overlap at time and I'm not clear on the difference. Maybe a DMZ is achieved using firewalls?
2
votes
1answer
1k views

PCI - prohibiting direct connections to the Cardholder Data Environment

In PCI 1.3.3 it states: Are direct connections prohibited for inbound or outbound traffic between the Internet and the cardholder data environment? A Cardholder Data Environment (CDE) ...
2
votes
1answer
3k views

Safety of exposing an internal web application to the internet using a reverse proxy in the DMZ

I am creating a web application which needs to make direct connections to internal resources (e.g. database servers), but will also need to be accessed from the internet. The web app exposes web ...
2
votes
2answers
3k views

Web server interaction with a database server

It is common knowledge that any servers exposed to the internet needs to be placed in a DMZ. However, a web application sometimes need to get user input and updates to backend database tables etc. How ...
2
votes
3answers
2k views

2 vs 3 tier network architecture

I am interested in how a 3-tier network topology (web/app/data) provides improved security than a 2-tier topology (web-app/data). I understand the concept of a DMZ as the initial contact point with ...
2
votes
1answer
113 views

Moving GIT/SVN servers to internal network segment while still allowing external collaboration

Here is my situation: I have a typical network setup, with DMZ and internal segment, with a VPN concentrator. Because we have external collaborators, the GIT/SVN servers are in the DMZ. Individual ...
2
votes
2answers
1k views

By how much does virtualizing a perimeter firewall reduce network security?

I am looking to set up a hardware firewall for my home network. However, I am but a poor lowly student so I'm looking to virtualise to reduce hardware costs. Now for a diagram to explain what I have ...
2
votes
2answers
605 views

Applications with no front end server

We are bringing up a server that will be exposed to the Internet from a vendor who's application has no official vendor front end server. Although this web application server will pull data from ...
2
votes
1answer
89 views

Setup network with IoT devices

I bought a new router and I'm thinking to make my network a bit smarter from the security aspect. My question is now: How can I make sure that an attacker cannot get into my "secure" network ...
2
votes
1answer
133 views

Separate server between web server and database server

Possibly basic question from a developer, not a security expert. AFAIK, a very common setup for web sites is to have 1 or more web servers behind a firewall and load balancer, with the web servers ...
2
votes
1answer
74 views

Counting on firewalls only : sound security strategy to prevent intrusion?

I had this discussion with a friend of mine who is a windows sysadmin. He said to me that for his company's IT security, he is doing only updates on the windows server. But except these system ...
2
votes
1answer
1k views

Upload data from Internet to DMZ to an intranet

I've got the following situation: A web server located in a DMZ receives file uploads from web browsers. The uploaded files are stored on the web server's file system. In the next step, these files ...
2
votes
3answers
2k views

Best practice for connecting publicly available server to internal LDAP/Active Directory?

We have a public website. The site also contains the intranet (although none of the data on the intranet pages are terribly secret). Users have to login to the website using their Active Directory ...
2
votes
2answers
2k views

DMZ layer for web server/presentation layer

I need help explaining to non security people why I want to require the webserver/presentation layer in a dmz. I've given options for a tier two (presentation/logic -> logic/data in zones) ...
2
votes
1answer
302 views

Access documents on internal network with website securely

I have a large document store of client data on my internal network. I am in the process of engaging some developers to build a website to make this data available to my clients externally. I also ...
2
votes
2answers
559 views

tunnelling HTTP request through DMZ from a secured area

In my topology I have a secured area where all the servers are. There is also a DMZ with a few reverse proxy servers. I now need to make one of the servers in the secure area open to make HTTP calls ...
1
vote
1answer
1k views

Proxy between web server in DMZ and SOAP-service in internal network?

I have a web server which is located in a DMZ, and exposed to the internet. I also have an application server hosting a SOAP-service in the internal network. I need to access the SOAP-service from ...
1
vote
1answer
12k views

internal proxy server vs DMZ proxy server

What would be reason for placing a proxy server in a Demilitarized Zone (DMZ)? I understand that a DMZ is a separate network to your internal network (lies inbetween internal network and firewall). I ...
1
vote
1answer
689 views

Secure data transfer to internal network

I need to transfer data originally from the internet that is first transported to a DMZ, then from the DMZ into an internal network. The data is basically real-time data that is needed on the internal ...
1
vote
2answers
2k views

Comparing Site to Site VPN with DMZ

Consider that the two cities A and B have offices of a company and both these offices have their own isolated networks. People at site B used to communicate using an application which has its server ...
1
vote
1answer
228 views

How would a DMZ work

I have a problem understanding how a DMZ would be implemented. I've read two different answers regarding the communication between the DMZ and the internal network. Some people suggest that you can ...
1
vote
2answers
2k views

What is a firewall and its DMZ?

My question is in regards to network security. I understand that there should be a demilitarization zone at the border for your network. It is there where the perimeter firewall should live and ...
1
vote
2answers
654 views

additional network security benefits from double hop dmz?

Core network --> Firewall Internal Zone --> Inner DMZ Firewall --> Outer Firewall --> Internet Based User I can't think of any reason why "Inner DMZ firewall" would make this topology more secured ...
1
vote
1answer
657 views

Secure File Replication between LAN and DMZ

Our support staff established remote access connection from jumphosts that are isolated within a DMZ. To provide support they need project files (up to a few GB of size) which are stored on a file ...
1
vote
1answer
103 views

How to protect a LAN from WAN with some kind of authentication

we have a local network where some services run. Currently they aren‘t connected to the Internet. But now we want be able to reach those servers from the internet. Since those services are under ...
1
vote
1answer
838 views

Do AWS and GAE use DMZ?

The system I am working on primarily use Google App Engine for my main web app and Amazon Cloudfront/S3 for hosting static data. Now as an audit exercise this question is out to me: Are the ...
1
vote
2answers
534 views

Protecting data within the intranet from internet

i want to build an internet facing website that interact with internal resource such as referential data. We have a DMZ zone and intranet zone. When users logs in to the website, the http web server ...
1
vote
1answer
125 views

Terminology - DMZ

The term DMZ is used to describe a separation area between a trusted zone and an untrusted zone. Ex: internal network vs internet. Can it be used to refer to a separation area between a trusted zone ...
1
vote
1answer
1k views

How does a reverse proxy change the security posture of a web server residing in the DMZ? [closed]

How does the reverse proxy change internal and external security posture with a reverse proxy compared to not having a reverse proxy? For example, you have a publicly accessible iis server, what is ...
1
vote
0answers
76 views

Is there any value in using macvlan/VLANs to create router aware networks to segment internet exposed containers vs non exposed containers?

I have a single home server with a single NIC. I intend to run numerous Docker containers -- some will be internet exposed, some will not. The way I see it, I have two options: Use the normal bridge ...
1
vote
0answers
82 views

Left port 80 exposed, several IPs accessed phpmyadmin

A few days ago while messing around with a web server, I put my server into a DMZ via my router and forgot to disable it. I opened port 80 and 3306 on the server's firewall (Windows Server) to access ...
1
vote
0answers
64 views

Is it best to have HIPAA data pushed to me or to pull it and how do those solutions differ from an infrastructure and security perspective?

Long time reader first time asking. I have HIPAA data I need to get from point A to point B. Point A can either securely host the file to be pulled by Point B or push the data to Point B. I am ...
1
vote
0answers
217 views

Sql Server access from DMZ

I'm developing a B2B website open to the internet. I've deployed the website on an application server that is in its own network and is only allowed to communicate to the intranet on two ports: To ...
1
vote
0answers
887 views

LDAP (Active Directory) Authentication from DMZ

I have a web application hosted in a DMZ on a non-domain server. The app is primarily an intranet site, but also needs to be available publicly. The app authenticates users using LDAP to the internal ...
1
vote
0answers
692 views

Port forwarding and DMZ not working

Am trying to run a tor-relay on my raspberry-pi. I have a static IP configured on my pi and enabled the tor service. But when I tried to do port forwarding for my pi's static ip on my ORport, it is ...