RE: DMZ or not ?

[sean.kelly () lanston com]

> Currently, we're using Linux as a Firewall Box, with a port 
> forwarding to our mail server, that is behind the firewall.
>
> We are in way now, to install a public web server and a DNS 
> server. What are de advantages and disadvantages of placing 
> this servers behind the firewall and perform 
> NAT or Port forwarding, instead of  using a DMZ ?

If you have a firewall with a couple ports, a good solution would be to put
the web server in its own loop, protected by the firewall, and your LAN in
another loop.  This way, you can restrict access to the web server to, say,
port 80, but if it's compromised the hacker doesn't gain access to your LAN.

With a simpler fireall (one port to the internet, one port to your LAN), I'd
advise putting the webserver in the DMZ.  Keep backups and if it's
compromised you just reload from tape.

As for your DNS server.... it depends on whether that server will be
handling DNS stuff for machines on your LAN or just public machines.  You
might want a DNS server inside the firewall for internal machines and a
second one outside for public IPs.

Sean