DMZ confusion

[googlemad]

We have several virtual servers with two LAN cards :

 

Internal LAN (example)

IP 10.201.98.1

Subnet 255.255.0.0

Gateway 10.201.98.254 (firewall)

 

DNS1 10.201.98.51 (ad controller 1)

DNS2 10.201.98.52 (ad controller 2)

 

DMZ LAN (example)

IP 192.168.255.1

Subnet 255.255.255.0

Gateway : 192.168.255.254

 

DNS1 10.201.98.51 (ad controller 1)

DNS2 10.201.98.52 (ad controller 2)

 

On the firewall for each of these servers there is a 'HTTP_IN_TO_(SERVERNAME)' policy with allowed parties 'Any-Trusted, Any-External, VLAN30 (I would presume this VLAN entry is so anyone using the wireless here can connect through). This policy contains a static NAT, i.e. 111.111.11.1 > 192.168.255.1 to map our external DNS entry to the server. The only allowed port in this policy is HTTP (port 80).

 

Is this secure from attack to our entire LAN from an outsider? As far as I always understood DMZ any servers in this zone shouldn't really have any LAN access at all but I'm not sure if the port limiting to just HTTP traffic prevents against this anyway?