to DMZ or not to DMZ, that is the question?

[FN-GM]

I think instead of trying to put servers in to different DMZ's, I'm now thinking the answer to turn the TMG into a reverse proxy.

 

That way you'll have:

Internet --> smoothwall --> TMG Reverse Proxy --> internal servers

 

If I have it the right way around and in my DMZ is a simply the reverse proxy. Does anyone else use this approach?

 

The problem is TMG has finished. If you are doing a new install I would look at other products.

[localzuk]

The problem is TMG has finished. If you are doing a new install I would look at other products.

 

Simplest reverse proxy is to use a web server. Both IIS and Apache2 can do reverse proxying with minimal effort or config. TMG is overkill for this purpose anyway really!

[Blue_Cookeh]

Does SIMS have parent facing stuff now (in which case, reverse proxy using Nginx/Apache/your UTM)? Why wouldn't you leave that internal and force your staff through a VPN? I wouldn't be comfortable putting that sort of data anywhere near the Internet, but for things like web servers, VPN servers etc I would always stick them inside a DMZ.

 

Of course, you should be putting other restrictions in place like throttling database connections etc for each client connection so people can't just dump your database should the web app have an exploit.

Edited January 27, 2016 by Blue_Cookeh

[Davit2005]

You don't need two physical firewalls, a (reasonably) cheap Cisco ASA will do a really good job of this. We essentially have 7 DMZ's as we treat each wireless VLAN as a discrete "DMZ" as it is a semi-trusted network.

 

We just use a Next Gen Firewall with different Zones, the zones are assigned individual LAN ports on the firewall and these go via a untagged switch link direct to virtual servers which are using passthrough adapters (literally a server that has dedicated LAN 1 port for dirty, 1 port for clean and management/vMotion tagged on a 2 port trunk)

 

It is not ideal for resilience but we are working on it.

[ass17]

I only said TMG because we have it sitting there as a backup transparent proxy just in case smoothwall won't allow certain access to government sites that our accounts team have to submit data to.

 

But certainly it is something we could virtualise if we decided to use a different reverse proxy

[ass17]

My next question would be do I need an additional reverse proxy if smoothwall is a firewall, IPS, reverse proxy all in one job, can that become effectively my DMZ? @TomNewton Edited January 27, 2016 by ass17

[Blue_Cookeh]

My next question would be do I need an additional reverse proxy if smoothwall is a firewall, IPS, reverse proxy all in one job, can that become effectively my DMZ? @TomNewton

 

Yes there's no reason why you cant. We do this

 

Internet > Sophos reverse proxy > Sophos UTM firewall/routing > Web server (VLAN 666) > Sophos UTM firewall/routing > Database/internal services (VLAN 1).

 

Sure maybe there's a reduction in network performance going round in a circle like that, but I don't need to buy a second firewall for the amount of traffic we have coming in.

[ass17]

What I'm struggling to understand is how sticking a reverse proxy in will stop a hacker from gaining access to servers? Or by having a reverse proxy they hit the firewall/reverse proxy it goes and gets the data on behalf of the hacker therefore they never get beyond the firewall?

 

If this is the case will a reverse proxy only deal with HTTP/HTTPS requests or is it literally any type of request made? IMAP/SMTP for example

[localzuk]

What I'm struggling to understand is how sticking a reverse proxy in will stop a hacker from gaining access to servers? Or by having a reverse proxy they hit the firewall/reverse proxy it goes and gets the data on behalf of the hacker therefore they never get beyond the firewall?

 

If this is the case will a reverse proxy only deal with HTTP/HTTPS requests or is it literally any type of request made? IMAP/SMTP for example

 

The firewall only lets traffic through on the ports you specify. A reverse proxy simply rewrites incoming HTTP requests to use an internal server address instead. The latter doesn't aid in protection really at all - if the web server software is insecure, and publicly accessible, it will still be at risk.

 

The idea of the DMZ is that your publicly facing server is segmented away from your main network, so that if a hacker does gain access to it, they can't then use it to launch an attack on the rest of your internal servers. The key is keeping them segmented with firewalls in between. The reverse proxy aspect is more of a way to connect an external URL to an internal server that is unaware of the external address, by rewriting the URL.

[ass17]

Ok I see, so if we reverse proxy servers that have web access that will protect that side of things. But what can I do if we allow external RDP access (port forwarded, IPS turned on for this rule) to a terminal server that needs access to mail, sims, etc... Can anything be done?

[Blue_Cookeh]

Ok I see, so if we reverse proxy servers that have web access that will protect that side of things. But what can I do if we allow external RDP access (port forwarded, IPS turned on for this rule) to a terminal server that needs access to mail, sims, etc... Can anything be done?

 

You could use something that provides forms-based authentication (over HTTPS!) to an RD Web Gateway, I know TMG and Sophos both have this option and I'm pretty sure Smoothwall would too.

Edited January 27, 2016 by Blue_Cookeh