intranet website in dmz ?

[Guest]

Hi guys

my idea of allowing dc access to our intranet web server from the DMZ is by using pin holes in the firewall. is this a good way or do you know of a better 1

of course the intranet server needs access from the internet and needs access to check account logins on the dc's which are on internal network

 

btw i seem to live on the "how do you do it" forums

is this a bad sign :oops:

[NetworkGeezer]

Even if you put a server in the DMZ it will still require too many holes in the protected interface.

 

A reverse proxy (squid, Apache or even ISA) would be better. That way you don't have a machine will domain access talkig directly to remote clients.

[tom_newton]

You *could* use pinholes, though NG has a point, there is not that much danger - especially if you open IP/port combinations carefully. the other option is to tunnel the requests over some secure medium - HTTPS, VPN, SSH, perhaps.

 

Reverse proxy isn't a bad idea either - of course that can be used in combination with a DMZ for better effect.

[Guest]

thanks guys

not too keen on isa and reverse proxy seems a lot for my little brain

may have a mess with VPN,s

so Tom are you suggesting intranet in the dmz with a vpn tunnel for the ports needed through to DC?