3

I found out our DMZ zone is not as secure as it should be. We use NAT to translate internet services from DMZ to internet. We have some developers out of organization. Some of them connect via client-to-client tunnel to specific server. But for some we open ssh/rdp ports on translated addresses. The point is: when developer connects to his specific server, he has access to all other servers in DMZ zone. enter image description here So being in one subnet with other servers, he has network access to all other servers. This is very insecure practice. I see here 3 solutions:

  1. Create iptables/firewall template and apply it locally on each server in DMZ zone. The problem here: it makes much manual work. Developer has root/administrator access so he can disable firewall on his server. To prevent it we should configure separate permissions, which makes more manual work.
  2. Put every DMZ host in separate zone with /31 subnet. On internet firewall create virtual static router for each server. Actually, I like it more. The problem is here: still has manual work on creating each server. Mess in internet firewall in static routes and rules.
  3. Deploy enterprise solution, such as cloudstack or openstack. The problem is here: we are small hosting company that hosts only services that we develop. We have about 10 servers that have remote access from foreign developers. Next year we plan for 10 more.

Dear gurus need your suggestions.

Improve this question
5
  • I think you mean "network access", not "physical access" since the developers are remote. Granting access to a subnet does leave every host in the subnet open to attack from someone with access to the subnet. Why would every DMZ host need 30 subnets? I would assume one subnet per host is enough.
    – Ron Maupin ♦
    Dec 28, 2015 at 6:59
  • Sorry, yes I meant "network access". And I meant /30 subnet. With one host and gateway.
    – Алдар
    Dec 28, 2015 at 9:08
  • Then you could actually use /31 to double your usable addresses since it doesn't waste two addresses per subnet.
    – Ron Maupin ♦
    Dec 28, 2015 at 9:10
  • Again, you right. I forgot about this subnet.
    – Алдар
    Dec 28, 2015 at 9:12
  • Personally, I would require the developers to tunnel to their individual servers rather than open the subnet to them. You could use something like a Private VLAN to restrict one host from being able to contact another on the same VLAN. If they don't have access to the subnet, and the server subnet is on a Private VLAN, one developer has no ability to see any of the other servers.
    – Ron Maupin ♦
    Dec 28, 2015 at 9:17

1 Answer 1

Reset to default
3

You didn't mention the switch model, but a lot of switches support Private VLANs which only allow a switch port to access the configured uplink switch port. This is often used in hosting to prevent one hosted server from being able to access another hosted server. You can isolate each switch port from all the other switch ports to provide your customers privacy.

Wikipedia has an article which can give you an overview of Private VLANs:

Secure hosting

Private VLANs in hosting operation allows segregation between customers with the following benefits:

  • No need for separate IP subnet for each customer.
  • Using Isolated VLAN, there is no limit on the number of customers.
  • No need to change firewall's interface configuration to extend the number of configured VLANs.

Actual configurations will differ between switch manufacturers.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.