I found out our DMZ zone is not as secure as it should be.
We use NAT to translate internet services from DMZ to internet.
We have some developers out of organization. Some of them connect via client-to-client tunnel to specific server. But for some we open ssh/rdp ports on translated addresses.
The point is: when developer connects to his specific server, he has access to all other servers in DMZ zone.
So being in one subnet with other servers, he has network access to all other servers. This is very insecure practice. I see here 3 solutions:
- Create iptables/firewall template and apply it locally on each server in DMZ zone. The problem here: it makes much manual work. Developer has root/administrator access so he can disable firewall on his server. To prevent it we should configure separate permissions, which makes more manual work.
- Put every DMZ host in separate zone with /31 subnet. On internet firewall create virtual static router for each server. Actually, I like it more. The problem is here: still has manual work on creating each server. Mess in internet firewall in static routes and rules.
- Deploy enterprise solution, such as cloudstack or openstack. The problem is here: we are small hosting company that hosts only services that we develop. We have about 10 servers that have remote access from foreign developers. Next year we plan for 10 more.
Dear gurus need your suggestions.
/31
to double your usable addresses since it doesn't waste two addresses per subnet.