Currently i build a new network for our company which is not my specialism as i'm actually a software engineer so excuse me when this is a stupid question.
I read a lot about networking last few weeks and as we have multiple webservers i assume we need a DMZ. What i understood should all servers which deliver services to the "public" (so internet) be placed inside the DMZ. After everything i read i still have some questions about this because it does not makes sense for me to place them in a "seperated" part of the network.
- Why should i place servers which deliver services to the "public" be in a "isolated" part of the network? I understand that this is intended to protect the "internal network" for intruders but as i forward only required ports to servers that need to deliver "public services", intruders are not be able to access other servers at al?
I also read that 2 things about webservers specifically;
- That they should be placed inside the DMZ and need access/rule/route to the database servers which should be placed in the internal network as they only deliver services to the web servers
- That they should placed in the internal network like the database servers. In this case there should be a proxy server in the DMZ which "routes" the traffic to the correct web server (in the internal network).
In both cases again i do not understand the sense of the DMZ as the proxy server or the webservers still need access to the internal network to access the web server(s) or database server(s). I assume if you are able to access the web server you are also be able to "hop" further into the network to devices where connection is possible to? What is the best practice here in terms of "where to place my webservers and do i need a proxy?"
Just for your idea, we use 1 single firewall (PfSense) where a DMZ is configured.