1

I am a computer programmer and having knowledge about networking but not an expert. I have a project in which I have to set up the network infrastructure for a school. The school will have it's own website, in-house web server, also a school portal and a dozen other applications online.I know about the DMZ approach to make the security of the network. But is there any other better approach, or something modern or new that is also cost effective and much more secure than using DMZ server. Thanks in advance

  • How many internal users will you have? You may want to consider hosting the website, portal, etc at a provider rather than maintaining your own hardware and infrastructure. – Ron Trunk Jul 1 '14 at 13:01
  • I suggested them but they wont listen, Its client requirement now. This is why I'm concerned about DMZ. – user2078768 Jul 1 '14 at 13:04
  • Are you just creating a DMZ, or are you setting up the entire infrastructure for the school? – Ron Trunk Jul 1 '14 at 14:18
  • I'm only responsible for the DMZ and webserver. I just want to know if there is better alternative than using a DMZ. I've already done some research, and found that it will be better to use a dual firewall DMZ network – user2078768 Jul 2 '14 at 6:45
4

There is a lot of theory in firewall design and the old outside/dmz/inside model, while still common is not by any means as popular as it once was. This question also borders on being closed as "opinion based," but I won't vote it as such personally.

In my opinion (since this sounds like a smaller deployment), you should be looking at for four zones, which would be much easier to manage/support, as well as more cost effective, on a single firewall that supports it.

In order of security (lowest to highest), I would structure the zones as follows:

  1. outside: basically outside your firewall and free of any firewall restrictions. This would also be one of two places you would put any guest access (fitting it in a four zone model and not adding a fifth).
  2. student: this is where students would connect to the network, protected from the outside, but without free access to internal resources. This is the second place you could consider for guest access.
  3. dmz: this is the traditional dmz where you would put externally accessed resources. In this case, it is also where you would put resources that should be accessed by students/guests.
  4. internal: for your staff and internal only resources. For added security, this could also be broken up into two different zones.

However key to any good firewall deployment today would be looking into a firewall that is application aware. This can provide additional protection beyond the traditional "limit access to IP/port" and state rules. For instance, it may be able to detect XSS or SQL injection attacks and block those as well.

| improve this answer | |
2

Whether one should use two firewalls or a single, three-legged firewall to create a DMZ is probably more personal preference than anything else. A single, three legged firewall works in 95% of the cases and is obviously cheaper and easier to manage than two firewalls with two rule-sets. On the other hand, two firewalls, if they are different brands, might protect against a (theoretical) vulnerability in one brand.

Unless your firewall is doing some sort of packet inspection/malware detection, the benefit of a firewall over a simple access list isn't that great. Ultimately, it makes little difference whether you use one or two firewalls as it's vulnerabilities in OSes or users that result in the vast majority of attacks.

| improve this answer | |
2

I would normally setup a single firewall with 3 sections, (what I call RED, ORANGE, GREEN), and setup rules between the 3. RED is your WAN (internett), ORANGE is your DMZ (where you put any server you want to be reachable from the internett), and a GREEN network for your normal PC's and other servers that are not to be reached from the internet (or the DMZ for that matter). even with a ORANGE network, this network can be protected quite well (for example only open port 80 if that is all you use).

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.