I am a computer programmer and having knowledge about networking but not an expert. I have a project in which I have to set up the network infrastructure for a school. The school will have it's own website, in-house web server, also a school portal and a dozen other applications online.I know about the DMZ approach to make the security of the network. But is there any other better approach, or something modern or new that is also cost effective and much more secure than using DMZ server. Thanks in advance
There is a lot of theory in firewall design and the old outside/dmz/inside model, while still common is not by any means as popular as it once was. This question also borders on being closed as "opinion based," but I won't vote it as such personally.
In my opinion (since this sounds like a smaller deployment), you should be looking at for four zones, which would be much easier to manage/support, as well as more cost effective, on a single firewall that supports it.
In order of security (lowest to highest), I would structure the zones as follows:
- outside: basically outside your firewall and free of any firewall restrictions. This would also be one of two places you would put any guest access (fitting it in a four zone model and not adding a fifth).
- student: this is where students would connect to the network, protected from the outside, but without free access to internal resources. This is the second place you could consider for guest access.
- dmz: this is the traditional dmz where you would put externally accessed resources. In this case, it is also where you would put resources that should be accessed by students/guests.
- internal: for your staff and internal only resources. For added security, this could also be broken up into two different zones.
However key to any good firewall deployment today would be looking into a firewall that is application aware. This can provide additional protection beyond the traditional "limit access to IP/port" and state rules. For instance, it may be able to detect XSS or SQL injection attacks and block those as well.
Whether one should use two firewalls or a single, three-legged firewall to create a DMZ is probably more personal preference than anything else. A single, three legged firewall works in 95% of the cases and is obviously cheaper and easier to manage than two firewalls with two rule-sets. On the other hand, two firewalls, if they are different brands, might protect against a (theoretical) vulnerability in one brand.
Unless your firewall is doing some sort of packet inspection/malware detection, the benefit of a firewall over a simple access list isn't that great. Ultimately, it makes little difference whether you use one or two firewalls as it's vulnerabilities in OSes or users that result in the vast majority of attacks.
I would normally setup a single firewall with 3 sections, (what I call RED, ORANGE, GREEN), and setup rules between the 3. RED is your WAN (internett), ORANGE is your DMZ (where you put any server you want to be reachable from the internett), and a GREEN network for your normal PC's and other servers that are not to be reached from the internet (or the DMZ for that matter). even with a ORANGE network, this network can be protected quite well (for example only open port 80 if that is all you use).