Dual Nic Cards - Apache

[Bob McClure Jr]

On Mon, Feb 20, 2006 at 01:19:12PM -0800, Bret Stern wrote:
> 
> I'm trying to setup a web server which is exists in a
> DMZ.
> 
> The server has two NIC cards.
> One card (192.168.5.85) allows public web access; the other
> card (192.168.0.85) allows my internal network route for
> html, perl updates.
> 
> The idea is to allow public access via the 192.168.5.85 card,
> while letting me do html and perl updates from my internal
> network via the 192.168.0.85 address.
> 
> The cgi scripts which are called in the dmz would access data
> through the internal network 192.168.0.85 for internal databases etc.
> 
> Is this a statisfactory and reasonably safe aproach?

I don't think so, though I'm not sure how your DMZ is connected to the
'Net or how your LAN is connected to the 'Net.  In general, you should
not be able to get to your LAN from the DMZ.  Otherwise it's not much
of a DMZ.  But getting from the LAN to the DMZ is okay.

On my system, my firewall (an old AMD K6-III 450 box) has three NICs.
One goes to the DSL modem on my assigned static IP, and the other two
go to my DMZ (one box which is my mail and web server and has one NIC)
and my LAN.  The firewall is configured so that any machine on the LAN
can get to the outside and to the DMZ, but nothing gets in (that is
unrequested) except SSH and it stops at the firewall.  The firewall
also routes ports HTTP(S), SMTP, POP3, IMAP, and a few special cats
and dogs to the DMZ.  But the DMZ has no access to the LAN.

> Comments
> 
> Bret Stern

Cheers,
-- 
Bob McClure, Jr.             Bobcat Open Systems, Inc.
bob at bobcatos.com             http://www.bobcatos.com
The best things in life aren't things.