Dual Nic Cards - Apache

[Bret Stern]

-----Original Message-----
From: Bob McClure Jr [mailto:bob at bobcatos.com]
Sent: Monday, February 20, 2006 1:36 PM
To: bret_stern at machinemanagement.com; Getting started with Red Hat Linux
Subject: Re: Dual Nic Cards - Apache

On Mon, Feb 20, 2006 at 01:19:12PM -0800, Bret Stern wrote:
>
> I'm trying to setup a web server which is exists in a DMZ.
>
> The server has two NIC cards.
> One card (192.168.5.85) allows public web access; the other card
> (192.168.0.85) allows my internal network route for html, perl
> updates.
>
> The idea is to allow public access via the 192.168.5.85 card, while
> letting me do html and perl updates from my internal network via the
> 192.168.0.85 address.
>
> The cgi scripts which are called in the dmz would access data through
> the internal network 192.168.0.85 for internal databases etc.
>
> Is this a statisfactory and reasonably safe aproach?

I don't think so, though I'm not sure how your DMZ is connected to the 'Net
or how your LAN is connected to the 'Net.  In general, you should not be
able to get to your LAN from the DMZ.  Otherwise it's not much of a DMZ.
But getting from the LAN to the DMZ is okay.

On my system, my firewall (an old AMD K6-III 450 box) has three NICs.
One goes to the DSL modem on my assigned static IP, and the other two go to
my DMZ (one box which is my mail and web server and has one NIC) and my LAN.
The firewall is configured so that any machine on the LAN can get to the
outside and to the DMZ, but nothing gets in (that is
unrequested) except SSH and it stops at the firewall.  The firewall also
routes ports HTTP(S), SMTP, POP3, IMAP, and a few special cats and dogs to
the DMZ.  But the DMZ has no access to the LAN.

> Comments
>
> Bret Stern

Cheers,
--
Bob McClure, Jr.             Bobcat Open Systems, Inc.
bob at bobcatos.com             http://www.bobcatos.com
The best things in life aren't things.


So if you had a web server, which required access to a database, couldn't
the database be accessed via the second nic card.

[Internet]->[firewall]->routed to [web server] 192.168.5.85
                                  [second nic] 192.168.0.85 --\
                                                              |
                                                              |
							[Local Lan switch
|||||]
                                                              |
                                  [data server] 192.168.0.85 -/

This configuration is too risky??

Thanks
Bret