5 ms·
Anyone have a simple idiot proof way to make sure a hacked webserver can't hit your internal network? I have two routers (effectively a DMZ) but there must be a
by rr888 4y ago
Anyone have a simple idiot proof way to make sure a hacked webserver can't hit your internal network? I have two routers (effectively a DMZ) but there must be a better way than two levels of NAT.
- louwrentius 4y agoThat DMZ is fine already, assuming they can't start hacking your routers. What you ideally want is network segmentation, use VLANS and put devices in their isolated network, only allowed to talk to the router/firewall, which only allows incomming traffic and doesn't allow the web server to initiate connections to the internet, except for NTP, software updates and DNS (fixed ips).
- rr888 4y agoYeah I actually had a Ubiquiti Edgerouter doing this but I was never confident enough it was set up properly, hence the other solution.
- upofadown 4y agoI have the router for the internal network (a Linux box) do a bridge. So it is all the same network and no extra NATing is required. That router blocks connections into the internal network.