In a small office / home office (SOHO) scenario, I would like to configure the ADSL router for a small http server installation - actually an experiment with a Raspberry Pi, working as an http server. I'm a bit concerned about the security implications of the computers on the LAN, in the case this http server gets compromised.
In order for the small server to be reachable from the outside Internet, I believe there are two options which I can use to configure the ADSL router:
- Port Forwarding
In the case of Port Forwarding, I would only need to forward ports 80,443 from the Internet/WAN to the same on the http server, which in this case would remain inside the local network LAN.
In the case of DMZ it becomes extremely important to secure/harden the http server box, e.g.: change ssh port, etc., but at least the http server is no longer on the local network LAN; but still somehow in connection with the ADSL router directly.
Which of the two options would provide the most security guarantees in the case the http server gets compromised, please?
I believe in the case of port forwarding scenario, an attack could come only by means of the http port, but if the box gets compromised, the box is on the LAN. While in the case of the DMZ scenario the box is theoretically not on the LAN, but I wonder if this exposes the router to more easier attacks, and also not really sure how to check if it's a proper DMZ for "network partition" or a "wildcard port forward". In any case I verified the router is set with "remote management (from Internet/WAN)" to disabled , it is a Netgear DGND3300v2.
I would like to run this http server experiment, without compromising the safety of the home office computers.