0

In a small office / home office (SOHO) scenario, I would like to configure the ADSL router for a small http server installation - actually an experiment with a Raspberry Pi, working as an http server. I'm a bit concerned about the security implications of the computers on the LAN, in the case this http server gets compromised.

In order for the small server to be reachable from the outside Internet, I believe there are two options which I can use to configure the ADSL router:

  • Port Forwarding
  • DMZ

In the case of Port Forwarding, I would only need to forward ports 80,443 from the Internet/WAN to the same on the http server, which in this case would remain inside the local network LAN.

In the case of DMZ it becomes extremely important to secure/harden the http server box, e.g.: change ssh port, etc., but at least the http server is no longer on the local network LAN; but still somehow in connection with the ADSL router directly.

Which of the two options would provide the most security guarantees in the case the http server gets compromised, please?

I believe in the case of port forwarding scenario, an attack could come only by means of the http port, but if the box gets compromised, the box is on the LAN. While in the case of the DMZ scenario the box is theoretically not on the LAN, but I wonder if this exposes the router to more easier attacks, and also not really sure how to check if it's a proper DMZ for "network partition" or a "wildcard port forward". In any case I verified the router is set with "remote management (from Internet/WAN)" to disabled , it is a Netgear DGND3300v2.

I would like to run this http server experiment, without compromising the safety of the home office computers.

3

DMZ is a very bad idea to use in any case.

Basically what DMZ does, is completely disables the router protocol for any ip address and forward all ports from outside to the internal.

And the server can still be within your network and thus be accessible. So any port is open to your server and any unwanted attacks are possible.

Port Forwarding is ALWAYS the way to go. DMZ is usually used for when your router does not support the kind of traffic, or there's a second router behind and your router doesn't bridge or for when you quickly need to test if the router is causing any problems.

But remember, you can always place your server outside of the other network if you setup your network correctly using VLAN's (if your router supports such).

  • 1
    Your advice, while completely appropriate for the vast majority of cases, seems a little overstated, in that there are valid reasons and means to securely DMZ a service or services. I would point out also, that DMZ does not bypass routing (or the firewall on most enterprise systems), it bypasses NAT, by sending unsolicited traffic destined for non-NAT mapped ports to the host. This can be really useful for service discovery, advanced load balancing techniques, and the provision of multiple service instances. but you are right, if you have to ask, DMZ is not for you. – Frank Thomas Dec 4 '15 at 22:58

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.