1

Ive, for some odd reason, have always fantasied about hosting my own web site from home...

I know security wise it isnt the best thing in the world but Im looking for a new tips on that today.

The best think I honestly think would be to put my web server (actually the VM containing the web server) in a DMZ.

Right now my network layout is this:

enter image description here

Not too complex. What I want to add is also very simple:

enter image description here

But if someone would compromise my web server, they would basically have access to all the network (192.168.1.0/24)

What would be the diagram if I want to put that web server in its own DMZ, separated completely from my network and only have access to and from the internet? How would I implement it?

Just in case, I have checked and my ISP does NOT block port 80.

EDIT: I forgot to mention, if I have a dynamic IP but I have a DDNS services, I can, with DNS records, make a CNAME that points to actual site right? Such as:

myactualsite.com CNAME ddns.no-ip.org
myactualsite.com DNAME ddns.no-ip.org
  • Two things: Site complains that I cant post images until I have 10 rep and, technically, there is another vSwitch (my WAN) between the firewall and the ISP modem. – riahc3 Apr 17 '15 at 13:30
  • 1
    Give web server PC/VM a static IP on your LAN -> port forward (from your router/firewall) only port 80 to your web server IP -> create your DNS records for your domain to point to your home public IP -> job done. Because you're only forwarding port 80 then you are minimising security breaches because only HTTP requests can reach your LAN, everything else can remain secured. – Kinnectus Apr 17 '15 at 13:36
  • @BigChris That sounds incredibly insecure. If someone should take over that web server, he would have access to all my home network. – riahc3 Apr 17 '15 at 13:38
  • Also what if I want to do to FTP upload (21), SSH (22), etc.? – riahc3 Apr 17 '15 at 13:39
  • 1
    By you putting your web server into the DMZ is incredibly insecure (DMZ - demilitarized zone - no protection - all ports open)... what I'm suggesting is far more secure. By port forwarding you only open the ports you want to open. If you want to "FTP" or "SSH" into the server then forward these ports too... OR, create a VPN where only YOU can have full access to your LAN from outside. To have your website visible to the outside you must, at least, open port 80 to the Internet; and port 443 is you wish to host an SSL enabled website. port forwarding is directed to a single client in your LAN. – Kinnectus Apr 17 '15 at 13:43
0

See pfSense - Example setup isolating LAN and DMZ but each with unrestricted Internet access

I haven't read the pfSense docs but I assume it is possible to configure one of the several Ethernet ports as a DMZ port with a separate subnet such that the psSense will isolate it's traffic from your LAN traffic and you then set rules to prevent compromised DMZ servers being able to initiate connections to your LAN devices.

           ,--------.   LAN   ,---------.
PC --------| switch |---------| pfSense |------ Intertubes
         ,-|        |     ,---|         |
Server--'  '--------'     |   '---------'    
with                      |DMZ
secrets                   |
                       ,--+---.
                       |web   |
                       |server|
                       '------'

I'm not sure how a computer running Vmware ESXi can host a pfSense device but that seems an odd thing to do. I'd want a separate physical device dedicated to security.

| improve this answer | |
  • Agree with Big Chris, separate subnets, but no reason to put the server in a DMZ with all the ports wide open. Just port forward 80 on the router to the server. – heavyd Apr 17 '15 at 14:11
  • @heavyd: We may be writing at cross purposes here. Some router manufacturers rather sloppily use the term DMZ to refer to en-masse wildcard port forwarding willy-nilly to any one device in your LAN. I use DMZ in the more normal traditional secure sense of a physically and logically isolated network segment access to/from which is mediated by a proper firewall configured to treat the DMZ as if it were compromised. – RedGrittyBrick Apr 17 '15 at 14:12
  • @RedGrittyBrick - that's why I deleted my comment. Sorry for any confusion. I should have written that I was referring to your bog standard SoHo router. A pfSense obviously has the ability to isolate entire segments so it's doing DMZ properly. – Kinnectus Apr 17 '15 at 14:16
  • @RedGrittyBrick "I'm not sure how a computer running Vmware ESXi can host a pfSense device but that seems an odd thing to do" Searching for "pfSense on ESXi" shows around 86,700 results on how "odd" it is ;) It is very common to run pfSense on ESXi – riahc3 Apr 17 '15 at 14:21
  • Anyone have any more ideas or insite? – riahc3 Apr 18 '15 at 18:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.