1

Background

I'm designing a server setup for the small business where I work. We want to be able to host our own web server and other services in the future at our own location.

Being the IT guy/network guy/general tech guru, I am learning to be a jack of all trades. Unfortunately, I have little experience with networking, but I'm learning and it's been interesting.

I've been reading up on networking and I believe that I have a pretty solid understanding of what is going on with our network. I understand the principles of port forwarding and the idea that a router can be used as a way to block incoming connections to services. I've also got our Nginx-based web server up and running, although I haven't figured out how to connect it to the Internet just yet.

Also, we don't really have the budget for new equipment, so I am making do with a bunch of home networking equipment that we have laying around. If this is completely insufficient, let me know, but I assume that it will work.

Here's a quick drawing of the current setup:

current setup

Starting at the top, the thick black line (representing the building data connection, Comcast) is split into internet at the modem. There is no in-wall ethernet set up here- our business uses wi-fi as the method of internet use. So the wi-fi router is connected directly to the modem, because it is the only device on the top level. The wi-fi router serves internet for day-to-day use.

Problem Description

Security

I'm trying to get the web server to be safely secluded from the rest of the network. If the server is compromised, then I don't want it affecting the computers that we use for day-to-day work.

Efficiency

I don't want to cause the "day-to-day" network to be slowed too much by adding the server. I also don't want the server to be very slow because of the network layout.

Setup

What should the IP addresses, subnet masks, and connections look like for each router?

Solutions

Solution A

This was the first solution that I came up with. Using a workgroup switch, I wanted to give both routers top-level positions. The server router would forward TCP port 80 (http).

Cons:

  • I could not get to work. I'm assuming this is because both routers are trying to get the same Comcast-assigned public IP from the modem. Somehow the business network router would work fine in this setup, but the other router would not renew/release IP addresses or give an outward internet connection (with a DNS failure as the reason). Although I tried giving each router different IP addresses (one 192.168.1.1, one 192.168.2.1), it did not solve the problem.

Pros:

  • Good security. If the server is compromised, it can't get into the business network. At worst, it could sniff traffic from the outside, but I'm not sure if this is even possible.
  • Good efficiency. Each network is only slowed by the workgroup switch.

Solution B

This was the next solution I came up with. It's a DMZ-style setup that allows the server to be on the outside of the business network but still serve HTTP.

Cons:

  • In Solution A, I could mess up the server router and there would be no consequences for daily business. But in this method, if I screw up the server router's configuration, it means trouble for everyone.
  • Poor efficiency. The business network needs to go through two routers to get to the Internet.
  • Poor server security. If one of the business computers becomes compromised, it can damage the server.

Pros:

  • Good business network security. The server, if compromised, can't get to the other computers.
  • Handles public IP correctly. This solution uses a router as the top-level item, which means it can use DHCP to assign IP addresses, which a network switch lacks.

Solution C

This solution is similar to the first solution, but a router is used instead of a switch to provide proper IP handling.

Cons:

  • Poor efficiency. Both networks have to go through 2 routers to get internet.

Pros:

  • Good security. Neither network can get to the other directly. In the worst case, I suppose traffic sniffing could occur (not sure).
  • Handles public IP correctly. This solution has a top-level device that can use DHCP to sort out IP addresses.

Bottom Line

I'm not sure which solution works best. Is there a better solution that I haven't thought up?

I'm also unsure of how to set the best solution up so that it serves internet properly and securely to each network. What do I need to do with IP addresses, open ports, and subnet masks for each router?

Note: I know Server Fault has a low tolerance for questions that use home networking hardware. That's really the only reason I posted here- I want my question answered and I don't want to play politics. If this is the wrong site, I would appreciate it if you could move it to the correct location. Thanks.

  • 1
    To be honest if it was my network, working with a low budget which I have had to do many times I would look to run a PC acting-as-a firewall. Grab an old PC and make sure you pop in another Network Card (for proper DMZ you need three NIC's) install pfSense or something similar, then have one connected to the Modem and pass-through the external IP to the pfSense External NIC, one to the Server for DMZ and one to your Network. You can then modify the Router settings to be a WiFi AP only and properly secure the network down. – CharlesH Jun 29 '15 at 15:29
1

Going by your 3 offered choices, B is the best (IMO), as it keeps the server on a perimeter network, and the internal router firewalls your internal business network from the perimeter network (so that the server can't access the business network), while using the least equipment.

The "real" answer (again, IMO):

  • Get a router that supports a proper demilitarized zone (DMZ).
  • Put server into DMZ.
  • Ensure routes exist between LAN and DMZ, and WAN and DMZ.
  • Profit.
  • Thanks for the answer. I think at this point, I'll go with B, with the goal of getting better hardware in the future. Is there anything special that I would need to do with the IP addresses and subnet masks of the 2 routers in B? Do they need to be different? Also, is C still a secure solution and does it fix the problem in A correctly? Thanks. – Blue Ice Jun 29 '15 at 15:38
  • Only word of caution in B that I can offer is if the Modem is passing through the external IP (or even if its not to be honest) make sure you are not being caught out by 'Double NAT' as this can cause all sorts of strange issues... – CharlesH Jun 29 '15 at 15:47
  • @CharlesH Can you explain what you mean by "Double NAT"? Thanks – Blue Ice Jun 29 '15 at 15:58
  • @Blue Ice effectively NAT is the method of translating the external IP to the internal IP range. However if you have two or more devices trying to perform NAT then each of them believe they have to perform network translation from one IP address to its 'internal' range. It's quite an in depth subject, effectively whatever device is internet facing with an internal IP (like 192.x.x.x) that is performing NAT so disable on the other device(s) – CharlesH Jun 29 '15 at 16:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.