I'm designing a server setup for the small business where I work. We want to be able to host our own web server and other services in the future at our own location.
Being the IT guy/network guy/general tech guru, I am learning to be a jack of all trades. Unfortunately, I have little experience with networking, but I'm learning and it's been interesting.
I've been reading up on networking and I believe that I have a pretty solid understanding of what is going on with our network. I understand the principles of port forwarding and the idea that a router can be used as a way to block incoming connections to services. I've also got our Nginx-based web server up and running, although I haven't figured out how to connect it to the Internet just yet.
Also, we don't really have the budget for new equipment, so I am making do with a bunch of home networking equipment that we have laying around. If this is completely insufficient, let me know, but I assume that it will work.
Here's a quick drawing of the current setup:
Starting at the top, the thick black line (representing the building data connection, Comcast) is split into internet at the modem. There is no in-wall ethernet set up here- our business uses wi-fi as the method of internet use. So the wi-fi router is connected directly to the modem, because it is the only device on the top level. The wi-fi router serves internet for day-to-day use.
I'm trying to get the web server to be safely secluded from the rest of the network. If the server is compromised, then I don't want it affecting the computers that we use for day-to-day work.
I don't want to cause the "day-to-day" network to be slowed too much by adding the server. I also don't want the server to be very slow because of the network layout.
What should the IP addresses, subnet masks, and connections look like for each router?
This was the first solution that I came up with. Using a workgroup switch, I wanted to give both routers top-level positions. The server router would forward TCP port 80 (http).
- I could not get to work. I'm assuming this is because both routers are trying to get the same Comcast-assigned public IP from the modem. Somehow the business network router would work fine in this setup, but the other router would not renew/release IP addresses or give an outward internet connection (with a DNS failure as the reason). Although I tried giving each router different IP addresses (one 192.168.1.1, one 192.168.2.1), it did not solve the problem.
- Good security. If the server is compromised, it can't get into the business network. At worst, it could sniff traffic from the outside, but I'm not sure if this is even possible.
- Good efficiency. Each network is only slowed by the workgroup switch.
This was the next solution I came up with. It's a DMZ-style setup that allows the server to be on the outside of the business network but still serve HTTP.
- In Solution A, I could mess up the server router and there would be no consequences for daily business. But in this method, if I screw up the server router's configuration, it means trouble for everyone.
- Poor efficiency. The business network needs to go through two routers to get to the Internet.
- Poor server security. If one of the business computers becomes compromised, it can damage the server.
- Good business network security. The server, if compromised, can't get to the other computers.
- Handles public IP correctly. This solution uses a router as the top-level item, which means it can use DHCP to assign IP addresses, which a network switch lacks.
This solution is similar to the first solution, but a router is used instead of a switch to provide proper IP handling.
- Poor efficiency. Both networks have to go through 2 routers to get internet.
- Good security. Neither network can get to the other directly. In the worst case, I suppose traffic sniffing could occur (not sure).
- Handles public IP correctly. This solution has a top-level device that can use DHCP to sort out IP addresses.
I'm not sure which solution works best. Is there a better solution that I haven't thought up?
I'm also unsure of how to set the best solution up so that it serves internet properly and securely to each network. What do I need to do with IP addresses, open ports, and subnet masks for each router?
Note: I know Server Fault has a low tolerance for questions that use home networking hardware. That's really the only reason I posted here- I want my question answered and I don't want to play politics. If this is the wrong site, I would appreciate it if you could move it to the correct location. Thanks.