Re: Web Server Network Setup Questions

Internet --> Firewall 1 --> W2003 Web Server --> Firewall 2 --> Router 1
--> iSeries

Firewall 1 only allows ports 80 & 443 (or whatever ports your web server
uses).
Firewall 2 only allows the ODBC ports (or sockets or whatever) between
the web server & iSeries.
Router 1 disallows traffic from Firewall 2 to wind up anywhere but the
subnet with the iSeries.

The area between Firewall 1 & Firewall 2 is the classic demilitarized
zone or DMZ.  The idea is that only devices (web servers, etc.) in the
DMZ are exposed to the internet.  Everything inside of Firewall 2 has a
NATted address and can't be directly attacked from the outside.  Your
email gateway device, for instance, would also be in the DMZ and would
only have the email ports exposed to the Internet.  Firewall 1's rules
would be such that 80 & 443 traffic would only be forwarded to the web
server and email traffic would only be forwarded to the email gateway.
That way if a web server was accidentally started on the email device it
wouldn't be exposed to the internet and couldn't be an attack vector.

That NATting would include the iSeries; it would have a 10.xx.xx.xx or
192.168.xx.xx type of address that doesn't traverse Router 1.  Some
installations also NAT the addresses of the servers in the DMZ; in these
cases Firewall 1 (or an adjacent router) maps the Internet address to
the NATted address.

In a real world installation, you'll generally also wind up with ports
open on Firewall 2 and defined routes that allow the web developers/site
maintainers to access the W2003 server.  Sometimes this will be done
using a second Ethernet card in the W2003 box.

You may also use a 2nd Ethernet adapter in the iSeries to funnel
internal traffic & keep it segregated from traffic between it & the web
server.

With the right firewall & router rules, you don't need separate Internet
connections for your exposed services and the regular pipe the users
use. 


John A. Jones, CISSP
Americas Information Security Officer
Jones Lang LaSalle, Inc.
V: +1-630-455-2787 F: +1-312-601-1782
john.jones@xxxxxxxxxx

-----Original Message-----
From: web400-bounces@xxxxxxxxxxxx [mailto:web400-bounces@xxxxxxxxxxxx]
On Behalf Of Mike
Sent: Wednesday, August 23, 2006 3:37 PM
To: Web Enabling the AS400 / iSeries
Subject: [WEB400] Web Server Network Setup Questions

While this may not be a usual forum for this, this IS iSeries related. I
am just querying the others out here how they do it.

We have been using an outside vendor for web hosting and are just now
going to be bringing our web site in-house. From what I understand (I
just jumped
in) there will be a seperate line for the web server (Windows 2003) than
our regular internet connection to keep things out of the internal
network.
However, we want to do a bunch of stuff with our iSeries data (mostly
inquiry) which of course is in the internal network. How have you setup
your connection for things like this? We have ideas, but have no idea
what works best in practice.

--
Mike Wills
http://mikewills.name - Blog
http://theriverbendpodcast.com - Podcast
--
This is the Web Enabling the AS400 / iSeries (WEB400) mailing list To
post a message email: WEB400@xxxxxxxxxxxx To subscribe, unsubscribe, or
change list options,
visit: http://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives at
http://archive.midrange.com/web400.
 

This email is for the use of the intended recipient(s) only.  If you have 
received this email in error, please notify the sender immediately and then 
delete it.  If you are not the intended recipient, you must not keep, use, 
disclose, copy or distribute this email without the author's prior permission.  
We have taken precautions to minimize the risk of transmitting software 
viruses, but we advise you to carry out your own virus checks on any attachment 
to this message.  We cannot accept liability for any loss or damage caused by 
software viruses.  The information contained in this communication may be 
confidential and may be subject to the attorney-client privilege. If you are 
the intended recipient and you do not wish to receive similar electronic 
messages from us in future then please respond to the sender to this effect.