LAN Security with public servers

[InlineFour]

for comsumers, is the safest and cheapest solution for securing an internal lan with public webservers is by using 2 NAT routers?

teh evil int3rweb > external NAT > public webserver > internal NAT > internal machines

is this essentially how most commercial LANs are secured, by segregating the public computers from the internal computers?

 

[nweaver]

not sure it's the best way, but we don't ever double-nat. We run web->Pix (non nat)->7500 (core router)-> servers/machines on live IP's. the PIX also has a nat pool for several secured networks.

 

[Genx87]

I could be wrong but you dont necessarily have to NAT them just do this

Internet--->Firewall--->external network--->firewall---->internal network.

 

[JackMDS]

Originally posted by: InlineFour
for comsumers, is the safest and cheapest solution for securing an internal lan with public webservers is by using 2 NAT routers?

The answer to the quote is Yes.

Network Segregation - Adding security to Wireless Network (or to any peer to peer Network).

:sun:

 

[InlineFour]

not sure it's the best way, but we don't ever double-nat. We run web->Pix (non nat)->7500 (core router)-> servers/machines on live IP's. the PIX also has a nat pool for several secured networks.

cisco pix would be overkill on a home network and expensive as well.

Internet--->Firewall--->external network--->firewall---->internal network.

firewall is a general term. a NAT router is essentially a "firewall", but there could be better solutions.

JackMDS, what would be the next step better than 2 NAT routers for network segregation? 🙂

 

[JackMDS]

Best, Safest etc. are all ?Relative? terms.

Relative to the needs and the environment that it is only known to you.

So, upward the next step would involves professional system with special hardware, or and Central Server system (like Win2003) with ISA and RADUIS.

Downward, as posted above software Firewalls. Assign Static IPs (or reserve IPs within DHCP if your Router can do so). Leave a small open range of DHCP for the public Wireless, and use the Trusted Zone of the Firewall to curb traffic between the Wireless IPs and the Static/Reserved IPs.

:sun: