05-04: Exercises¶
Question¶
A small company has:
- An internal LAN with employee workstations and a file server (should never be reachable directly from the internet).
- A public-facing web server that customers need to reach over the internet.
- A single internet connection.
Design a segmented network:
- How many network zones/subnets should exist, and what goes in each?
- What traffic should be allowed between each pair of zones (internet, DMZ, internal)?
- Why is putting the web server directly on the internal LAN a bad idea, even with firewall rules protecting it?
Solution¶
Step 1: Define the zones¶
Three zones are the standard pattern here (see 05-07: ACLs, DMZ & Segmentation):
| Zone | Contains | Trust level |
|---|---|---|
| Internet | Everyone else | Untrusted |
| DMZ (Demilitarized Zone) | Public-facing web server | Semi-trusted |
| Internal LAN | Employee workstations, file server | Trusted |
Each zone should be its own subnet (see 01-05: IPv4 Subnetting & CIDR) so the firewall can apply a distinct policy per zone based on subnet membership — e.g., DMZ = 192.168.10.0/24, Internal = 192.168.20.0/24.
Step 2: Define the allowed traffic per zone pair¶
| From → To | Allowed? | Why |
|---|---|---|
| Internet → DMZ | ✔️ HTTP/HTTPS only, to the web server's IP | That's the whole point of the DMZ — it's meant to be reached from outside |
| Internet → Internal | ❌ Never directly | Employee workstations and the file server have no business being internet-reachable |
| DMZ → Internal | ❌ (or tightly restricted, e.g., one specific port to a database) | If the web server is compromised, it should NOT be a stepping stone straight into the trusted LAN |
| Internal → DMZ | ✔️ For administration (e.g., SSH from a management host only) | Admins need to manage the web server |
| Internal → Internet | ✔️ General outbound (browsing, updates, etc.) | Normal business use |
| DMZ → Internet | ✔️ Limited (e.g., OS updates only) | The web server shouldn't need broad outbound access either |
Step 3: Why not just put the web server on the internal LAN?¶
Even with perfect firewall rules on day one, this design has a structural flaw: the security of the entire internal network now depends entirely on the web server never being compromised.
- Web servers are the most exposed, most frequently attacked systems in any organization — they're specifically designed to accept connections from the untrusted internet.
- If an attacker compromises the web server (through an application vulnerability the firewall can't see, since firewalls generally don't inspect HTTP application logic — see 05-08: Firewall Limitations & Evasion), they now have a foothold inside the same network segment as the file server and employee workstations, with no additional network boundary to cross.
- With a proper DMZ, that same compromise only gives the attacker a foothold in the DMZ — a separate segment where the firewall enforces that DMZ→Internal traffic is denied or tightly restricted by default. The attacker has to defeat a second boundary to reach anything of real value.
This is the core idea of defense-in-depth and segmentation: a single compromised system should never automatically mean the whole network is compromised.
Final Answer¶
- Three zones: Internet (untrusted) / DMZ (web server) / Internal LAN (workstations + file server).
- Policy: Internet↔DMZ allowed on HTTP/HTTPS only; Internet↔Internal denied entirely; DMZ↔Internal denied or minimal; Internal↔DMZ allowed for admin; Internal↔Internet and DMZ↔Internet allowed outbound (DMZ more restricted).
- Placing the web server on the internal LAN removes the network boundary that limits the blast radius of a web-server compromise — segmentation exists precisely so that one system being attacked doesn't automatically expose everything else.