How realistic is this architecture? It’s been a while since I’ve set something like this up for work.

The thought behind this layout is that having only one machine hanging out there with just Apache and ssh (from lan only, non-standard port), and forwarding via Mod_Proxy any services I might want to share with non-LAN friends/family (photos, docs), is a smaller exposure than hosting all my VMs in a DMZ and hoping that the one server doesn’t get nuked.

Something like: DNS -> public-zone{ www-serv } <-> firewall-1 <-> lan{ vm-host <-> firewall-2 <-> (printers, laptops, etc) }

firewall-1 is actually a router running Tomato, with custom iptables rules. That way if www-serv is compromised the attacker can’t just drop some rules.

firewall-2 is just iptables rules on vm-host

all LAN computers’ iptables are a little more permissive, with holes for SAMBA, CUPS, and ssh on non-standard port.

What do you think? Is this sufficient? What would you do differently?

  • frongt@lemmy.zipEnglish
    3·
    2 days ago

    I think Apache is overkill. Just use caddy or traefik if it’s containers. nginx if not.

    • BonkTheAnnoyed@lemmy.blahaj.zoneOPEnglish
      2·
      2 days ago

      The real answer is, ngnx is a great fit. I already know most quirks of Apache, though, and I don’t necessarily want to pull in another manual to my brain.

      I might switch in the future, though. It’d be handy to have that in my pocket.

      I’m not using containers, per se, at least not in the docker sense, virtualization is done with is KVM