From: Brian (brian_ffm_at_hotmail.com)
Date: Wed 08 Sep 2004 - 12:37:01 BST
I like to restrict the database server. no NAT.
yes, it's the same interface but no one can go from the internet to the
database. The Database vserver are only in private network with eg.
10.10.10.1... only local vserver can access the DB Server. other point ist
I have only 4 public IP Addresses.
not good ? :-)
thanx, Brian
----- Original Message -----
From: "Herbert Poetzl" <herbert_at_13thfloor.at>
To: "Brian" <brian_ffm_at_hotmail.com>
Cc: <vserver_at_list.linux-vserver.org>
Sent: Wednesday, September 08, 2004 10:38 AM
Subject: Re: [Vserver] DMZ with vserver
> On Tue, Sep 07, 2004 at 10:56:36PM +0200, Brian wrote:
> > is ist possible ore advisable to install vserver with a DMZ ?
> >
> > HOST
> > eth0 = Internet
> > eth0:0 = privat network
> >
> > Vserver1 for Webserver
> >
> > eth0 = Internet
> > eth0:0 = privat network
> >
> > Vserver2 for Mail
> >
> > eth0 = Internet
> > eth0:0 = privat network
> >
> > Vserver3 for mysql
> >
> > eth0 = privat network
>
> hmm, well, as I see it, all packets will
> be sent over the _same_ interface and all
> servers will have access to both networks
> (maybe even on the same ip ?) so I do not
> see much security in that ...
>
> maybe assigning just one private network
> address to each vserver, and using S/DNAT
> to map specific ports from/to the outside
>
> HTH,
> Herbert
>
> > thanx, Brian
> > _______________________________________________
> > Vserver mailing list
> > Vserver_at_list.linux-vserver.org
> > http://list.linux-vserver.org/mailman/listinfo/vserver
> _______________________________________________
> Vserver mailing list
> Vserver_at_list.linux-vserver.org
> http://list.linux-vserver.org/mailman/listinfo/vserver
>
_______________________________________________
Vserver mailing list
Vserver_at_list.linux-vserver.org
http://list.linux-vserver.org/mailman/listinfo/vserver