Getting my head around implementing a webserver

Hi Everyone,

I`m working in a school and at present our network is sat behind a VERY restrictive firewall and proxy, the school have decided they want to host thier own website in-house, to do this I need to contact the EMBC (our ISP) and put a written request in for an external IP, it also suggests reading thier firewall policy which iv done, basicaly in a nutshell it says they will remove thier firewall protection for that perticular IP.

Am I right in thinking that because our webserver would be on our LAN if an attacker compromised it, they could potentially compromise our whole network. and because the IP I specify to them is an internal LAN one I cant put it on a network of its own. It does state that we have to have a firewall in operation protecting it, could anyone make any suggestions as to how this could be set up?

Thanx

Craig Dunn

Without knowing the network topography in this school it would be difficult to comment properly.

I would look at using either the DMZ or Virtual Server functions of your edge router to help handling the traffic.

You might want to use another firewall between the web server and the rest of the network to protect the rest of the network if the web server becomes compromised.

Steve

Normally, web servers are placed in the DMZ. Get with your network admin and see if they'll free up a port for you.

What I would suggest is setting up two separate VLANs on your router/firewall, one for your "normal" network and one for your webserver network. Just make sure they are completely separate and you should be fine.

Honestly you have a lot of concerns that are related to security, I would just pay a few bucks and have another company manage it for you. Hosting is pretty cheap these days... Thats just my 2 cents