Dmz para acceso externo e interno

mremersaro

Buenas noches hoy cuento con una instalacion de OsTickets 1.12 dentro de mi Lan, pero necesito publicar el servicio hacia internet para que se pueda acceder desde la wan. La idea es poner un server en la dmz y que tanto los usuarios de lan como wan accedan a ese server de la dmz, ahora esta es la mejor opción? O se podría tener 2 server uno dmz para acceso externo y 1 server en la lan para el acceso interno pero ambos sincronizados y consultando sobre la misma base?

aguardo sus comentarios

grac

ntozier

Whats the best option? That really depends on what your security requirements are, as well as your companies procedures and policies.

If you are going to have two servers and sync the data between them (you would sync the servers using mySQL replication) I'm not sure how well that would work as it would have to be real time replication. This isn't something that I personally have ever setup. My understanding is that real time replication isn't really a thing in this day and age yet.

So you would probably be better off having two webservers (one external, one internal) talking to a single mysql server. You would want to talk to whoever handles your internal security (such as your security officer) to see what they recommend.

mremersaro

Gracias ntozier, me podrias indicar desde donde configuro la conexion del segundo servidor a la DB del primer server?

gracias

ntozier

Just copy the /include/ost_config.php from one installation to the other.

mremersaro

Y que puertos son los que debería de habilitar desde el server dmz al server LAN..?

y en el server dmz tengo que eliminar el plugin del ldap?

ntozier

HTTP: 80
if you plan in using HTTPS: then 443.
if Mysql is not on the server: 3306

if that server is going to be sending/receiving emails then you would need the ports for the protocol that you choose to do it for outgoing connections.

Really it ultimately depends on how you set everything up.

mremersaro

Perdon ntozier, pero en el server DMZ le copio el ost-config.php del server LAN, pero la base de datos del DMZ esta apuntando a su server DMZ y no a la base del LAN, en que parte del ost-config.php tengo que configurarle la conexion hacia el server LAN?=

Seria en la opcion que remarque? ahi tendria que poner la IP del server LAN?
😀

ntozier

You highlighted it. You would want to put the Ip address of the mysql server there.

mremersaro

Seria aca:

mremersaro

ntozier, reemplace localhost por ala ip del server de la LAN pero ahora no me levanta el sitio.

ntozier

Have you setup a route in the firewall from the dmz to the server?

mremersaro

ntozier

I would remote into the dmz server and see if I could get to the mysql server inside the lan.
There are a number of ways that you can do that.

Also
Does your mysql user have permissions to connect from the DMZ server?
(check their permissions)

mremersaro

me esta tirando este error cuando intento conectarme del DMZ a la LAN

ERROR 2003 (HY000): Can't connect to MySQL server on '192.168.21.35' (111)

Alguna idea?

ntozier

possible causes:

there is a firewall blocking the connection
MySQL is not actually running on that host -or- is not listening at that IP address
Network failure (such as there is no route to the host.)

mremersaro

Es es realmente Raro, porque aparentemente tengo conexión del la dmz hacia la lan pero no puedo conectarme a la db de la lan

ntozier

does your MySQL user have permission to talk to the db serer?

mremersaro

Estoy usando el mismo usuario que utilizo en el ost-config y utilizo para ingresar de adminmyphp. Es desde el server lan con ese mismo usuario ingreso. Tengo que configurar algo en el server lan para permitir que server tiene permiso para conectarse?
gracias

ntozier

But that doesn't mean that you gave the user permissions to connect from a server outside of the server that it is configured on.

Check the my.cnf bind-address.

Then grant the privilege.
GRANT ALL PRIVILEGES ON *.* TO 'USERNAME'@'1.2.3.4' IDENTIFIED BY 'PASSWORD' WITH GRANT OPTION;

Make sure that you change:

USERNAME to the actual DB users's username
1.2.3.4 to the actual IP of the MySQL server
PASSWORD to the actual DB user's password

I would actually recommend that you add a second username/password combo for the external access and grant it access to the database.

Then test the connection.

mremersaro

ntozier esto lo ejecuto desde el server LAN (donde esta mi mysql)? o desde el server DMZ?

Modifique el my.cnf y puse en bind-address = 0.0.0.0.

Pero desde el server DMZ ejecute mysql -h 192.168.21.35 -u root -p y me dio este error:

ERROR 1130 (HY000): Host '10.70.70.42' is not allowed to connect to this MySQL server

mremersaro

En el my.cnf me hace referencia a la que la configuracion esta en /etc/mysql/mysql.conf.d/mysqld.cnf alli es donde tengo que modificar el permiso de conexion externa y ademas del localhost poner la IP de server DMZ?