# Network Design

**URL:** <https://forums.suse.com/t/network-design/23464>\
**Category:** Chatting over the Back Fence\
**Created:** [January 2, 2013, 8:46am UTC](https://forums.suse.com/t/network-design/23464 "2013-01-02T08:46:01Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![System1](https://avatars.discourse-cdn.com/v4/letter/s/51bf81/32.png) [@System1](https://forums.suse.com/u/System1)\
**Post date:** [January 2, 2013, 8:46am UTC](https://forums.suse.com/t/network-design/23464/1 "2013-01-02T08:46:01Z")

</div>

I have a 3-legged router/firewall setup with a DMZ subnet, a private  
subnet, and the WAN. On the private subnet, I have two file servers, a  
DNS/DHCP/Print server, and a DC. In the DMZ, I have a web server and a  
DNS server. I do not allow any traffic from the DMZ to the internal  
network and only allow DNS and HTTP traffic form the internet to the  
DMZ. What is the most secure way to add an email server and VPN server  
into the network. I don’t want to allow any traffic directly form the  
internet to the internal network and I don’t want to allow any traffic  
from the DMZ to the internal network. How do most corporate environments  
with a focus on security have this setup?

Thanks

## – jrothwell

jrothwell’s Profile: [http://forums.novell.com/member.php?userid=38450](http://forums.novell.com/member.php?userid=38450)  
View this thread: [http://forums.novell.com/showthread.php?t=462788](http://forums.novell.com/showthread.php?t=462788)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex022/uploads/suse/original/2X/5/5012ba89e3ffb5220dac47d5ea0ba032e2fe1cb6.png) [@system](https://forums.suse.com/u/system)\
**Post date:** [January 2, 2013, 3:19pm UTC](https://forums.suse.com/t/network-design/23464/2 "2013-01-02T15:19:53Z")

</div>

Most environments I’ve seen allow the VPN traffic to a machine with an  
internal network NIC (either as the only NIC or as a second NIC with the  
other NIC being in the DMZ or something). That machine, then, handles the  
VPN negotiations and only forwards traffic from VPN clients once they are  
authenticated and assuming their traffic should go to the internal  
network. Setting this up with OpenVPN is pretty easy, though sometimes  
there are a lot of steps involved; the OpenVPN site has a great  
walk-through/howto that covers just about everything:  
[http://openvpn.net/index.php/open-source/documentation/howto.html](http://openvpn.net/index.php/open-source/documentation/howto.html)

You could potentially have the VPN box entirely outside the internal  
network (DMZ or whatever) but then to get the VPN traffic into the network  
would require a bit of router fun, and I do not see how that would be  
worth it; either the router would allow it in after you configured it to  
do so, or the box itself could just plug in internally and switches could  
handle the rest. Either way traffic from this box will get to the  
internal network when addressed appropriately.

Good luck.