network layout

[hargi]

I dont know if i have this right.
If i have 2 servers a web server and a database server do they both need to be in the dmz?
The web server will use information from the database server to populate pages and allow users to perform searches, but the database should only be able to be edited from the internal network.

Im in the understanding that intranet is internal, internet is external and the DMZ is a place were things are put that are needed both internally and externally?

TIA

 

[samuria]

None of them should be in the dmz zone as this lets everything come in so any attack be it ftp, http etc will get in.

You just forward the port for the webserver normally port 80 and thats all thats needed and attacks are then limited to that one port and on server. The database doesnt need to be on the internet so its safe behind NAT