Is there any advantage (or perhaps I should ask, *what are the advantages*) of having a separate physical server as a firewall, another for a dmz/internet server, and another as an internal/intranet server?
| | Big Bad Internet | |
| | | | |
| dmz/internet server | --------Firewall-------- | wireless router |
| | | | |
| | intranet server, other stuff | |
For the sake of argument, let's say that the following is true:
-firewall is running a linux firewall (astaro, endian, engarde, take your pick), has a quad port ethernet card connecting as above
-the dmz/internet is runnning selinux (engarde)
-the wireless router is untrusted and ip's are tied to known mac addresses
-on the internal side, the intranet server and asterix/trixbox servers are running selinux (engarde), there is the usual bevy of stuff on the internal side (storage area network, users, etc)
-there are (obviously) switches between the firewall and dmz, and between the firewall and the internal stuff
+Is this overcomplex? Should we instead integrate the (untrusted) dmz/internet and (trusted) intranet, asterix, etc onto the firewall?
+what am i missing from a design standpoint?