If for example you were to create a network that will be providing e-mail,web services and hosting a LAN with users what would be the correct design layout to maximize security?

Example;

Firewall------DMZ----------Web Server
|
|
|
Proxy
|
|
|
LAN

I myself don't like to interact with web services and lan systems so I built mine this way

Internet
|
eth0
router ( has 3 nics, 1 for wan internet, 1 for dmz servers, 1 for lan)
eth1 lan ---------- eth2 dmz
lan machines----------internet servers

I have gone as far to add a second router between eth1 and lan machines. I have setup wireless access on the second router that has many security features, Mac Filtering, WPA, and radius support. May be extreme but fun to build.

Brian1 isnt that exactly the same configuration as metallica1973 posted?!

I have to agree with PK21. I was always taught to put web servers and public services in a DMZ.

Would this be more appropiate and secure?


Firewall/IDS------DMZ----------Web Server
|
|
|
Proxy/Firewall/IDS
|
|
|
LAN

or

Firewall/IDS------DMZ----------Web Server
|
|
|
Proxy/IDS
|
|
|
Firewall/IDS
|
|
|
LAN

I think i would go with the first one. But if you have switches which support mirroring of ports then I would go for the following.

|
[switch] ----mirror port to--------------
| |
Firewall------DMZ----------Web Server |
| | |
| | |
[switch] ----mirror port to---------------> IDS
|
Proxy/Firewall
|
|
LAN

Maybe you can mirror switch ports to tap traffic on multiple switches on your network and connect them with an IDS system like snort. With a setup like this traffic will be copied to your IDS and the IDS system doesnt need to send any traffic, it will only recieve traffic and is for this reason more secure then a system that will be reachable from your network.

Damn, my drawings outline didn't stay, lets try again :-) :

|
[switch] ----mirror port to--------------> IDS
|
Firewall------DMZ----------Web Server
|
|
[switch] ----mirror port to---------------> IDS
|
Proxy/Firewall
|
[switch] ----mirror port to---------------> IDS
|
LAN

And ofcourse you can also mirror the traffic which is generated on the DMZ

Interesting, I will have to read up on port mirroring. thanks