Security

Ask something
Discussion Locked

Exchange DMZ dilemma

0 helpful
1 reply

by amariniello

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

A system that I am setting up has a DMZ and they want to use Exchange 2K functionality and have their own mail server. A colleague has suggested, locating the Exchange server in the DMZ and allowing the clients to access the server through the Internal firewall. The Domain controller (All 2K) is located on the internal network and I would like all accounts to be centrally administered. I also want no connections initiated from the DMZ into the internal network.
If I use a front end / back end server situation I will need to punch a few holes though the firewall.
Can I use a Linux server running send mail/qmail/whatever to pickup the mail and the internal exchange server to retrieve it? Thus elimination the need to open up a hole from the DMZ to the internal network?
Does an anyone have any ideas or suggestions???

1 reply

by thomas.nilsen

I would recommend using 1 of these options:

1. Install a Linux box running sendmail/postfix/qmail on DMZ and open up TCP port 25 from DMZ to the internal Exchange server. You won't get it more secure than this. This will also give you the option of using spamfilters etc on the SMTP daemon.

2. Install a Linux/Windows box with a third party SMTP anti-virus gateway - like Trend InterScan.

I would never place a full Exchange server on DMZ. There's to many ports that needs to be open. Place only the SMTP gateway on DMZ, while the mail server stays on the internal LAN.

This discussion is closed to new replies.