Summary

Web server DMZs are probably one of the more common uses you will find for Linux firewalls these days. We run across people running NAT-ed web server clusters in the hosting business all the time using Linux boxes as front-end firewalls. Of course, one of the more common misconceptions we run into with these same users is that of surprise when a system is compromisedeven though a firewall was being used (host-based or otherwise). A firewall is not a silver bullet, and while it can help protect your system from compromise, it cannot protect you from what you allow in. If you allow connections to your web server, the firewall does not really protect you from web-based attacks.

This is why we always recommend running web servers on dedicated DMZ segments. If and when your web server is compromised, it cannot be used to leverage access to your internal network.