What is the safest method of port forwarding?

Question

So, I don't know very much about networking but I am attempting to create my own web server so that I can have website development practice. All was going well until I learned that I had to "forward some ports". The problem with this is that there are some computers on my network with sensitive financial information which I want to be at as protected as possible. What would be the best way to go about this? Should I attempt to set up two separate home networks? If so, how would I do this?

Answer 1

The way to think about this is trust. Right now, you trust everything on your internal network, and nothing external. This is because you are confident that your internal network devices are under your control, and know that you don't control anything external. Anything external is untrusted (this is not a word, but is commonly used)

Any interaction between the internal and external networks results in a decrease in trust of the internal network. Because even when browsing a webserver on the external network with something on the internal network you are exposing it - perhaps something malicious could take advantage of a vulnerability in your browser for example.

This type of risk is mitigated by careful control of outgoing connections. In a corporate setting you might use a proxy server for web traffic, one that can scan for malicious activity. For email you would use an internal relay. Both of these help avoid direct contact between trusted devices and untrusted devices.

When you are port forwarding, you are permitting direct access to your trusted devices from an untrusted source. This dramatically reduces the trust of this device, to the point that it should no longer be considered trustable: semi-trusted.

If this machine resides on your internal network, you now have trusted devices capable of interacting directly with a semi-trusted device and vice versa, and so decreasing their net trust.

To mitigate this, we put semi-trusted devices into their own network, and we carefully control the access between the semi-trusted network (known as a DMZ) and the internal network.

Ideally, this would be via the use of a firewall that does not permit connections to be instigated from the DMZ to the internal network. In many cases, this is not feasible, and some access must be permitted.

Access to the DMZ from the internal network should be similarly controlled, and kept to the bare minimum via firewall rules.

Answer 2

A best practice when publishing a web server over the Internet is to put this server into a DMZ. Then, all others servers stay in the MZ zone.

If you are not aware about what a DMZ is, here is a good stating point.

Here also a good link that shows warning about architecture it seems you have.

So, basically, yes you will need to setup two seperate networks. In case of a home network i won't ask you to implement two firewalls (External and Internal). You could be able to achieve the same thing with one home router/firewall (depending the model and specs). Basically, two networks, routed and filtered by the router/firewall. Note that some home router provide a DMZ setup.

how would I do this? depends on your network architecture and your router model.