3CX Behind LAN versus DMZ w/SBC?

[oguruma1218]

I'm kind of reticent to port forward ports directly behind my firewall into my LAN....

Is there any real downside to running 3CX in a DMZ (I would just give it its own NIC and entire network on my router) and then having an SBC behind the LAN?

Is that notably more secure?

 

[leejor]

I'm kind of reticent to port forward ports directly behind my firewall into my LAN....

Why? You port forward to the IP of the 3CX Server, rather than exposing all to the internet. You don't have to involve an SBC. This is how it is normally done on a local installation, with a few exceptions, of course.

 

[oguruma1218]

If you port forward to a device behind your LAN, and that device becomes compromised (since it's exposed to the rest of the world), now you have a compromised device behind your LAN.

The same reason people put web servers and mail servers in a DMZ, no?

 

[leejor]

There have been several discussions on this topic before...

https://www.3cx.com/community/threads/server-network-security-best-practices.64697/

Obviously, as long as it works, you can set up your network, the way you feel is best.