{"id":370,"title":"DMZ\u2019de IIS + LAN\u2019da SQL Server","content":"

 <\/p>\n

DMZ’de IIS + LAN’da SQL Server<\/h1>\n

Do\u011fru Mimari, Güvenli Firewall Kurallar\u0131 ve Gerçek Sald\u0131r\u0131 Senaryolar\u0131<\/h2>\n

 <\/p>\n

\"Image\"<\/p>\n

 <\/p>\n

Kurumsal a\u011f tasar\u0131mlar\u0131nda en s\u0131k yap\u0131lan ve en tehlikeli hatalardan biri<\/strong>, web sunucusu ile veritaban\u0131n\u0131 yanl\u0131\u015f güvenlik bölgelerinde konumland\u0131rmakt\u0131r.
Özellikle \u015fu soru çok s\u0131k sorulur:<\/p>\n

\n

“DMZ’de IIS web sunucusu var, veritaban\u0131 LAN taraf\u0131nda olabilir mi?”<\/em><\/p>\n<\/blockquote>\n

Cevap:
Evet, olabilir. Ama sadece belirli ve kat\u0131 \u015fartlar sa\u011flan\u0131yorsa.<\/strong>
Aksi hâlde DMZ kavram\u0131 tamamen anlam\u0131n\u0131 yitirir.<\/p>\n

Bu yaz\u0131da, kurumsal güvenlik dünyas\u0131nda kabul edilen tek do\u011fru yakla\u015f\u0131m\u0131<\/strong>, firewall kural setleri ve gerçek sald\u0131r\u0131 senaryolar\u0131yla birlikte ele al\u0131yoruz.<\/p>\n

\n

Senaryo Netle\u015ftirme<\/h2>\n

Bu yaz\u0131 boyunca a\u015fa\u011f\u0131daki referans mimari kullan\u0131lm\u0131\u015ft\u0131r:<\/p>\n

DMZ<\/strong><\/p>\n

    \n
  • \n

    IIS Web Server → 10.10.10.2<\/code><\/p>\n<\/li>\n<\/ul>\n

    LAN (Server \/ Management VLAN)<\/strong><\/p>\n

      \n
    • \n

      SQL Server → 192.168.40.10<\/code> (VLAN40 önerilir)<\/p>\n<\/li>\n<\/ul>\n

      \n

      \u2757 Veritaban\u0131 ASLA DMZ’de konumland\u0131r\u0131lmaz<\/strong>
      \u2714\ufe0f Do\u011fru karar: Veritaban\u0131 LAN taraf\u0131nda, sunucuya özel bir VLAN’da olmal\u0131d\u0131r.<\/p>\n<\/blockquote>\n

      \n

      Alt\u0131n Kural (Ezberlenmeli)<\/h2>\n
      \n

      DMZ → LAN trafi\u011fi varsay\u0131lan olarak kapal\u0131d\u0131r<\/strong>
      Ancak<\/strong>
      DMZ → LAN sadece: Tek IP + Tek Sunucu + Tek Port \u015feklinde aç\u0131labilir<\/strong><\/p>\n<\/blockquote>\n

      Bu kural bozuldu\u011fu anda:<\/p>\n

        \n
      • \n

        DMZ izolasyonu çöker<\/p>\n<\/li>\n

      • \n

        Yatay hareket (lateral movement) mümkün hâle gelir<\/p>\n<\/li>\n

      • \n

        Web sald\u0131r\u0131s\u0131, tüm iç a\u011fa yay\u0131labilir<\/p>\n<\/li>\n<\/ul>\n

        \n

        Do\u011fru Mimari (Production Standard\u0131)<\/h2>\n
        Internet\n   |\nFirewall\n   |\nDMZ\n[IIS Web Server]\n   |\n(Firewall üzerinde kontrollü TEK kural)\n   |\nLAN (Server VLAN)\n[SQL Server]\n<\/code><\/pre>\n
        Bu yap\u0131; bankalar, ISP’ler ve kamu a\u011flar\u0131nda kullan\u0131lan standart DMZ yakla\u015f\u0131m\u0131d\u0131r<\/strong>.<\/p>\n
        \n
        Veritaban\u0131 Hangi VLAN’da Olmal\u0131?<\/h2>\n
        Yanl\u0131\u015f Yakla\u015f\u0131m<\/h3>\n
          \n
        • \n
          Kullan\u0131c\u0131 VLAN’lar\u0131 (VLAN10 \/ VLAN20 \/ VLAN30)<\/p>\n<\/li>\n<\/ul>\n
          Do\u011fru Yakla\u015f\u0131m<\/h3>\n
            \n
          • \n
            VLAN40 – Management \/ Server VLAN<\/strong><\/p>\n<\/li>\n<\/ul>\n
            Örnek:<\/strong><\/p>\n
            DB Server IP : 192.168.40.10\nVLAN        : 40\n<\/code><\/pre>\n
            Bu VLAN’da:<\/p>\n
              \n
            • \n
              Kullan\u0131c\u0131 PC bulunmaz<\/p>\n<\/li>\n
            • \n
              Sadece sunucu ve yönetim sistemleri yer al\u0131r<\/p>\n<\/li>\n<\/ul>\n
              \n
              En Kritik Nokta: Firewall Kural\u0131<\/h2>\n
              DMZ ile LAN aras\u0131nda sadece tek bir izin kural\u0131<\/strong> bulunur.<\/p>\n
              IIS → SQL Firewall Kural\u0131<\/h3>\n
              Source Zone      : DMZ\nSource IP        : 10.10.10.2        (IIS Server)\nDestination Zone : VLAN40\nDestination IP  : 192.168.40.10      (SQL Server)\nService          : MSSQL (TCP 1433)  (veya MySQL 3306)\nAction           : Allow\nLog              : Enabled\nIPS              : Enabled\n<\/code><\/pre>\n
              Dikkat Edilmesi Gerekenler<\/h3>\n
                \n
              • \n
                DMZ → LAN ANY olmaz<\/p>\n<\/li>\n
              • \n
                DMZ → VLAN10\/20\/30 olmaz<\/p>\n<\/li>\n
              • \n
                DMZ → Subnet bazl\u0131 izin verilmez<\/p>\n<\/li>\n
              • \n
                \u2714\ufe0f Sadece IP → IP → Port<\/strong><\/p>\n<\/li>\n<\/ul>\n
                \n
                Veritaban\u0131 Sunucusu Üzerinde Ek Güvenlik<\/h2>\n
                Firewall kural\u0131 tek ba\u015f\u0131na yeterli de\u011fildir<\/strong>.
                Sunucu üzerinde de ikinci bir güvenlik katman\u0131 olmal\u0131d\u0131r.<\/p>\n
                Windows Firewall (SQL Server)<\/h3>\n
                ALLOW TCP 1433 FROM 10.10.10.2\nDENY  ALL FROM ANY\n<\/code><\/pre>\n
                \n
                \ud83d\udd10 Firewall + OS Firewall = Çift kilit<\/strong><\/p>\n<\/blockquote>\n
                \n
                Kimlik Do\u011frulama: En S\u0131k Yap\u0131lan Hata<\/h2>\n
                Yanl\u0131\u015f<\/h3>\n
                  \n
                • \n
                  sa<\/code> \/ root<\/code> kullan\u0131c\u0131lar\u0131<\/p>\n<\/li>\n
                • \n
                  Full permission DB user<\/p>\n<\/li>\n<\/ul>\n
                  Do\u011fru<\/h3>\n
                    \n
                  • \n
                    Sadece ilgili veritaban\u0131<\/p>\n<\/li>\n
                  • \n
                    Yetkiler:<\/p>\n
                      \n
                    • \n
                      SELECT<\/p>\n<\/li>\n
                    • \n
                      INSERT<\/p>\n<\/li>\n
                    • \n
                      UPDATE<\/p>\n<\/li>\n<\/ul>\n<\/li>\n
                    • \n
                      DROP \/ ALTER yok<\/p>\n<\/li>\n<\/ul>\n
                      Bu sayede web uygulamas\u0131 ele geçirilse bile zarar s\u0131n\u0131rl\u0131 kal\u0131r.<\/p>\n
                      \n
                      IIS Taraf\u0131nda Güvenlik Önlemleri<\/h2>\n
                      Connection String<\/strong><\/p>\n
                        \n
                      • \n
                        \u015eifreli tutulmal\u0131<\/p>\n<\/li>\n
                      • \n
                        Web root d\u0131\u015f\u0131nda saklanmal\u0131<\/p>\n<\/li>\n
                      • \n
                        Mümkünse environment variable kullan\u0131lmal\u0131<\/p>\n<\/li>\n<\/ul>\n
                        Ek Önlemler<\/strong><\/p>\n
                          \n
                        • \n
                          Connection pool limitli<\/p>\n<\/li>\n
                        • \n
                          Timeout de\u011ferleri k\u0131sa<\/p>\n<\/li>\n
                        • \n
                          Parametreli sorgular \/ ORM kullan\u0131m\u0131<\/p>\n<\/li>\n
                        • \n
                          SQL Injection korumas\u0131<\/p>\n<\/li>\n<\/ul>\n
                          \n
                          DMZ → LAN Ba\u011flant\u0131 Testi<\/h2>\n
                          IIS sunucusundan:<\/p>\n
                          telnet 192.168.40.10 1433\n<\/code><\/pre>\n
                          Firewall log’unda:<\/p>\n
                          ALLOW DMZ(10.10.10.2) → VLAN40(192.168.40.10) TCP 1433\n<\/code><\/pre>\n
                          Bunun d\u0131\u015f\u0131nda tek bir port<\/strong> görürseniz:<\/p>\n
                          \n
                          \u26a0\ufe0f Yanl\u0131\u015f yap\u0131land\u0131rma vard\u0131r.<\/p>\n<\/blockquote>\n
                          \n
                          Firewall Rule Set (Özet)<\/h2>\n
                          WAN → DMZ<\/strong><\/p>\n
                            \n
                          • \n
                            HTTPS (443) → IIS<\/p>\n<\/li>\n<\/ul>\n
                            DMZ → VLAN40<\/strong><\/p>\n
                              \n
                            • \n
                              Sadece IIS → SQL (TCP 1433)<\/p>\n<\/li>\n<\/ul>\n
                              VLAN40 → DMZ<\/strong><\/p>\n
                                \n
                              • \n
                                Sadece yönetim (RDP \/ SSH)<\/p>\n<\/li>\n<\/ul>\n
                                DMZ → LAN \/ User VLAN<\/strong><\/p>\n
                                  \n
                                • \n
                                  Tamamen kapal\u0131<\/p>\n<\/li>\n<\/ul>\n
                                  En altta<\/strong><\/p>\n
                                    \n
                                  • \n
                                    Default deny (log aç\u0131k)<\/p>\n<\/li>\n<\/ul>\n
                                    \n
                                    Reverse Proxy + SSL Offload ile Bir Üst Seviye<\/h2>\n
                                    Daha geli\u015fmi\u015f yap\u0131larda, IIS’in önüne Reverse Proxy<\/strong> eklenir.<\/p>\n
                                    \"Image\"<\/p>\n
                                    DMZ<\/strong><\/p>\n
                                      \n
                                    • \n
                                      Reverse Proxy (Nginx) → 10.10.10.10<\/code><\/p>\n<\/li>\n
                                    • \n
                                      IIS Web Server → 10.10.10.2<\/code><\/p>\n<\/li>\n<\/ul>\n
                                      Ak\u0131\u015f<\/strong><\/p>\n
                                      Internet → Reverse Proxy (HTTPS)\nReverse Proxy → IIS (HTTP – internal)\nIIS → SQL (TCP 1433)\n<\/code><\/pre>\n
                                      SSL Offload Neden Önemli?<\/h3>\n
                                        \n
                                      • \n
                                        Sertifika tek noktada<\/p>\n<\/li>\n
                                      • \n
                                        TLS aç\u0131klar\u0131 merkezi yönetilir<\/p>\n<\/li>\n
                                      • \n
                                        WAF \/ rate-limit \/ header kontrolü<\/p>\n<\/li>\n
                                      • \n
                                        Daha temiz ve anlaml\u0131 loglar<\/p>\n<\/li>\n
                                      • \n
                                        Performans art\u0131\u015f\u0131<\/p>\n<\/li>\n<\/ul>\n
                                        \n
                                        Gerçekçi Sald\u0131r\u0131 Senaryolar\u0131<\/h2>\n
                                        SQL Injection Denemesi<\/h3>\n
                                        GET \/login.aspx?user=admin' OR 1=1--\n<\/code><\/pre>\n
                                        Reverse Proxy Log<\/strong><\/p>\n
                                        ACTION=BLOCK\nREASON=SQL_INJECTION_PATTERN\n<\/code><\/pre>\n
                                        IIS ve SQL’e ula\u015famaz<\/p>\n
                                        \n
                                        Directory Traversal<\/h3>\n
                                        GET \/..\/..\/windows\/system32\/cmd.exe\n<\/code><\/pre>\n
                                        Sonuç<\/strong><\/p>\n
                                          \n
                                        • \n
                                          Reverse proxy taraf\u0131ndan bloklan\u0131r<\/p>\n<\/li>\n<\/ul>\n
                                          \n
                                          Brute Force Login<\/h3>\n
                                            \n
                                          • \n
                                            Rate-limit devreye girer<\/p>\n<\/li>\n
                                          • \n
                                            Firewall IPS ba\u011flant\u0131y\u0131 keser<\/p>\n<\/li>\n<\/ul>\n
                                            \n
                                            IIS Ele Geçirilirse Ne Olur?<\/h3>\n
                                              \n
                                            • \n
                                              SQL’e sadece uygulama yetkisiyle eri\u015filir<\/p>\n<\/li>\n
                                            • \n
                                              User VLAN’lara geçi\u015f yap\u0131lamaz<\/p>\n<\/li>\n
                                            • \n
                                              Domain ele geçirilemez<\/p>\n<\/li>\n<\/ul>\n
                                              Zarar uygulama + DB tablosu seviyesinde kal\u0131r<\/strong><\/p>\n
                                              \n
                                              Asla Yap\u0131lmamas\u0131 Gerekenler<\/h2>\n
                                                \n
                                              • \n
                                                DB’yi DMZ’ye koymak<\/p>\n<\/li>\n
                                              • \n
                                                DMZ → LAN ANY kural\u0131 açmak<\/p>\n<\/li>\n
                                              • \n
                                                DB’yi kullan\u0131c\u0131 VLAN’\u0131na koymak<\/p>\n<\/li>\n
                                              • \n
                                                sa<\/code> \/ root<\/code> kullanmak<\/p>\n<\/li>\n
                                              • \n
                                                Management VLAN’a kullan\u0131c\u0131 PC almak<\/p>\n<\/li>\n<\/ul>\n
                                                \n
                                                Sonuç<\/h2>\n
                                                DMZ’de IIS olabilir.
                                                Veritaban\u0131 LAN’da olmal\u0131d\u0131r.
                                                Arada tek yönlü, tek IP, tek port, loglanan<\/strong> bir firewall kural\u0131 bulunur.<\/p>\n
                                                Bu yakla\u015f\u0131m:<\/p>\n
                                                  \n
                                                • \n
                                                  Gerçek DMZ izolasyonu sa\u011flar<\/p>\n<\/li>\n
                                                • \n
                                                  Sald\u0131r\u0131 yüzeyini ciddi biçimde daralt\u0131r<\/p>\n<\/li>\n
                                                • \n
                                                  Kurumsal a\u011flarda y\u0131llard\u0131r kullan\u0131lan kan\u0131tlanm\u0131\u015f bir standartt\u0131r<\/strong><\/p>\n<\/li>\n<\/ul>\n
                                                  \n
                                                  Reverse Proxy sald\u0131r\u0131y\u0131 görür,
                                                  Firewall s\u0131n\u0131rlar,
                                                  DMZ hapseder,
                                                  LAN korur.<\/strong><\/p>\n<\/blockquote>","excerpt":"DMZ\u2019de IIS + LAN\u2019da SQL Server\nDo\u011fru Mimari, G\u00fcvenli Firewall Kurallar\u0131 ve Ger\u00e7ek Sald\u0131r\u0131 Senaryolar\u0131","created_at":"2025-12-21 14:41:46","updated_at":"2026-09-23 16:33:18","category_id":7,"view_count":592,"reading_time":5,"status":"published","editor_choice":0,"is_editor_choice":0,"published_at":"2025-12-21 11:41:46","featured_image":"\/uploads\/images\/2025\/12\/6947dce9bb40d_1766317289.png","slug":"dmz-de-iis-lan-da-sql-server","category_name":"Cyber Security","category_slug":"cyber-security","category_color":"#10b981"}