Our OS X Server serves our company DNS, web and mail with an external IP address to the Internet.
It currently does not have a local address on the LAN and thus cannot be used e.g. for software update caches for OS X and IOS devices on the network.
If I were to also attach the server to the LAN by one of its other ports would I be compromising its security or the security of the LAN?
I am more concerned about opening up a security hole from the WAN into the LAN than vice versa as I can control which users have access to which services on the Server.
OS X Server has its adaptive firewall enabled and the router via which it connects to the WAN has only those ports open that we need for the services it serves.
Best Answer
Nothing much will change in regards to WAN exposure, as long as you're not configuring the server to proxy or route any traffic. Services intended for the LAN only should be configured to only run on the appropriate interface, regardless of whether there's a firewall in place.
There is an increased risk if one of the externally facing services is compromised, potentially allowing access to resources on the LAN. If you want to be really careful you can set up the firewall on the Mac to not allow traffic out the LAN interface unless it originated on the Mac...