I'm a developer at a medium-sized company and I'm trying to make an internal web application available to employees using mobile devices outside the office. The main options we're considering are requiring users to connect through a VPN or publishing the frontend through a DMZ while keeping the backend and database protected inside the network.
With the DMZ design, the public-facing application or reverse proxy would be allowed to communicate only with the specific internal services and ports it needs. I'm concerned that a VPN could create usability problems for people who simply want to open the app quickly, but I also want to avoid exposing the internal network or creating an easy path to the database.
How would you approach this architecture? Is a tightly restricted DMZ and reverse-proxy setup reasonable, or would VPN access generally be safer and more appropriate?
4 Answers
I wouldn’t limit the decision to traditional VPN versus a classic DMZ. An identity-aware application proxy or zero-trust access service can keep the application private while granting authenticated users access only to that specific service. This avoids giving a phone broad network-level access and is often easier for users than manually starting a VPN.
The important question is whether users really need network access, or only access to one application. If it’s just one web app, application-level access is generally preferable to placing the device on the corporate network.
Both approaches can be secure, but for a frequently used mobile application I’d usually favor a public reverse proxy or application gateway in a separate network segment. Expose only HTTPS, restrict the gateway to the exact backend services and ports it needs, and make sure the database is never directly reachable from the public side.
Use strong authentication such as SSO and MFA, along with logging, rate limiting, patching, and preferably a WAF. Treat the public-facing component as if it could eventually be compromised, so its firewall rules should prevent access to the rest of the LAN. Have the design reviewed and tested before deployment.
A cloud-based application proxy or tunnel can be a practical option for a medium-sized company. It can provide authentication, MFA integration, logging, threat filtering, and access policies without requiring inbound exposure of the internal network. You should still isolate the backend and apply least-privilege firewall rules; outsourcing the edge does not remove the need to secure the application itself.
A VPN is still a sensible choice for administrators or a small group of trusted employees, especially when the application is highly sensitive. It’s conceptually straightforward, but it adds friction and a compromised device may gain more network reach than the user actually needs.
For a normal employee-facing app, a tightly controlled reverse proxy or application-access gateway is usually more convenient. Regardless of the choice, follow the company’s existing publishing pattern and make sure the setup is independently assessed before going live.
A DMZ and a VPN aren’t mutually exclusive. You can use a segmented public-facing tier for the application while reserving VPN access for administration or particularly sensitive functions.