Security – If you need to open ports from DMZ to LAN, at what point is the separation no longer worth it

Your question isn't totally clear but I'll do my best...

One thing to remember is that any program can use any port it likes. That's how spyware and malware manage to thrive in some environments... by using common, well known ports and pretend to be something else.

A less malicious example would be the Skype program which will try to find a port to use but will ultimately use ports 80 (HTTP/web port) and 443 (SSL port) if it has to.

With that in mind... you should do a scan of the PC(s) in question using a program like nmap or nessus, etc... (there's A LOT of them out there) to find out what ports are open and then decide how you want to set up your firewall.

Here is a link to common port assignments to give you a starting point for what MIGHT be running on that port:

http://technet.microsoft.com/en-us/library/cc959833.aspx

For example, port 53 is commonly used for DNS. If you don't have any need for DNS or you don't have a DNS server running on that machine, you can block it.

Along that same line, you should make sure your server isn't running services it doesn't need to. If you see port 53 open on your server and you have a DNS server (you're not using) running turn it OFF. ;-)

Hope this helps.

Proper network security states that DMZ servers shouldn't have any access into the 'Trusted' network. The Trusted network can get to the DMZ, but not the other way around. For DB backed web-servers like yours this can be a problem, which is why database servers end up in DMZs. Just because it is in a DMZ doesn't mean it HAS to have public access, your external firewall can still prevent all access to it. However, the DB server itself doesn't have access to inside the network.

For MSSQL servers, you probably need a 2nd DMZ due to the need to talk to AD DC's as part of its normal functioning (unless you're using SQL accounts rather than domain-integrated, at which point this is moot). That second DMZ would be home to Windows servers that need public access of some kind, even if it is proxied through a web-server first. Network Security people get squinty when they consider domained machines experiencing public access getting access to DCs, which can be a hard sell. However, Microsoft doesn't leave much choice in this matter.