Port Forwarding and Open Ports

Hi Guys,

I am currently responsible for a small network at my local hospital radio service and I have a networking issue that I would like to sanity check.

We have three "servers" that perform various functions. The domain server is running Server 2008 and the other two are running windows 7 and XP. we have a couple of services including FTP and Web server running which require port forwarding to be set up on our ADSL Router. My issue is that this means I have some ports that are left open which as I understand it poses a security threat. The domain server does not have a software Firewall running as it interferes with some client server software that uses SQL server express. Im assuming that you cant close these ports as the purpose of port forwarding is to allow an external device to initiate a connection. Therefore my thoughts are to create a DMZ and deploy a server into the DMZ and configure all software that requires port forwarding on the server in the DMZ. As I understand it this would mean that the server in the DMZ could be open to attack but those PCs behind the NAT would be safe.

Are my assumptions correct?

 

Yes. Generally. that is the purpose of a DMZ.