I may be doing this incorrectly, so if you have any suggestions, I'm open to it. So I installed a reverse proxy server on my LAN. It's not on the DMZ because it's coming from a blade running inside a virtual machine. Anyways, so I installed iptables and locked everything down from the outside coming in. Only port 80 is open from the outside. My question is, what if someone compromised the box in any way, I want to deny them access to our local lan. However, just thinking about this, if someone got in through SSH or something they could just disable iptables, no?

I was thinking of denying traffic from the proxy to our LAN but is that irrelevant? I still need my LAN to talk to the proxy server since our back-end webservers need to communicate w/ this proxy server.