Sharepoint 2013 Web server role placement

Question

We are in the process of deploying sharepoint 2013, and I have a question on deploying the web server roles.   Where should they be ideally placed, on the internal network or on the DMZ.
If they are placed on the DMZ, can the web server roles be on workgroups or do they have to be always on the domain.  Can you join a work group computer to sharepoint farm, I assumed it always had to be on the domain.
Majority of our sharepoint users will be internal, but we have external partners who we want to access the sites as well, thats why we are thinking DMZ.
Any advise on the above questions

Answer 1

Yes, that is correct. You need those ports.
The WFEs communicate with every other server in the farm, as well as your Active Directory, DNS, and SMTP servers. This includes all supporting infrastructure services such as LDAP, Kerberos (if you're using it), etc. I believe SMB is only if you are indexing
fileshares.
It does seem like quite a lot for a web server, however a SharePoint WFE is not just a web server.
Here is the list of ports:
TCP 80, TCP 443 (SSL)
Custom ports for search crawling, if configured (such as for crawling a file share or a website on a non-default port)
Ports used by the search index component — TCP 16500-16519 (intra-farm only)
Ports required for the AppFabric Caching Service — TCP 22233-22236
Ports required for Windows Communication Foundation communication — TCP 808
Ports required for communication between Web servers and service applications (the default is HTTP):
HTTP binding: TCP 32843
HTTPS binding: TCP 32844
net.tcp binding: TCP 32845 (only if a third party has implemented this option for a service application)
Ports required for synchronizing profiles between SharePoint 2013 and Active Directory Domain Services (AD DS) on the server that runs the Forefront Identity Management agent:
TCP 5725
TCP&UDP 389 (LDAP service)
TCP&UDP 88 (Kerberos)
TCP&UDP 53 (DNS)
UDP 464 (Kerberos Change Password)
For information about how to synchronize profiles with other directory stores, see User
Profile service hardening requirements, later in this article.
Default ports for SQL Server communication — TCP 1433, UDP 1434. If these ports are blocked on the SQL Server computer (recommended) and databases are installed on a named instance, configure a SQL Server client
alias for connecting to the named instance.
Microsoft SharePoint Foundation User Code Service (for sandbox solutions) — TCP 32846. This port must be open for outbound connections on all Web servers. This port must be open for inbound connections on Web servers
or application servers where this service is turned on.
Ensure that ports remain open for Web applications that are accessible to users.
Block external access to the port that is used for the Central Administration site.
SMTP for e-mail integration — TCP 25
Jason Warren
Infrastructure Architect
Habanero Consulting Group
habaneroconsulting.com/blog