sonyfreek |
You can design your DMZ any way that you want it, but there are two generally practiced methods. The first is to have a firewall with three interfaces in it: Outside, Inside, and DMZ. The DMZ interface is not trusted by the internal network and all of your “expendable” servers and services should go there: ie the external DNS, Web Server, Mail Relay, IDS, etc. The internal network would be configured to allow port the email relay server through, but generally should not trust any connections from the DMZ into the internal network with that exception. Obviously, the external network shouldn’t be trusted at all and only necessary services should be allowed to access the Internet/outside from your internal hosts and DMZ services.
The second most popular DMZ setup is called “Barrier Reef.” With it, you configure two different firewalls (with different operating systems and firewall software) and install the DMZ between the two firewalls. Let’s call the one firewall the outside firewall and the other the inside firewall. The outside firewall has connections to the Internet and the DMZ. The Inside firewall has connections to the DMZ and the Internal network. In this case, the same rules are established as with a three interface firewall but you are “more protected” because if someone is capable of owning the one firewall, they may not have the expertise to crack the second one. Also, the ruleset on the second firewall should be more strict and selective of what it lets through.
Now, for the configuration of iptables… I suggest you use one of the front-ends to iptables to get you used to configuring rules. Later on, you may decide to take on the iptables ruleset directly if you are into that type of thing. I’ve used Shorewall before with a lot of success, but watch out with using a GUI on a production firewall. The easier it is for you to use, the easier it is for someone to hack it.
For setting up a three interface firewall, see <a href="http://www.shorewall.net/three-interface.htm." rel="nofollow">http://www.shorewall.net/three-interface.htm.</a>
SF
zottmann |
Hi !!
Sonny gave an excelent explanation about how to set up a DMZ !!
As for a GUI frontend for iptables, I suggest you try Firewall Builder. It is really ease to use, and even has some wizards that helps you on building your initial set of rules.
Regards,
Carlos.
astronomer |
Shortly after iptables came out, new riders published a book called: linux firewalls second edition. This book covers iptables in some depth and shows how to set up the standard architectures.
I have used this as a reference for three years now. It should have everything you need to know to set up the firewall section of your network.
If you have a specific question, let me know.
rt
Security management, Product/service procurement, Security products, Security, Management, Administration, Architecture/Design, Features/Functionality, Installation, Signature updating/Management, Network security, Firewalls, VPN, Intrusion management, Incident response, Forensics, Wireless
Hi,
0
