Re: 2 wan + 2 fire + 1 mdz

From: Rodolfo Alcazar (rodolfo.alcazar_at_padep.org.bo)
Date: 10/18/05

  • Next message: Wolfgang Qual: "Wacom Graphire 3 (usb) under Debian Sarge" 
    To: ns007532 <ns007532@bragatel.pt>
Date: Tue, 18 Oct 2005 13:51:42 -0400

    On Tue, 2005-10-18 at 13:07 +0100, ns007532 wrote:
    > Hi
    > I recently upgrade my system with one more wan connection, connect to a
    > new firewall(Debian + iptables + snort + portsentry and bind9, etc.). I
    > only have one dmz box.

    Sorry, what is a DMZ box? As far as I know, DMZ stands for
    "DeMilitarized Zone", and that is not a box, it is a LAN area delimited
    with a firewall with certain security policies.

    > I have 2 nics (eth0 and eth1)on dmz 10.196.3.2 and 10.196.4.2, in the
    > firewall1 10.196.3.1 and in firewall2 10.196.4.1.
    > The problem is the default gateway on eth0 on dmz 10.196.3.2 who is
    > 10.196.3.1, so a connection from wan2 62.123.x.x in firewall2 gets to
    > dmz, but the response is from the gateway and go back as martian source
    > to firewall1!

    Well, Ive drawn your configuration, and I suppose you have this config:

    internet(isp1) --- fw1 --- |eth1 |
                               |so-called-DMZ-box| --- eth2 to lan
    internet(isp2) --- fw2 --- |eth0 |

    You could have done this with just one box:

    internet(isp1) --- |eth1 |
                       | FIREWALL | --- eth2 to lan
    internet(isp2) --- |eth0 |
                       | | --- eth3 to DMZ

    > How can i resolve this?

    If I did understood ok, your problem is obvious. You have only one gateway definition. You must add this iproute definitions and delete the former:

    root # ip route 62.123.x.x/16 via 10.196.4.1 dev eth1
    root # ip route your.other.wan.gateway via 10.196.3.1 dev eth0

    Now, go to google and read "Load Balancing with Linux", to get the most
    from your both connections.

    Why do you have this expensive configuration? I have a 2-ISP
    load-balancing setup, with a DMZ in just one box: eth0 to ISP1, eth1 to
    ISP2, eth2 to DMZ and eth3 to lan. This box manages firewalling,
    balancing, routing and DNS, kinda your config. Dont you think this is
    simpler and cheaper? Why all that expensive stuff? Cant understand!
    Could you explain a little more? 

    --
Rodolfo Alcazar - rodolfo.alcazar@padep.org.bo
Netzmanager Padep, GTZ
591-70656800, -22417628, LA PAZ, BOLIVIA
http://otbits.blogspot.com
--
When all else fails, read the instructions.
-- 
To UNSUBSCRIBE, email to debian-user-REQUEST@lists.debian.org 
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org
  • Next message: Wolfgang Qual: "Wacom Graphire 3 (usb) under Debian Sarge"

    Relevant Pages

    • Re: Firewall recommendations?
      ... > that changes the configuration in an important way, ... I don't know were your going to get that in any firewall appliance, ... Because it's for the optional network I suspect, not just a DMZ, you can ...
      (comp.security.firewalls)
    • Re: general question on design options
      ... I'm running the configuration that you are considering. ... Behind that I have my ISA, ... How do you get the VPN connections that terminate on the Cisco to get past ... DMZ and not the LAN. ...
      (microsoft.public.isa)
    • OWA 2003 in DMZ?
      ... I've been reading articles out there stating that putting a Front End server ... in a DMZ in not a good idea, both for security and configuration reasons. ... should we just put it behind our firewall? ...
      (microsoft.public.exchange.admin)
    • Re: Firewall recommendations?
      ... > than any other real firewall. ... What I mean is that in order to see all of the configuration, ... differrent tabs, etc. ... Why don't they call DMZ just "DMZ"? ...
      (comp.security.firewalls)
    • Re: Installing ISA Server in Trihomed DMZ firewall
      ... some understanding regarding configuration of the ISA & firewall, ... Please help me by providing information that how I will configure ISA ... configure ISA sever in DMZ as web proxy server only, ...
      (microsoft.public.isa)