Re: Internet Firewall with 3interfaces

From: Shane (shane_at_weasel.is-a-geek.net)
Date: 11/13/05

  • Next message: ERACC: "Re: A Look at Slackware Linux 10.2" 
    Date: Mon, 14 Nov 2005 07:24:18 +1300

    On Sun, 13 Nov 2005 18:01:45 +0100, Mathon Florent wrote:

    > Hello,
    >
    > I am trying to build an internet firewall with SuSe10 and Yast
    >
    > there are 3 interfaces on the PC and the following settings
    >
    > - eth0 External (internet) 192.168.2.3
    > - eth1 DMZ 192.168.4.1
    > - eth2 Internal 192.168.3.1
    >
    > I could reach Internet from DMZ and from Internal
    >
    > But My problem is to reach DMZ from internal and internal from DMZ! how to
    > do this ?
    >
    > Regards,
    >
    > Florent M

    Er.. The point of having a DMZ is to seperate computers that have
    anonymous access away from your Internal machines.
    IOW The DMZ machines are in a position to be compromised, and should be
    treated as so. Allowing traffic to pass freely from the DMZ to the
    Internal and back defeats the whole purpose of your network design and
    firewall configuration.
    </lecture>

    Assuming your firewall machine is running Iptables,

    iptables --table nat --append POSTROUTING --out-interface eth1 -j
    MASQUERADE iptables --append FORWARD --in-interface eth0 -j ACCEPT

    In effect you are turning your firewall into a router
    HTH 

    -- 
Hardware, n.: The parts of a computer system that can be kicked
The best way to get the right answer on usenet is to post the wrong one.
  • Next message: ERACC: "Re: A Look at Slackware Linux 10.2"

    Relevant Pages

    • Re: Remote telnet through firewall failing
      ... >> I have not found internet telnet to be the worst of the various security ... I was amazed that after months on the internet (directly to ... no firewall) there was no discernible problems. ... have over 250,000 BSD machines for their hosting services. ...
      (comp.unix.sco.misc)
    • Re: Forest Trust between Production & DMZ
      ... >> more vulnerable, external, then we are speaking of the trust ... If your DMZ gets whacked, ... To avoid the Swiss-cheese affect on the firewall, ... > Network segregation was a good thing at times when Internet Protocol was ...
      (microsoft.public.windows.server.security)
    • Re: WSS v2 Intranet and Extranet config with DMZ...
      ... We also have a DMZ AD with a one way trust. ... in each with a one-way trust setup so internal users can access the WSS ... We have a firewall between our WSS installation and the big bad Internet. ...
      (microsoft.public.sharepoint.windowsservices)
    • Re: Pro-active Security Software?
      ... > Ultimately, you will need to deal with iptables, which is not too hard. ... To further protect the interior Linux network machines, ... > authorised to connect to Internet hosts. ... the firewall to tighten it up, the more I can configure the internal ...
      (comp.os.linux.security)
    • RE: Whats wrong with this topology?
      ... it's better to have the DMZ ... complicates all the filtering rules on your firewall... ... Better is to have the DMZ physically apart from your LAN (with the firewall ... region system (hostile internet vs. not very secure internal lan) because ...
      (Security-Basics)