Article View: alt.binaries.comp.virus
Article #4Re: Double firewall security.
From: Bent Mathiesen
Date: Fri, 20 Feb 2004 12:36
Date: Fri, 20 Feb 2004 12:36
43 lines
2993 bytes
2993 bytes
Sinatra Williams wrote:
> Hello:
>
> I'm curious, is there an advantage or disadvantage of using 2 firewalls on a
> broadband connections. The scenario is, I have a netgear firewall and I am
> thinking of diasy-chaining 2 firewalls together. Is that logical...What are
> the good points and bad points of doing this? Also, can you build a honeypot
> using 2 firewalls. I am teaching myself but trying to learn at the sametime.
>
> Any comments would be appreciated.
>
> Thanks,
>
In general there are advantages in using 2 or more firewalls when
shielding between networks (here home and internet).
Without going into to many details I will say:
1: Use 2 different products if possible.
2: Keep general policies on the outer firewall (here to www)
3: make the outher firewall a "bridged" firewall (No IP) if possible,
with a seperate management interface.
4: Use the inner firewall(s) for detailed policies down to host/ports.
Add to the above proxies, mail spam filters, etc - that can reside on
the host itself on between first and second firewall.
You will get multible layer security - and 1 wrong (logical ?)
configuration will not leave you totally exposed. The bridged firewall
can protect the 2 firewall very efficient.
Best regards
Bent Mathiesen
Security Specialist
CCSE GCIA MSCS
Technical Details
Message-ID:
<1077280580.948001@ftpgate>Path:
arc1-ca.pugleaf.net!archiver1.google.com!news2.google.com!news.maxwell.syr.edu!newsfeed.icl.net!proxad.net!134.158.69.22.MISMATCH!in2p3.fr!irazu.switch.ch!news-zh.switch.ch!switch.ch!newsfeed2-zh.ip-plus.net!not-for-mailReferences:
<e6cZb.5566$ya.2218929@news4.srv.hcvlny.cv.net>Show Full Headers
Complete Article Headers
X-Google-Language: ENGLISH,ASCII-7-bit X-Google-Thread: f922c,63ce2128248dce1c X-Google-Attributes: gidf922c,public X-Google-Thread: 112eba,63ce2128248dce1c X-Google-Attributes: gid112eba,public X-Google-Thread: 130228,63ce2128248dce1c X-Google-Attributes: gid130228,public X-Google-Thread: 111298,63ce2128248dce1c X-Google-Attributes: gid111298,public X-Google-ArrivalTime: 2004-02-20 04:36:22 PST Path: arc1-ca.pugleaf.net!archiver1.google.com!news2.google.com!news.maxwell.syr.edu!newsfeed.icl.net!proxad.net!134.158.69.22.MISMATCH!in2p3.fr!irazu.switch.ch!news-zh.switch.ch!switch.ch!newsfeed2-zh.ip-plus.net!not-for-mail From: Bent Mathiesen <bent@no.s.pa.mnet> Newsgroups: alt.binaries.comp.virus,alt.comp.anti-virus,comp.security.firewalls,info.firewalls Subject: Re: Double firewall security. Date: Fri, 20 Feb 2004 13:36:21 +0100 Organization: Swisscom AG - http://www.swisscom.com/ Lines: 44 Message-ID: <1077280580.948001@ftpgate> References: <e6cZb.5566$ya.2218929@news4.srv.hcvlny.cv.net> NNTP-Posting-Host: ftpgate.swisscom.com Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii; format=flowed Content-Transfer-Encoding: 7bit X-Trace: rex.ip-plus.net 1077280679 13703 138.190.13.11 (20 Feb 2004 12:37:59 GMT) X-Complaints-To: abuse@ip-plus.net NNTP-Posting-Date: Fri, 20 Feb 2004 12:37:59 +0000 (UTC) User-Agent: Mozilla/5.0 (Windows; U; WinNT4.0; en-US; rv:1.4) Gecko/20030624 Netscape/7.1 (ax) X-Accept-Language: en-us, en In-Reply-To: <e6cZb.5566$ya.2218929@news4.srv.hcvlny.cv.net> Cache-Post-Path: ftpgate!unknown@10.79.8.161 X-Cache: nntpcache 3.0.1 (see http://www.nntpcache.org/)