🚀 go-pugleaf

In comp.os.linux.networking Mohamad Termizi <mizi1998@tm.net.my> wrote:
> eth0: a.b.c.66/30 attached to a ADSL router at a.b.c.65/30
> eth1: x.y.0.1/24 local IP addresses (LAN) - with FTP/Web/Mail servers
> eth2: x.y.1.1/24 DMZ

> 1. Can this DMZ actually works? If yes, appreciate a email sample of
> firewall script.

a DMZ is supposed to contain your public accessable servers, otherwise you
do not need it.

> 2. Should someone having problem if he/she FTP'ing from the Net? From LAN?

If you set up up wrong, it might eighter be insecure or not work. Chances
that you get it right are low (judging from your questions)

Greetings
Bernd

Mohamad Termizi wrote:

> Hi ALL,
>
> I am setting a DMZ firewall with the following setup.
>
> eth0: a.b.c.66/30 attached to a ADSL router at a.b.c.65/30
> eth1: x.y.0.1/24 local IP addresses (LAN) - with FTP/Web/Mail servers
> eth2: x.y.1.1/24 DMZ
>
> Questions:
>
> 1. Can this DMZ actually works? If yes, appreciate a email sample of
> firewall script.
>
> 2. Should someone having problem if he/she FTP'ing from the Net? From LAN?
>
> TIA.
>
> ...termizi

Depends upon what x & y are.  We have a similar DMZ setup, except that the
DMZ is part of the address block we got from our ISP so that it is accessible
from both the Internet and the private LAN.  Our "public" Mail, Web, and FTP
servers are located on the DMZ so that they can be accessed from either the
LAN or the Internet. Our LAN is private and uses local IP addresses to
facilitate not being visible from the outside. Through the magic of IP masq,
machines on our private LAN can search the web and access outside machines,
but nobody can "see" those machines.

Feel free to contact me for more information.

John

----- Original Message -----
From: "Mohamad Termizi" <mizi1998@tm.net.my>
Newsgroups:
alt.comp.malaysia,aus.computers.linux,comp.os.linux.hardware,comp.os.linux.m
isc,comp.os.linux.networking,comp.os.linux.setup,de.comp.os.linux.networking
,jaring.os.linux
Sent: Wednesday, November 28, 2001 7:07 PM
Subject: Setting a DMZ firewall


> Hi ALL,
>
> I am setting a DMZ firewall with the following setup.
>
> eth0: a.b.c.66/30 attached to a ADSL router at a.b.c.65/30
> eth1: x.y.0.1/24 local IP addresses (LAN) - with FTP/Web/Mail servers
> eth2: x.y.1.1/24 DMZ
>
> Questions:
>
> 1. Can this DMZ actually works? If yes, appreciate a email sample of
> firewall script.

Yes it may , but  not reliable.

> 2. Should someone having problem if he/she FTP'ing from the Net? From LAN?
>
> TIA.

Yes, it u using  NAT , the FTP data port need to rewrite to send back to the
correct src add
It may take time for you to get this firewall to work in dmz enviroment.

In article <3c05a7bf_1@news.tm.net.my>,
Mohamad Termizi <mizi1998@tm.net.my> wrote:

| I am setting a DMZ firewall with the following setup.
| 
| eth0: a.b.c.66/30 attached to a ADSL router at a.b.c.65/30
| eth1: x.y.0.1/24 local IP addresses (LAN) - with FTP/Web/Mail servers
| eth2: x.y.1.1/24 DMZ
| 
| Questions:
| 
| 1. Can this DMZ actually works? If yes, appreciate a email sample of
| firewall script.

No, you have missed the purpose of a DMZ. It is a block of addresses
and/or machines which can be accessed from the internal or external
network, allowing the external net to be totally isolated from the
internal. So the servers go in the DMZ, not user machines or anything
you care about hiding.

| 2. Should someone having problem if he/she FTP'ing from the Net? From LAN?

Not is you have your iptables set up right. You don't want to use
ipchains, it doesn't have connection tracking to make things work
"right" for a firewall.

There are many things needed to setup a DMZ properly, I really don't
have the time to do even an overview. Just don't let any host on the
external NIC open a socket to anything on the internal NIC, set the
forwarding policy to "don't" and open holes between the external NIC to
the DMZ and the LAN to everywhere.
-- 
bill davidsen <davidsen@tmr.com>
  His first management concern is not solving the problem, but covering
his ass. If he lived in the middle ages he'd wear his codpiece backward.