Re: IP filtering -- MIDRANGE-L

Hi Steve -

I don't really want the front end system to do anything other than pass HTTP
traffic from an "Internet NIC" to an "internal NIC" - both on the front end
system.  Does this sound anywhere near "normal"?

Since the front-end system is going to be in a DMZ, there already is basic security filtering by the firewall/router that the front-end system is attached. If the front-end system does nothing more than pass all port 80 packets to the back-end system on the LAN, it is providing no additional security, and actually lessens the security of the LAN.

How would *you* do this?

I agree with the suggestion to put the website itself in the DMZ. To answer the question raised in another message: internal users can be given access to this machine without giving them access to the internet.

In this situation, the front-end machine talks to the back-end machine in a server-to-server connection that does not pass any of the HTTP traffic itself.

Ideally this should not be a direct connection. There are a couple of possiblities:

WAN--firewall--front-end-machine-in-DMZ
        |
        |------back-end-machine-in-LAN

WAN--firewall--front-end-machine-in-DMZ--firewall--back-end-machine-in-LAN

Either way, the front-end machine talks to the back-end machine through a firewall which is configured to pass only the expected type of traffic (DDM or whatever) and raises a major ruckus if the front-end machine is compromised and trys to initiate any unexpected traffic, either to the internet or the LAN.

Which configuration is used is dependent on the way the firewall(s) are hooked up now. There shouldn't be any need for new hardware, just new rules in a firewall to handle the traffic between the machines.

You can do proof-of-concept with both machines in the DMZ or both machines in the LAN, no problem. Obviously no firewall rules needed for this.

-- Ken http://www.ke9nr.net/ Opinions expressed are my own and do not necessarily represent the views of my employer or anyone in their right mind.

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.