Re: IP filtering

[Ken Sims <mr3111@xxxxxxxxx>]

Hi Steve -

> I don't really want the front end system to do anything other than pass HTTP
> traffic from an "Internet NIC" to an "internal NIC" - both on the front end
> system.  Does this sound anywhere near "normal"?

Since the front-end system is going to be in a DMZ, there already is basic 
security filtering by the firewall/router that the front-end system is 
attached.  If the front-end system does nothing more than pass all port 80 
packets to the back-end system on the LAN, it is providing no additional 
security, and actually lessens the security of the LAN.

> How would *you* do this?

I agree with the suggestion to put the website itself in the DMZ.  To 
answer the question raised in another message: internal users can be given 
access to this machine without giving them access to the internet.

In this situation, the front-end machine talks to the back-end machine in a 
server-to-server connection that does not pass any of the HTTP traffic itself.

Ideally this should not be a direct connection.  There are a couple of 
possiblities:

WAN--firewall--front-end-machine-in-DMZ
        |
        |------back-end-machine-in-LAN

WAN--firewall--front-end-machine-in-DMZ--firewall--back-end-machine-in-LAN

Either way, the front-end machine talks to the back-end machine through a 
firewall which is configured to pass only the expected type of traffic (DDM 
or whatever) and raises a major ruckus if the front-end machine is 
compromised and trys to initiate any unexpected traffic, either to the 
internet or the LAN.

Which configuration is used is dependent on the way the firewall(s) are 
hooked up now.  There shouldn't be any need for new hardware, just new 
rules in a firewall to handle the traffic between the machines.

You can do proof-of-concept with both machines in the DMZ or both machines 
in the LAN, no problem.  Obviously no firewall rules needed for this.

--
Ken
http://www.ke9nr.net/
Opinions expressed are my own and do not necessarily represent the views of 
my employer or anyone in their right mind.