Our editors posted a question on ITKnowledge Exchange to help out "Ruhi" plan for a demilitarized zone (DMZ) using iptables, and fellow techies jumped in to help out, providing excellent advice for DMZ design. You can also read this thread (and send a message to ITKnowledge Exchange members) on ITKnowledge Exchange.
Want to join in on a similar conversation? Register for ITKnowledge Exchange and fill out your profile so you can ask specific sets of people your IT questions and help out your fellow geeks. Anyone can read answers already provided to questions, but only registered ITKnowledge Exchange members can ask questions or add to threads.
TechTarget member "Ruhi" asked:
I have to plan and design a demilitarized zone using iptables. How can I do this?
|
A few basics
You can certainly use iptables to build a basic firewall architecture. Part of that structure would be the DMZ area. Another approach you could take is to use the iptables as server firewall, and block selected services.
You would need a routing functionality also, for which you could use any Linux-based routing daemon or a more mature router such as one from Cisco.
-- Dargandk
Any way you want it, that's the way you get it
You can design your DMZ any way you want it, but there are two generally practiced methods.
The first is to have a firewall with three interfaces in it: Outside, inside and DMZ. The DMZ interface is not trusted by the internal network and all of your "expendable" servers and services should go there -- i.e. the external DNS, Web server, mail relay, IDS, etc. The internal network would be configured to allow porting the e-mail relay server through, but generally should not trust any connections from the DMZ into the internal network with that exception. Obviously, the external network shouldn't be trusted at all and only necessary services should be allowed to access the Internet/outside from your internal hosts and DMZ services.
The second, most popular DMZ setup is called "Barrier Reef." With it, you configure two different firewalls (with different operating systems and firewall software) and install the DMZ between the two firewalls. Let's call the one firewall the outside firewall and the other the inside firewall. The outside firewall has connections to the Internet and the DMZ. The Inside firewall has connections to the DMZ and the Internal network. In this case, the same rules are established as with a three-interface firewall but you are "more protected" because if someone is capable of owning the one firewall, they may not have the expertise to crack the second one. Also, the ruleset on the second firewall should be more strict and selective of what it lets through.
Now, for the configuration of iptables... I suggest you use one of the front-ends to iptables to get you used to configuring rules. Later on, you may decide to take on the iptables ruleset directly if you are into that type of thing. I've used Shorewall before with a lot of success, but watch out with using a GUI on a production firewall. The easier it is for you to use, the easier it is for someone to hack it.
For setting up a three interface firewall, see http://www.shorewall.net/three-interface.htm.
-- Sonyfreek
A wizardly GUI
Sonyfreek gave an excellent explanation about how to set up a DMZ!
As for a GUI front end for iptables, I suggest you try Firewall Builder. It is really ease to use, and even has some wizards that helps you on building your initial set of rules.
-- Zottman
A good reference book
Shortly after iptables came out, New Riders published a book called Linux Firewalls, Second Edition. This book covers iptables in some depth and shows how to set up the standard architectures.
I have used this as a reference for three years now. It should have everything you need to know to set up the firewall section of your network. If you have a specific question, let me know.
-- Astronomer
(Linux Firewalls author Robert Ziegler has since published a third edition of the book through Novell Press. -- Editor)
Not on ITKnowledge Exchange yet? Register today.
