NOT NAT only with DMZ?

You can place any machine anywhere you like provided that NAT takes place if that machine needs to communicate onto the internet, or needs to be accessible from the internet.

A standard setup is to have your private, corporate machines on a highly secure internal network running NAT (or PAT - port address translation) and having little or no access to this subnet from anywhere else.

A DMZ can be set up to run public or private (with NAT) IPs, and have limited access to the devices on there, usually devices that need to be publicly accessible from the internet (mail servers, web, etc.).

Since public devices must have a public IP, your machines will still be subject to attack. As always, the best prevention is to keep up with the patches, have an effective firewall policy and pay attention to what is happening on your network.

Hope that helps -

What i use is a firewall called SonicWall Pro.
On this box it has 3 connections... LAN,WAN,DMZ.
The DMZ is normally used for mail & web servers and they call servers in the DMZ "sacrificable servers".
The quality of your firewall will determine whether the DMZ devices are susseptable to Denial of service attacks and so on or not.On the LAN side all your sensitive data and servers would be placed.On the WAN would be your router or LAN modem. NAT will be used on the WAN port to the outside andthe Ip address is provided by your ISP.You can set it up so that virtually nothing gets in or a lot. It also has proxy capabilities so you can limit certain users access to the internet.For best protection deploy an access list on your router aswelland close down vunerable ports even before it gets to your firewall.

Hope this helped!

This question was auto closed due to inactivity