Networks

Ask something
Discussion Locked

Firewall Placement

0 helpful
8 replies

by basher 1 view

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I need help designing my network. Here is how its setup up now, but don't think its right:

T1
|
Cisco Router
|(64.1.1.113/28)
|
switch
^ ^ ^
| | |(64.1.1.116/28)
| | Apache
| |
| |(64.1.1.115/28)
| W2K Exchange server
| |(10.0.0.2/24)
|(64.1.1.114/28) |
FreeBSD firewall |
|(10.0.0.1/24) |
| |
switch <-----------
^ ^
| |
| Workstations(DHCP from W2K Exchange)
|
W2K File server(10.0.0.3/24)

With these components what is the correct way to setup this network, the correct placement of each equipment. When you say "behind" the firewall, wouldn't that mean, in this senario, it would be on the 10.x network?? Please help, thanks in advance!!

Thanks,
Bill

8 replies

by mckaytech

Ideally, it would be nice to have a three-port firewall so that you would have the outside world, the inside world and the DMZ in which your Web and Exchange servers live. But even assuming a two-port firewall, the best location in my opinion for the firewall would be to have it as the next device after the router and use NAT to channel the public IP addresses to the servers inside the firewall and block all inbound traffic not headed for those specific servers and ports. Between ACLs on the router and the firewall itself, you can get reasonably good security with this setup.

However, there is a school of thought that would say the way you have it is correct - that you should not bring SMTP and HTTP traffic inside your firewall. I generally agree with the idea but having a Web and mail server sitting unprotected on the Internet is concerning as well.

Hence the three port firewall recommendation.

paul

by ebob

Like PM suggested, "right" is in the eye of the beholder.

A better approach is to use a firrewall with 3 interfaces, and designate the 3rd as "DMZ". Then hang your web and email server off of that.

The alternative is to bring one or more of these services to your inside network. This is probably the least palatable approach as you have to open up "public" ports in your FW.

A 3rd approach is to setup another email server, inside. Use your existing server as a "bastion host". Setup a tunnel in your FW between your 2 email servers. Also setup DHCP for your users on this new email host, and get it OFF of that one on the Internet. Then your users do email (and DHCP) with the server inside. Your DHCP scope is protected from nosey types on the 'Net. If you have "internal documents" posted on your web server, setup an Apache inside, and move those documents there.

This discussion is closed to new replies.