[Shorewall-users] Firewall config

Tom Eastep
2003-10-05T08:20:17Z

On Sat, 2003-10-04 at 18:20, Arjun Kaul wrote:

>
> But, I was wondering if there was a inherent flaw in my Design by keeping
> the Application server in the DMZ, since if it gets compromised there is a
> direct connection from it to the LOC zone.

If you need external access to the application server and the
application server needs access to the SQL server then what choice do
you have?

>
> Secondly, I am wondering if it would be better to use DNAT rather than
> direct connections between zones e.g.
>
> DNAT        dmz            loc:192.168.0.5:1433     tcp     6500
>
> or
>
> ACCEPT    dmz            loc                                tcp     1433
>
> The advantage with the former is that I can deny all incoming connections
> from DMZ to LOC zone and Only allow connections through the firewall. But
> would there be any performance considerations with the former.

Using DNAT in this situation is inherently no more secure than using
ACCEPT rules. For a discussion of when to use ACCEPT and when to use
DNAT, see faq 30.

-Tom
--
Tom Eastep    \ Nothing is foolproof to a sufficiently talented fool
Shoreline,     \ http://shorewall.net
Washington USA  \ teastep@shorewall.net