Firewall - DMZ
Overview
| DMZ Firewall |
Information |
| Description |
Configuration tool for DMZ-based firewalls. |
| Package Name |
cc-firewall-dmz |
| Configuration Page |
Network > Firewall > DMZ |
The DMZ solution is used to protect a separate network of public IP addresses. Typically, a third network card is used exclusively for the DMZ network.
- If you are configuring a few extra public IPs (not a whole network), then go to the 1 to 1 NAT section of the User Guide.
- If you are configuring a separate private network (192.168.x.x or 10.x.x.x), then investigate Hot LANs in the IP Settings section of the User Guide.
Installation
If you did not select this module to be included during the installation process, you must first install the module.
| |
 |
 |
This module is not available in the Community Edition |
|
Configuration
Network Configuration
Before you can use the DMZ firewall configuration, you need to configure one of your network cards with the DMZ role. In our example, we used the network settings tool to configure a third network card (eth2) with the following:
- Role: DMZ
- IP Address: 216.138.245.17
- Netmask: 255.255.255.240
- Network: 216.138.245.16/28
All the systems connected to this third network card can then be configured with an IP address in the 216.138.245.18 to 216.138.245.30 range.
Incoming Connections
By default, all inbound connections from the Internet to systems on the DMZ are blocked (with the exception of the ping protocol). You can permit connections to systems on the DMZ by allowing:
- all ports and protocols to a single public IP
- all ports and protocols to the whole network of public IPs
- a specific port and protocol to a single public IP
In the screenshot below, both 216.138.245.27 and 216.138.245.28 are not firewalled at all, while 216.138.245.26 can only be accessed via TCP port 2000.
Pinhole Connections (DMZ-to-LAN)
In some situations, you may want to allow particular network traffic from your DMZ to your LAN -- a pinhole rule. In our example, we have a document management system running on port 2401 on the LAN (at IP address 192.168.2.2). We want to allow a web server in our DMZ to access this document management system and we create a pinhole rule to do it (see screenshot).
Links
|
