DMZ Hosts can connect to the internal hosts?

jimmyone · #1 (**permalink**) 05-19-2009, 01:21 PM

Hi all,

how can it be that my DMZ hosts can connect to the Internal Network?

There is no NAT Rule defined for that.
When i try a ping or a telnet to a machine in the internal Network, its successful.

Whats the problem here?
I have looked into the NAT and Packetfilter Rules, there is no visible problem.

Do you have any ideas?

Thenak...

Greetz
Tom

wingman · #2 (**permalink**) 05-19-2009, 02:06 PM

on the top of the pf there should be a deny from the dmz to the internal host

jimmyone · #3 (**permalink**) 05-19-2009, 02:40 PM

When i create a deny Rule:

Source: DMZ (Network)
Dest: Internal (Network)
Action: Drop

there is no function... I can reach the interal hosts... ??

wingman · #4 (**permalink**) 05-19-2009, 04:30 PM

deny rule should be the first rule

Source: DMZ (Network)
Dest: Internal (Network)
Service:All
Action: Drop

Enable the log and to verify it works try to telnet to various ports for the dmz to the internal network

BAlfson · #5 (**permalink**) 05-19-2009, 05:36 PM

Like Wingman says, put it first. Every set of rules I can think of in the Astaro is processed sequentially. Once one of the rules is satisfied, the rest are skipped.

Another "trick" is that routes and rules in proxies and VPNs are evaluated before explicit ones you create. One of the implications of this is that allowing the DMZ to use the HTTP Proxy means that it can reach your internal network with any allowed service; someone who gains control of a computer in your DMZ has free access to websites in your internal network.

Cheers - Bob

jimmyone · #6 (**permalink**) 05-20-2009, 03:26 PM

Hi,

many thanks to you and sorry...
You're correct there is no connection possible.

When i try a telnet from the DMZ Client to any internal Host, there is a Connection abort.

But i can ping to all internal hosts...
In my Packetfilter i have all ICMP Forwards and so on unactivated.

The HTTP Proxy is in use...

Many Greetings
Tom

BAlfson · #7 (**permalink**) 05-20-2009, 05:15 PM

Tom, what masquerading rules do you have?

What have you entered in Allowed networks' on the 'Global' tab of 'Web Security >> HTTP/S'? If your DMZ is allowed, you will want to add blocks on the 'Content Filter' tab for your internal network. For example, if 'Internal (Network)' is 10.10.10.0/24, add a block for //10.10.10.

Cheers - Bob

wingman · #8 (**permalink**) 05-20-2009, 05:53 PM

Quote:

Originally Posted by BAlfson

Tom, what masquerading rules do you have?

What have you entered in Allowed networks' on the 'Global' tab of 'Web Security >> HTTP/S'? If your DMZ is allowed, you will want to add blocks on the 'Content Filter' tab for your internal network. For example, if 'Internal (Network)' is 10.10.10.0/24, add a block for //10.10.10.

Cheers - Bob

Bob

I am able to ping the internal zone and I do have pf rule denying traffic from dmz to internal, I don't have Allow ICMP on/through firewall and I have //192.168.2 under the url blocked as you said. What am I missing?

BAlfson · #9 (**permalink**) 05-20-2009, 11:23 PM

I don't know enough about TCP/IP to understand if the issue with ping is a bug or a feature of ICMP.

Do you have a packet filter rule like: 'DMZ (Network) -> Any -> Any : Allow' because you want to allow access to the internet? Unfortunately, that also allows unproxied traffic to your internal network. If that's the case, create a new Network Definition named "Internet" with 0.0.0.0/0 and bind it to the External interface. Now, replace the rule with 'DMZ (Network) -> Any -> Internet : Allow', and you can get rid of your 'DMZ (Network) -> Any -> Internal (Network) : Deny' rule. That will probably leave you still able to ping... let us know!

Cheers - Bob

wingman · #10 (**permalink**) 05-21-2009, 07:45 PM

Quote:

Originally Posted by BAlfson

I don't know enough about TCP/IP to understand if the issue with ping is a bug or a feature of ICMP.

Do you have a packet filter rule like: 'DMZ (Network) -> Any -> Any : Allow' because you want to allow access to the internet? Unfortunately, that also allows unproxied traffic to your internal network. If that's the case, create a new Network Definition named "Internet" with 0.0.0.0/0 and bind it to the External interface. Now, replace the rule with 'DMZ (Network) -> Any -> Internet : Allow', and you can get rid of your 'DMZ (Network) -> Any -> Internal (Network) : Deny' rule. That will probably leave you still able to ping... let us know!

Cheers - Bob

just tried removing the dmz ->any->private lan-->deny and add dmz->any-> internet (0.0.0.0/0) but still ping works from DMZ to private lan