Question about DMZ

lejzer · #1 (**permalink**) 02-15-2004, 07:36 PM

Hi!

I recently managed to setup a DMZ with help from this forum. I have a ftpserver running on the DMZ. The FTP is working as a charm from external and from the lan.

I only have one external ip from ISP.

The problem now is that i don't know how to set the correct rules to let the server access HTTP etc.

eth0: 192.168.0.X (LAN)
eth1: 217.***.***.*** (ISP)
eth2: 192.168.4.X (DMZ)

I don't know if the lan-settings are correct on the server.
IP: 192.168.4.1
Gateway: 192.168.0.254 (ASTARO) <<-- Is this correct?
DNS: Same as above <<-- is this correct?

I can't seem to get the server to access internet even though i've setup rules to allow it to.

Thanks in advance

AJo · #2 (**permalink**) 02-15-2004, 08:14 PM

Gateway on your server should be the ASL DMZ NIC address (if the server is located on that subnet as I assume)

DNS should be the DNS server you use, either the ASL DMZ NIC address if DNS proxy is enabled or the ISP provided address. If you provide your own DNS service then point the server to that address.

lejzer · #3 (**permalink**) 02-15-2004, 08:26 PM

Thank you!

That seems to be correct settings, but i still can't get the server to access anything on the outside?

AJo · #4 (**permalink**) 02-15-2004, 08:32 PM

1. Are you MASQ or SNAT all traffic from the server? Or do you just SNAT specific services (ie. ports)
2. Check you filter rules. Do you allow the server to http and dns?
3. Check the filter log to analyze the traffic.

lejzer · #5 (**permalink**) 02-15-2004, 08:46 PM

Actually i didn't MASQ or SNAT anything. I've just added rules for letting the server access different services.

Maybe that's the problem?

AJo · #6 (**permalink**) 02-15-2004, 08:49 PM

yup... since no other host outside your ASL protected environment will find the route to the server using a private address.

lejzer · #7 (**permalink**) 02-15-2004, 08:52 PM

I see,

Can you point me in the right direction how the NAT/MASQ should look like?

AJo · #8 (**permalink**) 02-15-2004, 08:56 PM

Choose either to MASQ or SNAT. Check the provided link below and read either the MASQ for clients part or the FTP SNAT part.

portfw

lejzer · #9 (**permalink**) 02-15-2004, 09:01 PM

Thanks,

I've read that article for setting up the MASQ/NAT for inbound access to the FTPServer on the DMZ, and that works, but now the problem is the other way around. Letting traffic from the server on the DMZ out.

Or am i misunderstanding your point? [img]/images/graemlins/smile.gif[/img]

AJo · #10 (**permalink**) 02-15-2004, 09:09 PM

yes you are misunderstanding, there is no use of letting traffic in (inbound) unless you let the internal destination to respond(ie. outbound). So both parts are described there.

1. MASQ webserver ==> ASL_external_interface

or

2. SNAT webserver ===> ASL_external_interface

some other useful links:
Initial_Setup.pdf

A_NAT_Primer.pdf