Firewall Wizards mailing list archives
Re: PIX access-list help
From: "Brian Blater" <brb.lists () gmail com>
Date: Wed, 26 Dec 2007 13:07:37 -0500
On Dec 25, 2007 12:25 AM, Paul Melson <pmelson () gmail com> wrote:
On Dec 21, 2007 11:02 AM, Brian Blater <brb.lists () gmail com> wrote:So, my main question, is there an access list command I can have that basically says "allow all communication from the dmz to the internet" and one that says "allow communication from the inside to the dmz"? I know I can add "access-list dmz permit ip host 192.168.1.1 any" and that solves the problem of getting to the internet, but then it opens all communication to the inside from this host and I don't want to do that. Since this is version 6.3(3) I can't use an out access-list which I think might solve the problem. I have enough memory to run version 7.x on this PIX, but I'm trying to tackle one problem at a time and I'm a little hesitant about doing the 7.x upgrade just yet.The short answer to your question is that PIX access-lists are read, per-interface, top-to-bottom: access-list dmz_in deny ip 192.168.1.0 255.255.255.0 10.0.0.0 255.0.0.0 access-list dmz_in permit ip 192.168.1.0 255.255.255.0 any access-group dmz_in in interface dmz If your internal network is 10.0.0.0/8 and your DMZ is 192.168.1.0/24, this will prevent traffic from the DMZ to the inside, but allow everything else. PaulM
Ok, I think I understand this a little better now. Say my private network is 192.168.1.0/24 and my dmz is 192.168.2.0/24. I already have the static (inside,dmz) 192.168.1.0 192.168.1.0 netmask 255.255.255.0 which is required in 6.3(3). So, in order to make this work i.e the inside network has access to everything on the dmz network and the dmz network can access the internet and I only allow specific communication from the dmz to the inside I need to do the following: access-list dmz permit udp host 192.168.2.2 host 192.168.1.202 eq domain access-list dmz permit tcp host 192.168.2.2 host 192.168.1.203 eq smtp access-list dmz deny ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0 access-list dmz permit ip 192.168.2.0 255.255.255.0 any I will also need to add the nonat statements as was suggested by Brandon: access-list nonat permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0 access-list nonat permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0 nat 0 (inside) access-list nonat nat 0 (dmz) access-list nonat My only concern here is the 3rd line in the dmz access-list and whether it will deny communication from the inside network to the dmz (except dns and smtp), but I will test that when I get home tonight. Thank you for everyone's help. Brian _______________________________________________ firewall-wizards mailing list firewall-wizards () listserv icsalabs com https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards
Current thread:
- PIX access-list help Brian Blater (Dec 24)
- Re: PIX access-list help Fetch, Brandon (Dec 26)
- Re: PIX access-list help Fetch, Brandon (Dec 26)
- Re: PIX access-list help Farrukh Haroon (Dec 26)
- Re: PIX access-list help kevin horvath (Dec 26)
- Re: PIX access-list help Paul Melson (Dec 26)
- Re: PIX access-list help Brian Blater (Dec 26)
- Re: PIX access-list help Avishai Wool (Dec 26)