RE: External Network / Firewall Setup.

["David Gillett" <gillettdavid () fhda edu>]

  Since all of your clients' Internet traffic is broadcast to everything
in the DMZ, I don't see that having them collect their mail from there
is anything to worry about.  The general rule on DMZs is that 
connections between the DMZ and the trusted (internal) network are only
ever initiated from the trusted side.

> I'm wary of a single point of failure.

  Well, I count at least FIVE of them in your design....

David Gillett


> -----Original Message-----
> From: lists () ninjafriendly com [mailto:lists () ninjafriendly com]
> Sent: Monday, September 05, 2005 4:45 AM
> To: security-basics () securityfocus com
> Subject: External Network / Firewall Setup.
>
>
> Hi all,
>
> Background: We're a .sch.uk with a currently county-managed 
> firewall and webmail
> provision.  We have a 2mb symmettric DSL connection with 
> approx 30% use at any
> one time.  Due to service and reliability issues with the 
> county-managed
> solution we are looking to run our own mailserver, accessible from the
> internet.  On balance, maintaining our own firewall setup is 
> less hassle than
> keeping what we currently have.
>
> I'm currently in the process of working out the firewall 
> requirements, what I
> have so far is this:
>
> Internet
> |
> Router
> |
> Firewall(1)
> |
> HUB---Snort(1)
> | |___Mailserver
> |
> Firewall(2)
> |
> HUB---Snort(2)
> |
> |
> LAN
>
> I suspect this setup may be overkill for the amount of 
> traffic we receive, but
> I'm wary of a single point of failure.  Hardware isn't a problem.
>
> Further info: The mailserver will be running Horde.  I'm 
> hoping to convince
> management to use a PIX or similar for the first firewall and 
> then something
> *nix based for the second, otherwise it will be two *nix 
> boxes (IPcop and
> something BSD based).
>
> Something I'm still unsure about is internal clients connecting to the
> mailserver in the DMZ - how much of a security issue is this? 
>  Should I use the
> DMZ mailserver simply as a relay for an internal mailserver?
>
> Would anyone mind looking this over and telling me if I've 
> screwed up /
> overlooked something?
>
> Thanks
>
> Pete