Firewall DMZ – provides a segmentation of the network when you need to host public resources such as Web servers.
Connecting our private network to the un-trusted network (aka the internet), we should control the flow of the traffic in a secured manner by a firewall device. With firewall, all the traffic are forced to pass through a single concentrated checkpoint where all traffic will be controlled, authenticated, filtered, and logged according to the policies set. With this way, we can significantly reduce, but not eliminate the amount of unauthorized traffic reaching our internal network. See also Intrusion detection system.
What happen if we need to provide the public resources that can be accessed by users from the internet in a secured way? Internet users can access the public resources but they cannot get into our private / internal corporate networks. We need to configure our firewall by providing the perimeter network – a Firewall with DMZ (Demilitarized Zones).
Firewall DMZ – Demilitarized Zone is a security network at the boundary between a corporate / private Local area network (LAN) and the internet. A firewall DMZ must be used whenever you need to provide a segmentation of the network when you need to host public resources such as Web servers. The perimeter network is designed to protect servers on the corporate network from attack by malicious users on the Internet. See also any types of malware here.
The following figure shows the diagram of the firewall with two DMZ networks.
If the requirements to use multiple network segments exist, you can deploy multiple DMZ with differing security policies (levels). For example on the figure shown on the above diagram, you need to deploy the applications for extranets, intranets, web server hosting and remote access gateways.
Have a look at the above diagram; the traffic from the internet users can only access the Web server which sits in DMZ1 network. They cannot access the SQL server which sits in DMZ2 network. However, both Web server in DMZ1 and SQL server in DMZ2 can access each other. As a general practice you should separate the SQL server from the Web server. You need to develop policies that meet the above security requirements. See also more detail about firewall ports.
Implementation
The firewall DMZ can be implemented at the border of the corporate LAN which typically has three network interfaces:
- The internet interface: the interface is exposed to the internet (the unsecured public network)
- The private / Intranet interface: the interface is connected to the corporate LAN network where you put your vulnerable servers.
- The DMZ network: the DMZ interface resides in the same public network that can be easily accessed by public users from the internet. The public resources which typically reside in the firewall DMZ are proxy servers, and web servers.
Wireless Routers with DMZ Feature
There are many popular home wireless routers (such as WRT610N by Linksys) with the firewall DMZ feature available in the market today. With the DMZ feature, you can expose a single computer to be exposed from the internet for use of a special-purpose service such as Internet gaming or videoconferencing. DMZ hosting forwards all the ports at the same time to one PC. The Port Forward feature is more secure because it only opens the ports you want to have opened, while DMZ hosting opens all the ports of one computer, exposing the computer to the Internet.
For example with WRT610N wireless router, you can expose one PC or game console for Online Gaming purposes. Access the router web-based utility and locate the Application > DMZ page to configure and enable the DMZ feature. DMZ feature is disabled by default. Enable the DMZ feature and select the IP address or manually enter a specific IP address of the computer from the Internet that will be allowed to access the PC in the network. You should also enter the IP / MAC address of the PC / Game console you want it to be accessed from the internet.
By Ki Grinsing
See also:
- Tweaking the DNS setting – speed up internet connection
- A general guidelines of the router
- Understanding Cisco router IOS
- Understanding the wireless LAN network
- Backup the hard drives
Recent Comments