how to access a dmz servers from LAN?
-
You see I have 2 firewalls one for the dmz (WAN - 192.168.1.100, LAN - 192.168.2.1)
and another for the internal network (WAN - 192.168.2.250, LAN - 192.168.3.1).
I have to implement a web server, FTP and an IDS in the DMZ and I really don't know how to do it, of course, the clients of the lan must access the services of the dmz, I have the services of DNS, AD, DHCP, WSUS working correctly on the LAN (2nd Firewall).Any ideas? I'm losing my mind right now.
Please detail your answers, I am a student.
help me.
-
Why does this sound like a homework assignment?
-
@JKnott probably right ;)
Do you actually have two separate firewalls or 1 firewall with separate interfaces for the LAN and DMZ? Post a network map.
What you're talking about involves firewall rules, port forwarding and setting up Snort or Suricata for IDS.
-
The going rate for help on homework is $250/hr - 2 hour min... How would you like to send that? Vemo, Zelle? Crypto accepted ;)
-
@JKnott yes, it is.
-
@JVlas said in how to access a dmz servers from LAN?:
@JKnott yes, it is.
Does your instructor know you're cheating? I would think he wants you to solve this on your own.
-
@JKnott I'm not cheating, I'm looking for information, he hasn't taught me anything I've done so far or is this cheating?, Anyways I would appreciate if you could help me.
-
@marvosa said in how to access a dmz servers from LAN?:
@JKnott probably right ;)
Do you actually have two separate firewalls or 1 firewall with separate interfaces for the LAN and DMZ? Post a network map.
What you're talking about involves firewall rules, port forwarding and setting up Snort or Suricata for IDS.
I have 2 separate firewalls, what I have to do is that the clients that connect to the LAN of the second firewall can access the DMZ services, I have run out of ideas on how to do it. I used Windows server 2016 to create an ISS in the dmz, is that fine?, Do I have to use other applications?, I need a firewall rule?
-
That sort of design is horrible.. You will have all kinds of asymmetrical issues.. And will force you to nat and or host route, etc. If you need to allow for any pinholes from your dmz into your lan.
What is the actual assignment... I find it hard to grasp that that sort of setup was spelled out.. If you want to use 2 firewalls ok - but the lan firewall should be connected to the edge via a transit... Its traffic should not transverse the segment where your internet services are provided, etc.
Is the assignment to just isolate these services from the lan, or will these services be provided to the public internet, and your lan will also use them.
-
@johnpoz said in how to access a dmz servers from LAN?:
That sort of design is horrible.. You will have all kinds of asymmetrical issues.. And will force you to nat and or host route, etc. If you need to allow for any pinholes from your dmz into your lan.
What is the actual assignment... I find it hard to grasp that that sort of setup was spelled out.. If you want to use 2 firewalls ok - but the lan firewall should be connected to the edge via a transit... Its traffic should not transverse the segment where your internet services are provided, etc.
Is the assignment to just isolate these services from the lan, or will these services be provided to the public internet, and your lan will also use them.
This is the assignment at this point I discard using the third firewall, then create the vlans on the LAN adapter of the second firewall. I don't really have any problem with the LAN, it's just with the DMZ.
-
What a freaking FAIL!!! That is the sort of nonsense they are teaching???
So in that scenario for traffic to get to the internet say this lan2 it goes through 3 firewalls, and transverse not only lan 1 also the dmz..
That is just MORONIC!!!
I take it in this scenario firewall 2 and 3 are also natting... If not all of your lan servers would need host routing on them, or you have asymmetrical mess.
Even if you wanted allow for downstream firewalls in the network, the routing between networks would be done via transit network or networks.. You don't transverse or use a host network as a transit network like that..
edit: here is how it would be setup with your 3 firewall/routers.. Much more detail would be needed for sure - but this eliminates any asymmetrical issues. And allows for only having to nat at the edge device, etc. etc.
All of this could be done with single firewall/router to be honest.. But sure use of downstream routers/firewall is not an issue.. But you sure and the hell would not set up like you posted... I would say the person that came up with that scenario shouldn't be teaching networking that is for sure.
-
@johnpoz said in how to access a dmz servers from LAN?:
What a freaking FAIL!!! That is the sort of nonsense they are teaching???
So in that scenario for traffic to get to the internet say this lan2 it goes through 3 firewalls, and transverse not only lan 1 also the dmz..
That is just MORONIC!!!
I take it in this scenario firewall 2 and 3 are also natting... If not all of your lan servers would need host routing on them, or you have asymmetrical mess.
Even if you wanted allow for downstream firewalls in the network, the routing between networks would be done via transit network or networks.. You don't transverse or use a host network as a transit network like that..
edit: here is how it would be setup with your 3 firewall/routers.. Much more detail would be needed for sure - but this eliminates any asymmetrical issues. And allows for only having to nat at the edge device, etc. etc.
All of this could be done with single firewall/router to be honest.. But sure use of downstream routers/firewall is not an issue.. But you sure and the hell would not set up like you posted... I would say the person that came up with that scenario shouldn't be teaching networking that is for sure.
Very very thanks bro, you don't have to tell me more details I think I'm in the right place rn.
-
No problem - I take BTC or LTC ;) heheeh
-
Er I think there's some confusion here. The diagram shown is just a string of firewalls behind each other, there is no routing across the ISPs network. More importantly LAN clients should be able to access the DMZ subnet by default. The fact you say they cannot suggests to me you don't have it configured as shown there. But the subnets/IP you give suggest it is.
So how are you trying to reach the DMZ servers from LAN clients? How is it failing?
But, yeah, you could do this with one firewall and three interfaces.
Steve
-
@stephenw10 said in how to access a dmz servers from LAN?:
Er I think there's some confusion here
Yeah for sure!!!! Whoever put up that drawing has ZERO!!! understanding of how networking works.. if that is some teacher??? Then just shoot me!!! Our future is failed - we should just give up..
I really do not get how that could be any sort of class - there is zero possible how that someone that is a teacher of networking could put up such a drawing.. If so we are just failed!!!! WTF????
Really - if someone put that up as some sort of test, other than what is F'ing wrong with this drawing... We are all is serious trouble for the future!!!
