How to build a DMZ?
-
My first time using pfsense. in this case I will build DMZ but I am confused how to build the DMZ, if only to add a rule to the firewall? or other?
case as shown below:
please help the master, thank you very much.
-
DMZ would not be in the same segment as your other servers.. Unless all of them are going to be in the dmz? But you have no other segments..
-
You probably mean a "pseudo" DMZ that you have in many el cheapo routers where the router forwards all possible ports to single address on the LAN network. This is not supported on pfSense because it's not a real DeMilitarized Zone and offers no separation from the other hosts. You'll need a separate DMZ interface on your pfSense if you want to have one.
-
DMZ would not be in the same segment as your other servers.. Unless all of them are going to be in the dmz? But you have no other segments..
so, should the different segments. but based on the topology of the above still could not make a DMZ?
-
@kpa:
You probably mean a "pseudo" DMZ that you have in many el cheapo routers where the router forwards all possible ports to single address on the LAN network. This is not supported on pfSense because it's not a real DeMilitarized Zone and offers no separation from the other hosts. You'll need a separate DMZ interface on your pfSense if you want to have one.
so I can not make the DMZ is based on the topology of the above?
-
All dmz is is a firewalled segment with normally restrictive rules that prevents it from accessing your other segments. And which is normally allowed traffic unsolicited inbound from hostile network or say internet So via another interface or a vlan you could break out another network.. Make it 192.168.201/24 for example.
If you do not have a switch to use vlans to isolate your "dmz" segment from the rest of your network.. You could just use another switch and interface on pfsense.
In your drawing you don't spell out this wifi network you have.. So I take it you bridged this to your 192.168.200/24 segment??
Normally if your serving up web to the internet, the webservers would be in a "dmz" from the rest of your network.. You don't show any other networks? Are your local end clients all on the wifi that is bridged to your 192.168.200?
As an example I have my ntp server that serves up ntp to the ntp pool (internet). This is in my "dmz" segment that blocked from from creating connections into any my other network segments/vlan. But my other local segments can create traffic into the dmz..
-
All dmz is is a firewalled segment with normally restrictive rules that prevents it from accessing your other segments. And which is normally allowed traffic unsolicited inbound from hostile network or say internet So via another interface or a vlan you could break out another network.. Make it 192.168.201/24 for example.
If you do not have a switch to use vlans to isolate your "dmz" segment from the rest of your network.. You could just use another switch and interface on pfsense.
In your drawing you don't spell out this wifi network you have.. So I take it you bridged this to your 192.168.200/24 segment??
Normally if your serving up web to the internet, the webservers would be in a "dmz" from the rest of your network.. You don't show any other networks? Are your local end clients all on the wifi that is bridged to your 192.168.200?
As an example I have my ntp server that serves up ntp to the ntp pool (internet). This is in my "dmz" segment that blocked from from creating connections into any my other network segments/vlan. But my other local segments can create traffic into the dmz..
sorry on the topology above are not included. to access free wifi using the ip address ip address 192.168.1.1/24 with the provision in the DHCP of bounds 192.168.1.10 to 192.168.1.40.
because I lacked a DMZ interface to build the solution create a VLAN?
-
How many interfaces does your pfsense have? If you do not have enough then yes use a vlan.. What switch do you have - does it support vlans?