Pseudo DMZ - rules for split DNS
-
In reference to this post:
Firewall with WAN-LAN-DMZ SetupRealizing with a single public facing IP, a true DMZ isn't possible, I'm basically using port forwards to expose services on hosts hanging off an interface configure with a private RFC-1918 address. This works fine...the resources are accessibly externally.
What I'm trying to figure out is a rule-base that would allow hosts on my internal LAN, a separate RFC-1918 private address space on a different internal interface, to access the DMZ services using my internal DNS (resolving to the RFC-1918 addresses for the hosts in the DMZ).
My goal is to allow LAN devices to reach the hosts in the pseudo-DMZ subnet if the LAN device initiates the connection. However, I do not want a device in the pseudo-DMZ to be able to initiate a connection to a device in the LAN subnet. This is the challenge I'm trying to overcome. Does the PFSense Firewall support such a scenario that allows connectivity in one direction for "established" connections, yet block connection attempts in the other direction without an established connection?
Hope I've not made this too confusing.
Thanks in advance.