From owner-freebsd-security Thu Nov 22 10:21:48 2001 Delivered-To: freebsd-security@freebsd.org Received: from pintail.mail.pas.earthlink.net (pintail.mail.pas.earthlink.net [207.217.120.122]) by hub.freebsd.org (Postfix) with ESMTP id 0BD9237B405 for ; Thu, 22 Nov 2001 10:21:42 -0800 (PST) Received: from user-33qtm2c.dialup.mindspring.com ([199.174.216.76] helo=gohan.cjclark.org) by pintail.mail.pas.earthlink.net with esmtp (Exim 3.33 #1) id 166yTk-0000N2-00; Thu, 22 Nov 2001 10:21:41 -0800 Received: (from cjc@localhost) by gohan.cjclark.org (8.11.6/8.11.1) id fAMBHdQ00890; Thu, 22 Nov 2001 03:17:39 -0800 (PST) (envelope-from cjc) Date: Thu, 22 Nov 2001 03:17:39 -0800 From: "Crist J. Clark" To: Fernando Germano Cc: security@FreeBSD.ORG Subject: Re: Best security topology for FreeBSD Message-ID: <20011122031739.A226@gohan.cjclark.org> Reply-To: cjclark@alum.mit.edu References: <00ca01c172aa$814c90d0$ed64a8c0@audi2k> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <00ca01c172aa$814c90d0$ed64a8c0@audi2k>; from fgermano@audiotel.com.ar on Wed, Nov 21, 2001 at 01:35:18PM -0300 X-URL: http://people.freebsd.org/~cjc/ Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk List-ID: List-Archive: (Web Archive) List-Help: (List Instructions) List-Subscribe: List-Unsubscribe: X-Loop: FreeBSD.org On Wed, Nov 21, 2001 at 01:35:18PM -0300, Fernando Germano wrote: > > Could please help me? > > I'm about to install a FreeBSD 4.4 box with some firewall and I need to know > wich one of the freeware firewalls product is the best (IPFW, IPFilter, > etc), or maybe if you could recomend me a good solution for this situation: > > FreeBSD box = firewall with 10 NICs > > NIC 1 -> DMZ > NIC 2 -> Internet > NIC 3 -> Partner network > . > . > NIC 8 -> Partner network > NIC 9 -> Internal network > NIC 10 -> Internal network It is sad to see this poor design, Internet | | Firewall--"DMZ" | | Internal Used so very, very much these days (I think thanks to several firewall vendors pushing this as a standard design). A much better design, is Internet | | Firewall1 | | DMZ | | Firewall2 | | Internal (This design is actually where the term "DMZ" comes from since it actually looks like one here.) And in your case... that many NICs in one machine... I hope you have a dedicated stand-by. It's screaming "single point of failure." I would really consider NOT using one machine for all of this. -- Crist J. Clark cjclark@alum.mit.edu To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message