Date: Fri, 8 Jun 2001 15:42:31 -0700 From: "Robert L Sowders" <rsowders@usgs.gov> To: <carlos@rjstech.com> Cc: freebsd-ipfw@FreeBSD.ORG, owner-freebsd-ipfw@FreeBSD.ORG Subject: Re: A epiphany of sorts Message-ID: <OFF278CAA0.8B6B96FB-ON88256A65.007CA43C@wr.usgs.gov>
next in thread | raw e-mail | index | archive | help
You might be able to simplify your rules by setting up a VPN tunnel with IPSec. Here is a simple step by step. http://www.freeBSDdiary.org/ipsec-tunnel.php "Carlos Andrade" <carlos@rjstech.com> Sent by: owner-freebsd-ipfw@FreeBSD.ORG 06/08/2001 10:21 AM Please respond to carlos To: <freebsd-ipfw@FreeBSD.ORG> cc: Subject: A epiphany of sorts I have been working on our company's firewall for some time and I have been helped quite a bit from the wonderful people on this list. I had a epiphany of sorts today. Due to the way our office is networked to our other sales offices I want to redo our firewall rules. (background) our_network : will be put behind the firewall, natd will be running so I may have to have nat rules somewhere for directing requests to the correct machine. midland_office : a sales office behind a DSL router, machines are dhcp'ing to the net. abilene_office : a sales office behind a DSL router, machines are dhcp'ing to the net. (theoretical rule set) allow everything from our_network out allow everything? from our midland_office in allow everything? from our abilene_office in pass tcp from any to our outside_interface 80 setup (access web servers) and then our thin client (which we use to connect to a app server from the offices and sometimes from the road) : TCP/IP port 1494 (inbound) UDP port 1604 (inbound and outbound) Outbound ports 1023 and above for both TCP/IP & UDP deny the rest (commentary) we have no mail or dns servers, all that is done by our ISP. So there is very little traffic wanting to come into our network, so I can let those things in. I hope that I can just allow in the IP's of the DSL routers since the machines behind it pass through it over DHCP, or am I loony and need to read up more on DHCP? Yes, I know I must have a huge measure of trust to allow everything from our offices. I do. I am just trying to add to the layers of security by dictating exactly where people can access us from and by how. thanks in advance, Carlos Andrade ---- Carlos A. Andrade IS Manager RJS Technologies 915.845.5228 ext 13 915.845.2119 fax carlos@rjstech.com To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-ipfw" in the body of the message To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-ipfw" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?OFF278CAA0.8B6B96FB-ON88256A65.007CA43C>