Date: Sun, 1 Jul 2001 14:59:57 -0700 From: "Crist J. Clark" <cristjc@earthlink.net> To: Robert Banniza <robert@rootprompt.net> Cc: freebsd-ipfw@FreeBSD.ORG Subject: Re: IPFW and triple-homed box... Message-ID: <20010701145957.F296@blossom.cjclark.org> In-Reply-To: <GMEDKMKMEBENJMBLDHAICEMDDPAA.robert@rootprompt.net>; from robert@rootprompt.net on Sun, Jul 01, 2001 at 01:36:24PM -0700 References: <20010701110834.B296@blossom.cjclark.org> <GMEDKMKMEBENJMBLDHAICEMDDPAA.robert@rootprompt.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sun, Jul 01, 2001 at 01:36:24PM -0700, Robert Banniza wrote: > Guys, > I've got a box that I would like to add a third interface to for a DMZ. > However, I'm having more questions than answers right now. I have basically > the following interfaces: > > xl0 (external interface to router) > fxp0 (internal interface using NAT) > fxp1 (DMZ interface using REAL IP on this interface as well as all machines > having a real IP) > > I want to allow ports 80,443 and 25 over to one single real IP on the DMZ > while allowing nothing to flow in to the internal network from the DMZ. I > also want all traffic on the internal network allowed out to the 'net and > allowed over to the DMZ. The first question I have is will you be using subnetting to do this, in which case the firewall will be routing, or not, which requires either NAT (not a big issue) or bridging (still a bit of a hack to combine with ipfw)? I think that needs to be cleared up before anyone can help much more. -- Crist J. Clark cjclark@alum.mit.edu To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-ipfw" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010701145957.F296>