Q

Should a router be placed between the firewall and DMZ?

Modern firewalls have the ability to serve as a router, negating the need of another device on a network. There are exceptions to this router rule, however. Network security expert Mike Chapple explains.

I have a question relating to firewall topologies. In a three network-card model, should the third network card connect to a router, which would then connect to the public servers in the DMZ? Would a triple-homed server -- acting as a firewall -- serve the function of a proxy server?
Typically, it's not necessary to have a router between the firewall and the DMZ. Modern firewalls have the ability to serve as a router, negating the need of another device on the network. However, if you have a large number of hosts in the DMZ, you may wish to consider a router with rudimentary filtering rules; placing one on the network can reduce the load on the firewall itself. The best way to determine whether you need this type of support is through good old-fashioned trial and error.

It's more likely that you'll need a router between your firewall and the Internet. In this location, a router can screen out an Internet stream's obvious "junk traffic" before it reaches the firewall. You can use the router to apply broad firewall rules across the enterprise. For example, if you don't allow any SSH traffic through the firewall, you can drop all inbound port 22 traffic at the router, letting the firewall focus on arbitrating...

tougher decisions.

Some firewalls do act as proxy servers, but only if they are specifically designed as Layer 7, or application-layer firewalls. Consider the case where an internal user wishes to access an external Web site. The proxy firewall transparently inserts itself into the conversation, completing the three-way handshake with the end user, determining whether the traffic is allowed, and then completing a separate three-way handshake with the destination system.

More information:

  • Learn how to conduct firewall configuration reviews.
  • Discover the different ways to place systems in a network topology.
  • This was first published in August 2007
    This Content Component encountered an error

    Pro+

    Features

    Enjoy the benefits of Pro+ membership, learn more and join.

    Have a question for an expert?

    Please add a title for your question

    Get answers from a TechTarget expert on whatever's puzzling you.

    You will be able to add details on the next page.

    0 comments

    Oldest 

    Forgot Password?

    No problem! Submit your e-mail address below. We'll send you an email containing your password.

    Your password has been sent to:

    -ADS BY GOOGLE

    SearchCloudSecurity

    SearchNetworking

    SearchCIO

    SearchConsumerization

    SearchEnterpriseDesktop

    SearchCloudComputing

    ComputerWeekly

    Close