The following question and answer thread is excerpted from ITKnowledge Exchange. Click here to read the entire thread or to start a new one.
ITKE member Ruhi posed this question:
I have to plan and design a demilitarized zone using iptables. How can I do this?
ITKE member Dargandk advised:
You can certainly use iptables to build a basic firewall architecture. Part of that structure would be the DMZ area. Another approach you could take is to use the iptables as server firewall, and block selected services.
You would need a routing functionality also, for which you could use any Linux-based routing daemon, or a more mature router such as one from Cisco.
ITKE member Sonyfreek advised:
You can design your DMZ any way you want it, but there are two generally practiced methods.
The first is to have a firewall with three interfaces in it: outside, inside and DMZ. The DMZ interface is not trusted by the internal network and all of your "expendable" servers and services should go there -- i.e. the external DNS, Web server, mail relay, IDS, etc. The internal network would be configured to allow porting the e-mail relay server through, but generally should not trust any connections from the DMZ into the internal network with that exception. Obviously, the external network shouldn't be trusted at all and only necessary services should be allowed to access the Internet outside from your internal hosts and DMZ services.
The second, most popular DMZ setup is called "Barrier Reef." With it, you configure two different firewalls (with different operating systems and firewall software) and install the DMZ between the two firewalls. Let's call the one firewall the outside firewall and the other the inside firewall. The outside firewall has connections to the Internet and the DMZ. The Inside firewall has connections to the DMZ and the Internal network. In this case, the same rules are established as with a three-interface firewall but you are "more protected" because if someone is capable of owning the one firewall, they may not have the expertise to crack the second one. Also, the ruleset on the second firewall should be more strict and selective of what it lets through.
Now, for the configuration of iptables... I suggest you use one of the front-ends to iptables to get you used to configuring rules. Later on, you may decide to take on the iptables ruleset directly if you are into that type of thing. I've used Shorewall before with a lot of success, but watch out with using a GUI on a production firewall. The easier it is for you to use, the easier it is for someone to hack it.
ITKE member Zottman advised:
Sonyfreek gave an excellent explanation about how to set up a DMZ!
As for a GUI front end for iptables, I suggest you try Firewall Builder. It is really ease to use, and even has some wizards that help you on building your initial set of rules.
ITKE member Astronomer advised:
Shortly after iptables came out, New Riders published a book called Linux Firewalls, Second Edition. This book covers iptables in some depth and shows how to set up the standard architectures.
I have used this as a reference for three years now. It should have everything you need to know to set up the firewall section of your network. If you have a specific question, let me know.
This tip originally appeared on SearchNetworking.com
