From owner-freebsd-security  Thu Nov 22 11:56: 6 2001
Delivered-To: freebsd-security@freebsd.org
Received: from pa169.kurdwanowa.sdi.tpnet.pl (pa169.kurdwanowa.sdi.tpnet.pl [213.77.148.169])
	by hub.freebsd.org (Postfix) with ESMTP id 4CE9037B419
	for <security@FreeBSD.ORG>; Thu, 22 Nov 2001 11:55:52 -0800 (PST)
Received: by pa169.kurdwanowa.sdi.tpnet.pl (Postfix, from userid 1001)
	id D6B581DA7; Thu, 22 Nov 2001 20:55:31 +0100 (CET)
Received: from localhost (localhost [127.0.0.1])
	by pa169.kurdwanowa.sdi.tpnet.pl (Postfix) with ESMTP
	id 6369755A2; Thu, 22 Nov 2001 20:55:31 +0100 (CET)
Date: Thu, 22 Nov 2001 20:55:30 +0100 (CET)
From: Krzysztof Zaraska <kzaraska@student.uci.agh.edu.pl>
X-Sender: kzaraska@lhotse.zaraska.dhs.org
To: cjclark@alum.mit.edu
Cc: security@FreeBSD.ORG
Subject: Firewall design [was: Re: Best security topology for FreeBSD]
In-Reply-To: <20011122031739.A226@gohan.cjclark.org>
Message-ID: <Pine.BSF.4.21.0111222046180.636-100000@lhotse.zaraska.dhs.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-security@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-security.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-security>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-security>
X-Loop: FreeBSD.org

On Thu, 22 Nov 2001, Crist J. Clark wrote:

<snip>
> It is sad to see this poor design,
> 
>      Internet
>         |
>         |
>       Firewall--"DMZ"
>         |
>         |
>      Internal
> 
> Used so very, very much these days (I think thanks to several firewall
> vendors pushing this as a standard design).
> 
> A much better design, is
> 
>       Internet
>          |
>          |
>       Firewall1
>          |
>          |
>         DMZ
>          |
>          |
>       Firewall2
>          |
>          |
>       Internal
> 
> (This design is actually where the term "DMZ" comes from since it
> actually looks like one here.)

Could you please explain why the second design is better? I know it's
harder to properly construct the correct ruleset for the first topology,
but what are other problems?

Thanks in advance,

Krzysztof


To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message