Date: Thu, 22 Nov 2001 03:17:39 -0800 From: "Crist J. Clark" <cristjc@earthlink.net> To: Fernando Germano <fgermano@audiotel.com.ar> Cc: security@FreeBSD.ORG Subject: Re: Best security topology for FreeBSD Message-ID: <20011122031739.A226@gohan.cjclark.org> In-Reply-To: <00ca01c172aa$814c90d0$ed64a8c0@audi2k>; from fgermano@audiotel.com.ar on Wed, Nov 21, 2001 at 01:35:18PM -0300 References: <00ca01c172aa$814c90d0$ed64a8c0@audi2k>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, Nov 21, 2001 at 01:35:18PM -0300, Fernando Germano wrote:
>
> Could please help me?
>
> I'm about to install a FreeBSD 4.4 box with some firewall and I need to know
> wich one of the freeware firewalls product is the best (IPFW, IPFilter,
> etc), or maybe if you could recomend me a good solution for this situation:
>
> FreeBSD box = firewall with 10 NICs
>
> NIC 1 -> DMZ
> NIC 2 -> Internet
> NIC 3 -> Partner network
> .
> .
> NIC 8 -> Partner network
> NIC 9 -> Internal network
> NIC 10 -> Internal network
It is sad to see this poor design,
Internet
|
|
Firewall--"DMZ"
|
|
Internal
Used so very, very much these days (I think thanks to several firewall
vendors pushing this as a standard design).
A much better design, is
Internet
|
|
Firewall1
|
|
DMZ
|
|
Firewall2
|
|
Internal
(This design is actually where the term "DMZ" comes from since it
actually looks like one here.)
And in your case... that many NICs in one machine... I hope you have a
dedicated stand-by. It's screaming "single point of failure." I would
really consider NOT using one machine for all of this.
--
Crist J. Clark cjclark@alum.mit.edu
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20011122031739.A226>