Subject: plan a Firewall with fwtk and a DMZ

From: "Dirk.Nerling" <[email-masked]>
Date: Tue, 7 Mar 2000 15:47:38 +0100

[To be removed from this list send the message "unsubscribe fwtk-users" in the
BODY of a mail message to [email-masked].]

Hello all,

I'm running fwtk for years now and I'm quite happy with this. I did it in
the normal dual homed configuration but now I plan to install a DMZ. I read
all I found about a DMZ but unfortunately I still have some questions. The
firewall (FreeBSD 3.4) could be a 600Mhz, PIII with 256 MB and 3 x 100MB
NIC.

Here is the setup I plan:

 Internet / ISP with squid and NNTP Server
    |
    |        speed: some more than a T1 (2MB)
    |
 cisco (normal without firewall ios)
    |
    |
FW NIC1 with offical ip                             H -- www server   with
~5 virtuell domains, plans to install a shop system and portal (I'm afraid a
lot of traffic)
   (external DNS)                                      |   
       FWTK , smap, http-gw                      U -- one anonymous ftp
server and some private ftp servers (not too much traffic)
                                                               |
FW NIC2 with rfc 1918 ip -------DMZ --------  B -- squid for providing web
cache for my internal users (a lot of traffic)
                                                       
      sendmail, http-gw, ftp-gw, plug-gw for nntp to our isp  
FW NIC3 with other rfc 1988 ip

         |                                        
         |------------------ internal net with clients, internal dns,
internal mail server with subdomains ...

now my questions:

1. Gernell:
1.1  Will the firewall with FreeBSD and TIS have the power to serve all
requests (external: www with portal, webbrowsing from the internal net and
so on)
1.2. Should I run the external DNS really at the firewall, if so I'd like to
use chroot - or should/could I put them in the DMZ?
1.3  I often hear that people put thier mailserver in the DMZ, why? Isn't it
easier and more secure, to use smap external save the mail to disk and
deliever internal with sendmail?
1.3  I need to route mail for the virtuell domains also through the
firewall, do I need a sendmail.cf for each virtuell domain?

2. W3 related:
2.1. How do I setup virtuell webdomains, if the webserver have rfc 1918 ip's
(put all virtuell ip's on the FW NIC 1?)
2.2. Could http-gw  work with virtuell domains or could/should I use
plug-gw? 
2.3. Will http-gw be stable and quick enough to serve squid and my virtuell
domains and will this combination do what I want?
2.4. I also use the squid of my isp as a second cache - and I afraid this
wont work any longer because they need udp - right?
2.5 Is running squid at the firewall a problem - do I need to put them in
the DMZ?

3. ftp related:
3.1. I could use plug-gw to stream the external ftp connects to my internal
anonymous ftp server, but who about virtuell domains? 

Sorry to ask such dumb questions but I can't find answers at www.fwtk.org
nor at previous postings of the fwtk mailling list. Hope we could discuss
the problem and perhaps I'm able to write a DMZ part of the FAQ.

best regards and MANY thanks in advance!
Dirk Nerling
--
Dirk Nerling, PDV-Systeme Erfurt, Haarbergstr. 73, 99099 Erfurt, phone:
++49-361-4407144
           PGP Fingerprint: C559 FF0E BAD0 9E09 F720  20F3 683E 357F 69B5
CC83
				http://www.pdv.de

---

From: "Wes Szumera" <[email-masked]>
Date: Tue, 7 Mar 2000 11:30:41 -0500

Is anyone having a problem connecting to Daimler-Chrysler's spin 
system?  I had things working great until yesterday when they 
changed addresses.

Thanks, 

Wes Szumera

Netperm-table

tn3270:  port tn3270 10.31.14.* 10.31.11.*  -plug-to 208.154.80.148 
-port tn3270

C:\windows\hosts

10.31.11.49	wc3270.extra.daimlerchrysler.com
#10.31.11.49 address of proxy server internal interface

inetd.conf

tn3270  stream tcp      nowait root /usr/local/etc/plug-gw plug-gw 
tn3270

Wes Szumera                    

Plant Engineer           
Eagle Trim Inc.  
0829 US 131 NW
Kalkaska, MI  49646-0460

voice 231 258 4150 ext 3024
fax   231 258 4153

---

From: "Joseph Judge" <[email-masked]>
Date: Fri, 17 Mar 2000 18:24:19 -0500

All -

I've never run the FWTK with a 3rd "DMZ" LAN off of the
firewall/gateway. So, I'm pulling most of this from just
"gut feel"

Jump in and correct me where I'm wrong.

(read on ... comments in the original email message below)

> firewall (FreeBSD 3.4) could be a 600Mhz, PIII with 256 MB and 3 x 100MB

	A 600 MHz machine is quite zippy -- so I cannot imagine
	performance problems (in terms of CPU processing).

	If you have a lot of connections through an application
	proxy you have to consider the performance hit that will
	happen -- because the connection is being handled up at
	a higher level and because of the fork/exec overhead.

	If you are running a plug-gw or http-gw in daemon
	mode -- then the fork/exec issue is less of or not a
	problem.

	I often run a packet filtering device in front of my
	DMZs now. My web server/ftp server/dns servers are all
	on hardened machines -- and the packet filter screens
	out most packet-levle scariness. My main risks are now
	simply the services I let through (apache, netscape, bind,
	sshd)

> requests (external: www with portal, webbrowsing from the internal net and

	I would think so ... you have enough horsepower for more than
	the bandwidth you are serving.

> use chroot - or should/could I put them in the DMZ?

	Good idea to chroot() it -- most folks don't. I still
	run my DNS on the firewall ... but I really think I should
	have moved it over to a DMZ system by now. I've not done
	either -- should do one, or the other, or both.

> deliever internal with sendmail?

	Folks come from different backgrounds. I've run into folks that
	use FW-1 ... and _never_ heard of a firewall able to handle
	email transport (SMTP) !!! They were shocked when I argued that
	feature _has_ to be in the FW-1 somewhere ... and they found it.

	Politics: run smap/sendmail on the firewall, keep the internal
	IT folks (who like exchange) away from this sensitive function.

	Performance: high email load, you may wish to move it off to some
	DMZ mail-specific machine. This is especially true if you desire
	to add virus scanning to the function.

	Risk: sendmail is often a risk. Run qmail ... or run smap and
	only use sendmail as a transport off of the machine. Both
	reduce the risk significantly.  Same issue as DNS = if you run
	it on the firewall, you _are_ opening some amount of risk, so
	reduce it somehow (chroot bind, smap senmail).

> firewall, do I need a sendmail.cf for each virtuell domain?

	I don't remember the smap/smapd code now ... used to be able
	to configure it (with spam filters) to reject bad domains, etc.
	To do this, it required knowledge of "OK" domains. Also,
	newer sendmail versions all support configuration of the
	mail sendmail.cf -- that support multiple domains, masquerading,
	etc.

	Years ago, I had a "map" file for sendmail. This said that
	"foo.com	esmtp:insidemailserver.foo.com" and had mappings
	for other servers inside.

> (put all virtuell ip's on the FW NIC 1?)

	Put all virtual IPs on the front of the firewall ... pass
	through the connections to the web servers.  There were
	patches to plug-gw that would bind to specific IP addresses
	so that you could do this. Dunno the code anymore, assume its
	in there somewhere. (maybe http-gw?)

> 2.2. Could http-gw  work with virtuell domains or could/should I use
	Check above -- the trick you are looking for is the ability to
	have the proxy bind to a specific address.

> domains and will this combination do what I want?

	I always used plug-gw ... never used http-gw to front a web
	server.

> wont work any longer because they need udp - right?

	I don't know what you mean ... why would they need UDP?
	I assume the ISP cache is transparent ... so nothing you
	do at your end would bother it.

> 2.5 Is running squid at the firewall a problem - do I need to put them in

	As long as squid does not answer on the "outside" of the firewall,
	then I would worry less about the external risk. If the squid is
	maintained and system is watched, then I'd not worry - as much -
	about the inside risk.  I would worry about performance of
	heavy web usage slamming the gateway (it could).

> anonymous ftp server, but who about virtuell domains?

	FTP control channel could be plug'ed -- but the data channel
	would not be -- so you'd be stuck with no ability to list
	directories and transfer files.
	You _have_ to use an FTP proxy that is default forwarded to
	the real ftp site. Folks hit the firewall, login as "anonymous"
	and the ftp-proxy sends them to the right place.
	If you have it bind to specific IP addresses on the firewall,
	then you can run different ftp-gw's - one for each one behind
	the gateway.