Re: different DMZs which is better?

[Athan <netfilter@miggy.org>]

[-- Attachment #1: Type: text/plain, Size: 1365 bytes --]

On Mon, Jan 13, 2003 at 02:15:34PM -0500, Mike wrote:
> I talked with my ISP and they will route me a /30 for my firewall and a /28
> for the DMZ segment. The DMZ will be hosting a webfarm does anyone have a
> list of things I should to the box besides filtering rules? like how I can
> stop directed broadcasts etc... I am going to accept Established and New
> connections in the forward chain going to the webservers and drop invalid.
> Is that ok for webservers or should I also accept related? Im only going to
> open up port 80 to the webservers and drop everything else.

  Are the web servers going to be setup to do reverse DNS lookups on
their connections?  Usually best not to, as it can be quite a
performance hit for busy servers, but bear this in mind for access rules
if restricting any part of the webspace by client host, as you'll only
be able to do that on IP.
  If you are allowing such reverse lookups then obviously the DMZ needs
to be able to access at least one DNS server, probably the firewall box
acting as a forwarder, or just plain doing the lookups itself.

-Ath
-- 
- Athanasius = Athanasius(at)miggy.org / http://www.miggy.org/
                  Finger athan(at)fysh.org for PGP key
	   "And it's me who is my enemy. Me who beats me up.
Me who makes the monsters. Me who strips my confidence." Paula Cole - ME

[-- Attachment #2: Type: application/pgp-signature, Size: 240 bytes --]