Re: server in DMZ

[Payal Rathod <payal-netfilter@scriptkitchen.com>]

On Wed, Sep 01, 2004 at 11:04:56PM -0400, Jason Opperisano wrote:
> i assume the squid proxy can already fetch content from the web server
> in the DMZ for your LAN--if this is not the case; please post your
> current rules:

Yes, it can access the DMZ using public IP right now. Now I want something
very simple, I want to allow only the client to access the machine.

> iptables -A FORWARD -i $extIf -o $dmzIf -p tcp --syn \
>   -s 1.2.3.4 --sport 1024:65535 -d 10.10.10.3 --dport 80 \
>   -j ACCEPT

Can you make this a bit simpler? I am not too worried about security of 
designs (no need for VPN). I just want only the client's IP to access it.
Right now I have,
-A PREROUTING -d 5.6.7.8 -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.10.10.3

5.6.7.8 is my external IP of the DMZ machine.

I am afraid if I give it as,
-A PREROUTING -s 1.2.3.4 -d 5.6.7.8 -p tcp -m tcp --dport 80 -j DNAT --to-destination 10.10.10.3

it will block access from my local LAN also via. the squid proxy and yes 
the gateway (squid proxy) machine does have 3 cards.

With warm regards,
-Payal