Simple firewall to contrall access between LAN and DMZ ??

Hi Experts,

All my external requests will coming to the DMZ from the firewall. And some of servers in the DMZ should access by the LAN users.

So I need some kind of open source, very simple access control tool to install in between DMZ and LAN and controll the access levels. (Windows or LINUX is ok)

Basically I need to restrict all inbound traffic from DMZ to LAN. (???) Only access from LAN to DMZ should be configured.

Please advise... and Thanks for your time !

Instant Access to this Solution

Plus...

30 Day FREE access, no risk, no obligation

Collaborate with the world's top tech experts

Unlimited access to our exclusive solution database

Never be left without tech help again

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

"The time we save is the biggest benefit of Experts Exchange to Warner Bros. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange." Mike Kapnisakis, Warner Bros.

"Our team likes having a resource that is more secure than just using Google and most experts using this service really know their stuff. It's nice to look here first versus using Google." Dayna Sellner, Lockheed Martin

"Anytime that I've been stumped with a problem, 9 out of 10 times Experts Exchange has either the accepted solution or an open discussion of the potential solution to the problem." Kenny Red, eBay Inc.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.

Screenshot of Experts Exchange Knowledgebase

Need individual assistance?

Our experts are ready to help.

If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.

Want to learn from the best?

Read articles from industry experts.

Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.

Working on a long term project?

Store your work and research.

Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.

Join the Community

Give a Little. Get a Lot.

Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.

My suggestion goes to using Linux. With it you can use the iptables firewall and do simple tasks as this one and as the need grows you can add more features to it. You will have finer control of what you allow and deny to go out / in of each zone.

I'm assuming you want something like this:
+----------+ +-------+ +------+
| Internet | ----> | DMZ | <------ | LAN |
+----------+ +-------+ +------+

You can add a linux server with two network interfaces to do this:
+----------+ +-----------+
| Internet | | DMZ / LAN |
+----------+ +-----------+
\ /
eth0\ /eth1
+----------+
| Firewall |
+----------+

Then you would have to define an IP range for your LAN and an IP range for your DMZ.
For instance you could have:
DMZ=200.200.200.0/24 -> one subnet of 255 IP's
LAN=200.200.201.0/20 -> plus 16 subnets of 4096 IP's

The server must have the network interfaces already configured with the correct IP for the networks they are in.
Then you could use the following commands (this is just a simple example):

#!/bin/bash
#can be different depending of your distro
#this value is from Debian
IPTABLES="/sbin/iptables" 
DMZ=200.200.200.0/24
LAN=200.200.201.0/20
WAN=0.0.0.0
 
#enable ipv4 forwarding, just in case it was not done before
echo "1" >/proc/sys/net/ipv4/ip_forward
 
 
$IPTABLES -F # flush all rules
$IPTABLES -X #delete all builtin chains
$IPTABLES -Z #zero byte and packet counters
#until now only resetting the iptables to a know state
 
#set default policies
#block all traffic
$IPTABLES -P INPUT DROP
$IPTABLES -P FORWARD DROP
 
#allow traffic to go from LAN to DMZ
$IPTABLES -A FORWARD --source $LAN --destination $DMZ -j ACCEPT 
#allow traffic to fo from LAN to WAN
#we want all users in LAN to connect to internet
$IPTABLES -A FORWARD --source $LAN --destination $WAN -j ACCEPT
#allow traffic to go from WAN to DMZ
#we only want folks in the internet to access our servers
$IPTABLES -A FORWARD --source $WAN --destination $DMZ -j ACCEPT
#allow the backwards connections that are part of already established
#streams to go through
$IPTABLES -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:

Select all Open in new window

Question

Simple firewall to contrall access between LAN and DMZ ??

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

IP Tables/IP Chains

Enterprise Firewalls

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Need individual assistance?

Our experts are ready to help.

Want to learn from the best?

Read articles from industry experts.

Working on a long term project?

Store your work and research.

What Makes Experts Exchange Unique?

Trusted by the world's most respected brands.

Faithfully serving IT professionals since 1996.

Related Solutions

Free Tech Articles

Cloud Class Webinars

Join the Community

Give a Little. Get a Lot.

Answers

3 Ways to Join

The Experts

The Experts

Testimonials

Testimonials

Testimonials

Business Clients

Business Clients

In the Press

In the Press

In the Press