Solved

Creating a DMZ on TMG 2010

Posted on 2012-03-26
3
2,657 Views
Last Modified: 2012-08-14
We are planning to host an Ubunto BigBlueButton web-conferencing server on our network.
 To make it more secure, I am planning to create a DMZ on TMG 2010 and place it in there before publishing it to the internet.
 
I have a virtualised TEST environment (Hyper-V) and have so far:
 * added a new NIC (DMZ)
 * using the wizard, created a three leg perimeter network
 * gave the DMZ a new subnet address
 * added a new access rule to allow DNS, NTP and other protocols to pass between the    
    DMZ and internal network > I chose to route traffice between the two networks
 * added a web-server to the DMZ
 * connected the physical Internal NIC and the DMZ NIC to a small switch (I will create a
    virtual connection later)
 
 
Here is some IP address information:
 Internal network (LAN):192.168.51.0
 DMZ: 192.168.52.0
 Web-server inside the DMZ: 192.168.52.1 (DNS: 192.168.51.1)
 

Questions:
 1) The web-server is now completely isolated; it cannot access the internet or even ping the DMZ NIC (192.168.52.254) - what other rules do I need to setup for the DMZ so that the web-server is accessible from both the internal network and the internet?
 2) As I understand it the access rule shouldn't be bi-directional; only the internal network should have (full ?) access to the web-server. However, aren't TMG rules bi-directional?
 3) Should traffice between the DMZ and internal networks be routed or NAT'd?
 4) Should I point the wen-servers IP address to a public IP address or keep the private DMZ IP address (192.168.52.1)?
 5) What should the gateway be on the web-server? I have pointed it to the address of the TMG server (192.168.51.254).
 

Many thanks!
0
Comment
Question by:mark-199
  • 2
3 Comments
 
LVL 51

Accepted Solution

by:
Keith Alabaster earned 500 total points
ID: 37767501
1. You tell me - what do you want it to do

2. Wrong. If the relationship is route (rather than NAT) only outbound and return traffic is allowed back to the initiating system. If traffic needs to be initiated from either element then traffic must be specifically allowed in both directions.

3. Route is best for internal to DMZ
From dmz to extrnal should be NAT
From internal to external should be NAT

4. Web server should be private IP. The external firewall/router will be responsible for forwarding traffic to the TMG external nic. On TMG you will have published the service and in the publishing ruule you will provide the internal ip address of the dmz server.

5. gw of dmz server will be dmz ip address of TMG
0
 

Author Closing Comment

by:mark-199
ID: 37795575
Thank you for your reply- this has helped me understand things better.
0
 
LVL 51

Expert Comment

by:Keith Alabaster
ID: 37795597
Welcome :)
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

My previous article  (http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/Windows_Server_2008/A_4466-A-beginners-guide-to-installing-SCCM2007-on-Windows-2008-R2-Server.html)detailed one possible method to get SCCM 2007 installed an…
Some time ago I faced the need to use a uniform folder structure that spanned across numerous sites of an enterprise to be used as a common repository for the Software packages of the Configuration Manager 2007 infrastructure. Because the procedu…
In an interesting question (https://www.experts-exchange.com/questions/29008360/) here at Experts Exchange, a member asked how to split a single image into multiple images. The primary usage for this is to place many photographs on a flatbed scanner…
How to Install VMware Tools in Red Hat Enterprise Linux 6.4 (RHEL 6.4) Step-by-Step Tutorial

756 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question