DMZ security

[theresatan]

Hi guys,

We have a server1 on domainA is a DMZ, and server2 on domainB is inside the firewall.

DomainA trusts domainB but domainB does not trust domainA.

Can firewall make a rule -- "server2 trusts server1 only"?

Someone told me it is not possible since it will make all computer at the same Lan
with server2 will trust server1, does that correct?

Any input appreciated.....

Theresa

 

[Piloria]

The Firewall is there to control network trafic. so can be set to allow or disalow trafic between servers in different networks.
Trusts between servers is outwith their control all they can do is allow/disallow connections between servers. you can specify that a connection can only be established from one server only to the other and not the otherway.

using port 1433 (which would neet to be set up)
Source Destination service action
server2 - server 1 - port1433 service - allow

 

[theresatan]

Piloria:

Thanks for your response.

Now I have more clear on the concept of firewall trafic.

But I realy want to know is:
Can firewall make a rule -- "Allow connection tracfit from server2(inside firewall) to server1(DMZ) only"?

Thank you!

Theresa

 

[Piloria]

depending on what you are spacificly trying to achive. if you want to only allow one directional trafic but dont mind what the trafic is then a pair of rules will guarentee it

Source Destination service action
server2 - server 1 - any - allow
Server1 - server 2 - any - reject


if you spacificly know the type of trafic or the port numbers that will be used then change the "any" service on the 1st rule to a service with that port number (or create a new service with the port number, it will tell you if there is an existing service )

 

[theresatan]

Piloria:

Thanks again for your response.

I just want to make sure my understanding is correct:

Following rule is acceptable:

Source Destination service action
server2 - server 1 - any - allow
Server1 - server 2 - any - allow
others - server 1 - any - reject(new added)
Server1 - others - any - allow (new added)

(I changed the 'reject' to 'allow' on second line and add two more.

others--All computers in the same LAN connected with server2 but excluding server2)

Open trafict connection between two servers that there is a firewall between them will affect these two servers only, it will not affect the other computers in the same LAN connect with the server which is inside the firewall.

Thank you Very much!

Theresa

 

[Piloria]

That should be fine

The firewall shouldnt affect machines on a local lan from communicating with each other.
only when a machine is going outside the lan (or subnet mask restrictions) and then routed through the firewall will the firewall be able to affect it.

 

[theresatan]

Piloria:

Thank you very much!

Theresa