DMZ to inside

[bobm10]

If I do the following, will machines in DMZ1 have port 80 access to machines in the inside or just on the outside?

nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz1 security50
access-list In_dmz1 permit tcp any any eq www
access-group In_dmz1 in interface dmz1

Now if I add the static below will the DMZ now have access to the inside?

static (inside,dmz1) 192.168.1.0 192.168.1.0 netmask 255.255.255.0 0 0

Thanks Bob

 

[dozier]

Just the inside, because there's no translation for going to the outside interface. Also, to go from the dmz1 to outside, the translation entry would be all that's required since the source interface is a higher security level than destination interface.

But, you're kind of defeating the purpose of having a firewall if you're just going to allow any tcp connection from a lower security interface to a higher one.