passing traffic from dmz to outside interface

[spillo3000]

this is my configuration



PIX Version 6.1(4)
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif ethernet2 dmz security50
enable password iuhguiuhjhhh encrypted
passwd oy8guygyogyg encrypted
hostname lab-fw
domain-name labcisco.uk
fixup protocol ftp 21
fixup protocol http 80
fixup protocol h323 1720
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol sip 5060
fixup protocol skinny 2000
no names
access-list dmz-in permit icmp any any
access-list dmz-in permit tcp any any
access-list dmz-in permit udp any any
access-list dmz-in permit ip any any
access-list inside-in permit tcp host a.b.c.z a.b.d.0 255.255.255.0 eq 3389
access-list inside-in permit tcp host a.b.c.z a.b.d.0 255.255.255.0 eq 139
access-list inside-in permit tcp host a.b.c.z a.b.d.0 255.255.255.0 eq telnet
access-list inside-in permit tcp host a.b.c.z a.b.d.0 255.255.255.0 eq 445
access-list inside-in permit udp host a.b.c.z a.b.d.0 255.255.255.0 eq netbios-ns
access-list inside-in permit udp host a.b.c.z a.b.d.0 255.255.255.0 eq netbios-dgm
access-list inside-in deny tcp any a.b.d.0 255.255.255.0
access-list inside-in deny udp any a.b.d.0 255.255.255.0
access-list inside-in permit tcp any any
access-list inside-in permit udp any any
access-list inside-in permit icmp any any
pager lines 24
logging on
logging trap debugging
logging host dmz a.b.d.x
interface ethernet0 auto
interface ethernet1 auto
interface ethernet2 auto
mtu outside 1500
mtu inside 1500
mtu dmz 1500
ip address outside a.b.y.10 255.255.255.252
ip address inside a.b.c.1 255.255.255.0
ip address dmz a.b.d.1 255.255.255.0
ip audit info action alarm
ip audit attack action alarm
no failover
failover timeout 0:00:00
failover poll 15
failover ip address outside 0.0.0.0
failover ip address inside 0.0.0.0
failover ip address dmz 0.0.0.0
pdm history enable
arp timeout 14400
nat (inside) 0 a.b.c.0 255.255.255.0 0 0
static (inside,dmz) a.b.c.0 a.b.c.0 netmask 255.255.255.0 0 0
access-group inside-in in interface inside
access-group dmz-in in interface dmz
conduit permit icmp any any
conduit permit tcp a.b.c.0 255.255.255.0 range 0 65535 a.b.y.f 255.255.255.252
conduit permit udp a.b.c.0 255.255.255.0 range 0 65535 a.b.y.f 255.255.255.252
conduit permit tcp a.b.d.0 255.255.255.0 range 0 65535 a.b.y.f 255.255.255.252
conduit permit udp a.b.d.0 255.255.255.0 range 0 65535 a.b.y.f 255.255.255.252
route outside 0.0.0.0 0.0.0.0 a.b.y.g 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h323 0:05:00 si
p 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server RADIUS protocol radius
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
floodguard enable
no sysopt route dnat
telnet timeout 60
ssh timeout 5
terminal width 80
Cryptochecksum:dfgdgdgdgdwgewgewgefgregfeg#



how can i passing traffic from dmz interface to outside interface
and block traffic from outside interface to inside and dmz ?
i must add nat (dmz) o a.b.d.0 255.255.255.0 0 0 (for bypass nat)
and in the second time i must convert all conduit command and add access-list ?what do you think ?

 

[NetworkGhost]

Get rid of the conduits.

Add your nat rule to you DMZ int. By Default Pix wont let any incoming traffic to the DMZ or Inside Int unless you specify.

Your ACL:

access-list inside-in permit tcp host a.b.c.z a.b.d.0 255.255.255.0 eq 3389
access-list inside-in permit tcp host a.b.c.z a.b.d.0 255.255.255.0 eq 139
access-list inside-in permit tcp host a.b.c.z a.b.d.0 255.255.255.0 eq telnet
access-list inside-in permit tcp host a.b.c.z a.b.d.0 255.255.255.0 eq 445
access-list inside-in permit udp host a.b.c.z a.b.d.0 255.255.255.0 eq netbios-ns
access-list inside-in permit udp host a.b.c.z a.b.d.0 255.255.255.0 eq netbios-dgm
access-list inside-in deny tcp any a.b.d.0 255.255.255.0
access-list inside-in deny udp any a.b.d.0 255.255.255.0
access-list inside-in permit tcp any any
access-list inside-in permit udp any any
access-list inside-in permit icmp any any

could be just

access-list inside-in permit tcp any any
access-list inside-in permit udp any any
access-list inside-in permit icmp any any

The other lines arent necessary. Just keep in mind that having an open outbound policy isnt always best either.
Do the above and you should be good to go.

 

[spillo3000]

if i leave ..
access-list inside-in permit tcp any any
access-list inside-in permit udp any any
access-list inside-in permit icmp any any
i permit the access of all my inside host to my server in dmz.....my problem is permit the access of my dmz host to outside network, and blocking the access of my outside host to inside and dmz network...

 

[NetworkGhost]

Thats not how those acl's work. The Pix WILL NOT allow access from the outside interface to the inside or DMZ unless there is a specifice rule allowing that access and a translation applied to the external interface. Thats what your interface security levels are for. 0 -- Outside, 50 or some number between 1 - 99 for your DMZ and 100 for your inside interface. Any interface with the higher number can access a interface with a lower number. For traffic to go backwards there has to be an ACL on the lower number interface. You can limit your DMZ interface access by modifying the DMZ acl: Narrow it down to ports above the deny statement
Example:

access-list dmz-in permit tcp any any 53
access-list dmz-in deny IP (dmz src net IP) (inside dest net IP)
access-list dmz-in permit icmp any any
access-list dmz-in permit tcp any any
access-list dmz-in permit udp any any
access-list dmz-in permit ip any any