Subject: RE: Enhancing my firewall/gateway to add a DMZ
To: 'Carleton, Sam \(SCI TW\)' <Sam_Carleton_TW@stercomm.com>
From: Conrad T. Pino <Conrad@Pino.com>
List: netbsd-help
Date: 12/20/2002 10:47:23
> Does the IP address for the DMZ matter?

Yes.  Subnet numbers on all interfaces must be unique i.e. different.

> I am currently using 192.168.0.x on my internal network, can I simply
> use 192.168.1.x ...

Yes.

> or should I use the class A or class B address range?

Permissible if desired but not required.

> If so, why?

The subnet number of each interface must be unique for routing purposes.

> In my current firewall, I have not mucked with any routing to allow the
> clients to access the Internet.  I have only had to setup IPNat correctly.
> Will this change?

Only if any internal network and DMZ network hosts will communicate using
their respective untranslated addresses i.e. no NAT.  Use of untranslated
address may require enabling IP forwarding.

> Am I going to have to mess with the routing at all for the clients to
> access the Internet?  My guess is: no.

Clients don't need IP forwarding enabled.  Clients do need a default gateway
which must be the IP address of the firewall/gateway interface shared with
the client.

> Considering the DMZ is also going to need to be NATed, I assume that the
> same applies.  Correct?

The DMZ must bet NATed.  DMZ clients need default gateways.

> Routing:  I assume that I will have to setup some routing for the traffic
> to go from the Intranet to the DMZ.  How do I go about doing that from
both
> the command line and auto-magically when the firewall reboots?

Enabling IP forwarding works.

Auto-magically during reboot:  Add "net.inet.ip.forwarding=1" line to file
"/etc/sysctl.conf"

Command line: sysctl -w net.inet.ip.forwarding=1

> Does anyone have any advice on how to setup the ipfilter rules going to
the
> DMZ?

The IPF HOW-TO (http://www.obfuscation.org/ipf/) elaborates quite a bit.
Could you be more specific about what services you want to use?