On Wednesday 20 November 2002 11:16, Paulo Abrantes wrote:
> Hello all,
>
> I have a small home LAN, about 7 computers, and finally
> I'm getting ADSL installed. Since I'm thinking in providing
> services, such as ssh and http, I'm considering to implement
> a DMZ. So I can leave those services in the DMZ, and leave
> my private LAN alone.
> What I have in mind is something like:
>
> Internet <- eth0 -> Gateway with NAT <- eth1 -> Switch for LAN
> <- eth2 -> DMZ
>
> My question is, if it is secure to get my gateway double legged, as
> shown.
There's nothing necessarily insecure about this method if where only looking
at the set up. It's common enough to do this.
> Or, should I get a 1st gateway that would NAT my DMZ and inside my DMZ,
> would just have another gateway that would provide NAT for my private
> LAN. This one seems more secure, since, if I get my 1st gateway
> cracked the attacker still has to discover and beat the 2nd one. Though,
> I do not see anymore advantages...
Presumably though, both systems would be configured similarly and patched up
(an ongoing thing of course!). In this case, if there was a vulnerability in
the first gateway, it would also be in the second gateway. You could
alleviate this by running different systems on each gateway, eg. linux and
bsd. This makes your life administering your set up harder though.
>
> Some thoughts and ideas on how should I really implement would be nice.
>
I would be inclined to do it the way you intended. If you set up your gateway
well, with good firewalling and regular patching, you should be safe from
most problems.
Security by obscurity is not something to rely on, but if no one is
interested in breaking your systems, no one will! By keeping your systems
well up to date (applying patches, checking vendor alerts etc.), and learning
as much as you can about configuring/securing your system, you will be in
good stead if someone does try and break in.
> Thanks,
>
> P. Abrantes
> ------------------------------------------------------------------------
> To unsubscribe email security-discuss-request@linuxsecurity.com
> with "unsubscribe" in the subject of the message.
------------------------------------------------------------------------
To unsubscribe email security-discuss-request@linuxsecurity.com
with "unsubscribe" in the subject of the message.
