ipfw - accessing DMZ from LAN

[Chuck Swiger]

On Aug 9, 2011, at 6:15 AM, Marek Salwerowicz wrote:
>> It's not working because you configured natd to work against traffic flowing via vr3, but traffic from your LAN is coming via vr0.  While you can change natd to run against all traffic, it's much better to avoid re-writing purely internal traffic by setting up a DNS view for your machines in the DMZ which uses internal IPs rather than the public IPs.
> 
> So should I allow trafic from LAN to DMZ and setup my local DNS to connect to hosts in DMZ using private IPs ?

Yes, that ought to work fine.

In fact, in the classic screened-subnet design from which the notion of DMZ hosts originated, you only permitted traffic from LAN to DMZ, and blocked all traffic from outside to LAN.  This meant that all LAN hosts needed to go through proxies or other services living in the DMZ-- internal hosts never talk to strangers, so to speak.  :)

>> Or, if you insist upon your DMZ hosts being on externally routable IPs, then go ahead and configure them with externally routable IPs rather than using natd's redirect_address, and only do NAT for internal traffic via vr0 instead.
> 
> Am I able to configure them with externally IPs only and having eg. bandwidth control using only one router?
> 
> My current setup is that I have separately router, web server and mail server but If I want to limit bandwidth, I have to do it on proper machine instead of configuring only one device.

dummynet (or Altq, or whatever else you might be using) works fine with pure routing config, yes-- you don't have to NAT traffic to do bandwidth control on the router.

Regards,
-- 
-Chuck