This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

DMZ - Multiple Webservers

We want create a DMZ for some HTTP/FTP servers; this our planned configuration:

eth0     Internet    XX.XX.38.19  Fixed IP Connected to DSL Router
eth1     LAN           192.168.150.0
eth2     DMZ          172.16.1.1         Connected to  seperate    SwitchDMZ

DMZ Servers:

Webserver 1      172.16.1.2   /   XX.XX.38.21
Webserver 2      172.16.1.3   /   XX.XX.38.18
FTPserver 1       172.16.1.4   /   XX.XX.38.17

We tried a lot of things to get it working but until now we haven't. We used the Astaro documentation for DNAT/SNAT webservers (only documentation for 1 webserver) and we looked into this forum.
Can someone give us the appropiate steps to set this up?

This thread was automatically locked due to age.

0 KKnecht over 21 years ago

1.) Create 6 definitions under \Definitions\Networks

Webserver1_int 172.16.1.2
Webserver1_ext  XX.XX.38.21
Webserver2_int 172.16.1.3
Webserver2_ext  XX.XX.38.18
FTPserver1_int 172.16.1.4
FTPserver1_ext XX.XX.38.17

2) Go to the NAT section
Create a DNAT rule like
Destination adress: Webserver1_ext
Change destination to: Webserver1_int
Do this for all three servers.
Do either one translation for all services or one for each service you need (example: HTTP/HTTPS)

3.) Go to PacketFilterRules
and add rules depending on the services you want, example:
Source: Any
Service HTTP
Destination: Webserver1_ int

Action: Allow
You could activate logging on this rule for testing purposes. In the filter live log you can see the traffic in green colour.

4.) Check from an external PC by the official name (if you already setup DNS properly) or typing the IP adress.

That's it

Good luck,
Karsten
Cancel
Vote Up 0 Vote Down

Cancel