I am evaluating the astaro package for my company. As part of my evaluation, I have set it up at home. I'm having issues with the configuration and the docs I've read nor my previous firewall experience seems to help.
My home network is rather complex from the average home user. I have a DHCP cable modem for my internet connection. My old firewall solution has four interfaces:
External - connected to the cable modem
DMZ - Connected to a VLAN on a Cisco switch
Sandbox - Connected to a separate VLAN on a Cisco Switch
Internal - Connected to VLAN1 and where my "inside" machines are connected.
My current configuration completely segregates the Internal, Sandbox and DMZ from each other, except for what I've specifically allowed to pass.
I use the sandbox VLAN when working on a friends machine or any unknown machine. This allows me to have internet access, but protects anything I have on the inside as well as the DMZ.
The DMZ is similiar to the sandbox vlan, except that there are ports forwarded to the DMZ from the outside network.
In trying to emulate this configuration is where I'm running into issues.
To start with, I have one NAT defined, which is Inside -> Outside. That's it. I figured I'd start simple.
In my packet filter I initially had Inside (network) -> Any -> Outside network. This configuratation seemed to work fine, except I cannot get to HTTPS sites like my bank or my company's mail server. The only way I can establish HTTPS is to change the destination to Any. And doing that then allows inside machines to access the DMZ and Sandbox directly.
What I can't get my head around is the fact that I've specifically said that the Inside can use any protocol to the Outside, but HTTPS doesn't work. When I say Inside -> Any -> Any it does. Thinking perhaps the destination was wrong (network vs. address) I've played around with those, but no go.
Oh yeah, when I don't configure Any on the destination for the internal rule, I also loose DNS ability from my Win2k3 AD controller as well as the ability to use my Cisco 3002 VPN hardware client.
Why is this? How can I emulate the network that I have setup with my current firewall? Is there a better option to use for the destination besides Outside address or network instead of Any?
Any help is appreciated.
This thread was automatically locked due to age.