DMZ, VPN Client, Routing, FW

Also I would like just allow specific services from LAN to DMZ and DMZ to LAN, do I have to create a Rule like DMZ to LAN Block all, and add a separate Rule after like DMZ to LAN https, http ??

Thanks a Lot!

Sally

Also I would like just allow specific services from LAN to DMZ and DMZ to LAN, do I have to create a Rule like DMZ to LAN Block all, and add a separate Rule after like DMZ to LAN https, http ??

- No, by default all traffic is blocked unless you specifically allow it, so you don't need a block rule and then an allow rule, just the allow rule will suffice. However when you are using web filtering then http(s) traffic will be handled by the web filter and not by the firewall, so you may need to make adjustments in web filtering config if you want to prohibit certain http(s) targets to be reachable from other subnets.

Hi Apijnappels,

thanks for the information. As the UTM can not act as VPN Client yet, I would like to use my second router to accomplish the following:

- Router in the DMZ 

- Router connect to an external OpenVPN Server

- Specific Traffic for example Internet traffic Requests should be routed over the VPN Tunnel

- VPN Tunnel terminate in the DMZ, so Traffic will be filtered by the UTM from DMZ to the LAN Network

Any advice how to accomplish this?

Thx

Sally

You will need to make sure that all required subnets are configured in the VPN tunnel (DMZ, LAN, Remote subnet(s)). Then in the UTM I think you need to create static routes where you route the required traffic from LAN to the router in DMZ (who in turn should send it into the tunnel).

Thanks, this means I have to add a Interface or a Gateway Route in this case? Do I have to add beside the Masquerading Rule also a NAT Rule to get this work? 

Thx

Sally

Thanks, this means I have to add a Interface or a Gateway Route in this case? Do I have to add beside the Masquerading Rule also a NAT Rule to get this work? 

Thx

Sally

DMZ Configuration is:

10.0.0.1 /8 "no Gateway"

DMZ Router:

10.0.0.2

255.0.0.0

GW: 10.0.0.1

DNS: 10.0.0.1

VPN Connection with the other side is established, but no traffic is going over the tunnel till yet.

Getting from the VPN Site the following Subnet Config:

Local Address: 172.21.28.71
Remote Address: 172.21.28.71

Do I have to add the Remote Subnet also to the UTM??

Thx

Sally

This is difficult to follow because there's no diagram and there are so many questions.

The one thing I would recommend is NOT using 10.0.0.0/8.  That will conflict with all of the "VPN Pool" Network objects and possibly with your ISP.  Subnets in 10.0.0.0/8 should only be used by very large organizations and ISPs.  Subnets in 192.168.0.0/16 should be reserved for home networks and public hotspots not behind a UTM.  Most UTM admins should use private subnets in 172.16.0.0/12.

Cheers - Bob