1

I've been reading a lot of different Q&As on here and other forums about firewall positioning in relation to the DMZ and the appropriate place to put a VPN server. I've made the following logical diagram to describe what I think is a synthesis of what I've read. Can you please tell me if this design is feasible configuration and if not, where/why it's wrong?

enter image description here

In the diagram the filtering router is the edge firewall. It has two externally visible IP addresses. One splits DMZ and LAN traffic. The other IP is for the VPN server. DMZ traffic is forwarded from the filtering router by port to servers in the DMZ. Requests for unknown connections not in the DMZ are either forwarded to the NAT router where they are translated or dropped.

The VPN Server also does authentication and forwards to the NAT router if the external client successfully registers on the network.

The NAT router translates internal/external traffic requests. It allows traffic to the DMZ from 'PC VLAN' but not the 'internal server vlan' servers. It blocks traffic coming from the DMZ that did not originate from a server in the DMZ.

Does this seem like a logical configuration in terms of where things should be and what the firewalls can be relied upon to do? As an aside, when I look at this I think that the DMZ and the LAN seem to be two subnets as they both split one of the externally visible IPs to enable addressing. Is this the wrong way to think about this?

Improve this question
7
  • 2
    Currently, there's no firewall between DMZ and LAN - effectively making your DMZ part of the LAN.
    – Zac67 ♦
    Commented Mar 16, 2019 at 9:54
  • Thanks. The NAT router is a type of firewall. So it sits between the DMZ and LAN?
    – Jay Black
    Commented Mar 16, 2019 at 9:55
  • NAT by itself is not a firewall (function).
    – Zac67 ♦
    Commented Mar 16, 2019 at 9:57
  • Thanks @Zac67 My understanding is that the Firewall is embedded in NAT. Its internal configuration is the same as a filtering routers except the rule engine and router are replaced with a rule engine and NAT.
    – Jay Black
    Commented Mar 16, 2019 at 10:02
  • 2
    It's fine if it's a policy-based firewall also doing NAT. I was trying to point out that NAT alone doesn't provide proper protection.
    – Zac67 ♦
    Commented Mar 16, 2019 at 10:06

1 Answer 1

Reset to default
4

The potential problems I'm seeing:

  • The NAT router needs to be a proper firewall. Otherwise the LAN isn't protected against the DMZ.
  • For Internet access, NAT is applied before the edge firewall. Make sure you apply your Internet access policies on the NAT router already.
  • VPN clients shouldn't be NATed when accessing the LAN or DMZ (this isn't clear from the diagram).
  • As a proper firewall, the NAT router might be bottlenecking client-server traffic. Alternatively, a fast L3 switch with ACLs may be used.
  • Your firewall policies should be cleanly split between client access to the Internet and DMZ (on NAT router), and access from Internet to DMZ (on edge firewall).
Improve this answer
2
  • Thanks @Zac67. That's really helpful. Do you mean the VPN should be behind the NAT? I did consider this and then instead of having a filtering router, having an edge router with a firewall doing NAT and making the DMZ and LAN two subnets.
    – Jay Black
    Commented Mar 16, 2019 at 11:41
  • 1
    For the connections VPN-servers, LAN-DMZ, PC-servers, VPN-DMZ you should disable source NAT on "NAT router". Alternatively, you could place a NAT router (without firewall) in front of your whole network (as the public-private demarcation line) and a combined firewall behind it (between the different trust zones).
    – Zac67 ♦
    Commented Mar 16, 2019 at 12:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.