How Do I Test A 'DMZ' Firewall ?.

[tickmike]

I have just built a new 'Smoothwall box' with a DMZ for my home network and NAS http://www.edugeek.net/forums/nix/97339-home-nas-raid1.html#post854030.

 

 

 

I have a set of private IP address's and have my router set up for 'non nating' this feeds the smoothie box, a 'green' out for my home network, 'purple' for 'wifi' and 'orange' for DMZ

 

Any advice please, I need some advice on testing the DMZ and any setting up for a secure connection as I have not used one before.

[twin--turbo]

Secure connection from what to what?

 

What's in the DMZ?

 

If your not using NAT, are you just using the smoothwall for proxying?

 

Do you have a static public external IP?

 

not sure what all the colours are about

 

Rob

[Guest Guest]

Colours are basically just as easy way to remember what each interface is for. Red = bad = WAN. Green = good = LAN...

 

To test just go to your PC in the DMZ and try to access your LAN. Unless you have specified a rule allowing access on a certain port/IP you should not be able to get to anything on your LAN.

 

I've used Smoothwall at home for years. Unless you have been a complete tool there is little to worry about, smoothwall is pretty foul proof in it's basic setup.

 

Don't know what you mean by a secure connection though. Do you mean what ports do you open to access your DMZ from your LAN and visa versa? Well that depends on what services you are running. Heres a list of default ports, you will probably want SMB for windows shares and http/https for www

http://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xml

Edited July 14, 2012 by Guest

[tickmike]

Thanks for your help.

 

Re..."Secure connection from what to what?" The main aim is to have an automatic backup system for my daughters laptop when she goes to uni in September (see link in first post), so it will be a ssh connection over the internet from her laptop via my static IP address via smoothwall DMZ to the backup server.

 

This is all Linux set up .

 

On smoothwall box is installed as 'half open', I'm not sure about the DMZ will it block everything until I open one port for my ssh connection ?.

 

Instead of using port 22 for ssh I was going to use a higher number (thanks for list link), now if I pick a higher number must it be one that no one else use's ?.

 

Is it a good idea just to use the backup server in the DMZ just for the sole purpose of holding my daughters laptop backup or can I use it as you say with a port open from my Lan so I can store backups off our home computers ?, or will that be a security problem.?

[Blue_Cookeh]

I'd just stick a Linux box on the LAN side, move SSH to a port like 2233 and NAT it. So long as the SSH password is strong, you shouldn't even have a problem on default port 22, but I like to move it just in case.

[twin--turbo]

Do you have a static IP?

 

I always move SSH of port 22 for machines on the internet, best achived with port translation on the firewall.

 

What are you going to use for the actual backup? You need something that does not do a full backup but versioning of some sort.

 

Rob

[tickmike]

re, "Do you have a static IP?" Yes see post 1 and 4 above !.

 

re, "What are you going to use for the actual backup?" luckyBackup - backup and sync utility which is the GUI for 'rsync'