<div dir="auto">The DMZ is a zone. One box or many. It is directly connected to internet and may or may not connect to the inside LAN. If it does, the firewall and routing is very, very specific. And, yes, firewall between big bad interwebs and DMZ.<div dir="auto"><br></div><div dir="auto">The inside, trusted LAN doesn't connect through DMZ network to outside. It connects to firewall/router and your internet demarcation line.</div><div dir="auto"><br></div><div dir="auto">So 3 nic Linux box. Nic 1 goes to internet, 2 is DMZ and 3 is private lan. Iptables on the box. LAN and DMZ are separate subnet with the box as their gateway. DMZ often has internet routable IPs. LAN usually does not and is NAT'ed. DMZ can be NAT'ed as well. If DMZ is not NAT'ed, nic 1 will need to in bridge mode.</div><div dir="auto"><br></div><div dir="auto">The terminally paranoid will add a second firewall box on the wire between nic 3 and the internal LAN.</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Mar 25, 2017 4:42 PM, "Scott Castaline" <<a href="mailto:skotchman@gmail.com">skotchman@gmail.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">So I would put the DMZ on the front or first LAN and then everything else on the back or second LAN? And also the DMZ is a single device and not the LAN itself? What if I have multiple DMZs on the first LAN can I do that?<br>
<br>
<br>
On 03/25/2017 12:30 AM, Alex Carver wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
On 2017-03-24 21:05, Scott Castaline wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Okay I've had the cable pulled in my house I was able to unbrick an<br>
older ASUS router which is running ASUSWRT-Merlin which has the radios<br>
shutoff for the access part of it. Many years ago I remember setting up<br>
several dual LANs, the first LAN was unsecured and all of the web facing<br>
gear was on that. Then a second router with LAN to LAN interfaces which<br>
connected to LAN 1 and LAN 2 was off of this router and was a secured<br>
network. I thought this what a DMZ was, but on google searching DMZ<br>
structure I'm finding that the DMZ is a single server by itself. The<br>
other thing that I'm finding is that the secured LAN is on LAN 1 and the<br>
DMZ is on LAN 2. That doesn't make sense to me.<br>
<br>
Can anyone enlighten me with what would be the correct way of doing this?<br>
<br>
<br>
</blockquote>
You can make up a DMZ using a three port router or you can daisy chain<br>
two routers with the link between them being the DMZ. Your LAN would<br>
hang off the back router farthest from the WAN.<br>
<br>
Either way you're just setting up a bunch of packet filter and routing<br>
rules. The advantage of the dual router approach is that it would<br>
theoretically be harder to break into your LAN because two routers would<br>
need to be compromised.<br>
<br>
A single router approach needs a router that can handle all traffic.<br>
The dual router approach only needs enough horsepower on the front<br>
router to handle the traffic. The back router, in theory, sees less<br>
traffic.<br>
______________________________<wbr>_________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org" target="_blank">Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" rel="noreferrer" target="_blank">http://mail.ale.org/mailman/li<wbr>stinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" rel="noreferrer" target="_blank">http://mail.ale.org/mailman/li<wbr>stinfo</a><br>
</blockquote>
<br>
-- <br>
Sent to you and NSA, CIA, FBI, SS, DHS and GOD only knows who the hell else...<br>
<br>
______________________________<wbr>_________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org" target="_blank">Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" rel="noreferrer" target="_blank">http://mail.ale.org/mailman/li<wbr>stinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" rel="noreferrer" target="_blank">http://mail.ale.org/mailman/li<wbr>stinfo</a><br>
</blockquote></div></div>