Re: External Network / Firewall Setup.

[Michael Gale <michael.gale () bluesuperman com>]

Hello,

	I would use the mailserver as a relay / SPAM / AV filter only and keep 
the corp IMAP (assuming IMAP) on the internal network.

|
|
router
|
Swtich with management port for snort
|_____________
Firewall NIC1 |
(external)    |
              |_____
        Firewall NIC2 (DMZ)
              |
              |
Firewall NIC3 |
(internal)    |
---------------
|
Switch with management port for snort
|

I hope my drawing is understandable ...

A few other things I would personally do is not place snort on the 
external network, I find it would generate to many alarms. Causing them 
to be ignored.

What are you doing for web mail ? Because ideally you would place a web 
mail proxy on the DMZ allow authenticated users from external access to 
their mail box located on a internal server.

Michael



lists () ninjafriendly com wrote:
> Hi all,
>
> Background: We're a .sch.uk with a currently county-managed firewall and webmail
> provision.  We have a 2mb symmettric DSL connection with approx 30% use at any
> one time.  Due to service and reliability issues with the county-managed
> solution we are looking to run our own mailserver, accessible from the
> internet.  On balance, maintaining our own firewall setup is less hassle than
> keeping what we currently have.
>
> I'm currently in the process of working out the firewall requirements, what I
> have so far is this:
>
> Internet
> |
> Router
> |
> Firewall(1)
> |
> HUB---Snort(1)
> | |___Mailserver
> |
> Firewall(2)
> |
> HUB---Snort(2)
> |
> |
> LAN
>
> I suspect this setup may be overkill for the amount of traffic we receive, but
> I'm wary of a single point of failure.  Hardware isn't a problem.
>
> Further info: The mailserver will be running Horde.  I'm hoping to convince
> management to use a PIX or similar for the first firewall and then something
> *nix based for the second, otherwise it will be two *nix boxes (IPcop and
> something BSD based).
>
> Something I'm still unsure about is internal clients connecting to the
> mailserver in the DMZ - how much of a security issue is this?  Should I use the
> DMZ mailserver simply as a relay for an internal mailserver?
>
> Would anyone mind looking this over and telling me if I've screwed up /
> overlooked something?
>
> Thanks
>
> Pete