Re: [fw-wiz] PIX access-list help



On Dec 25, 2007 12:25 AM, Paul Melson <pmelson@xxxxxxxxx> wrote:
On Dec 21, 2007 11:02 AM, Brian Blater <brb.lists@xxxxxxxxx> wrote:
So, my main question, is there an access list command I can have that
basically says "allow all communication from the dmz to the internet"
and one that says "allow communication from the inside to the dmz"? I
know I can add "access-list dmz permit ip host 192.168.1.1 any" and
that solves the problem of getting to the internet, but then it opens
all communication to the inside from this host and I don't want to do
that. Since this is version 6.3(3) I can't use an out access-list
which I think might solve the problem. I have enough memory to run
version 7.x on this PIX, but I'm trying to tackle one problem at a
time and I'm a little hesitant about doing the 7.x upgrade just yet.

The short answer to your question is that PIX access-lists are read,
per-interface, top-to-bottom:

access-list dmz_in deny ip 192.168.1.0 255.255.255.0 10.0.0.0 255.0.0.0
access-list dmz_in permit ip 192.168.1.0 255.255.255.0 any
access-group dmz_in in interface dmz

If your internal network is 10.0.0.0/8 and your DMZ is 192.168.1.0/24,
this will prevent traffic from the DMZ to the inside, but allow
everything else.

PaulM

Ok, I think I understand this a little better now. Say my private
network is 192.168.1.0/24 and my dmz is 192.168.2.0/24. I already have
the static (inside,dmz) 192.168.1.0 192.168.1.0 netmask 255.255.255.0
which is required in 6.3(3). So, in order to make this work i.e the
inside network has access to everything on the dmz network and the dmz
network can access the internet and I only allow specific
communication from the dmz to the inside I need to do the following:

access-list dmz permit udp host 192.168.2.2 host 192.168.1.202 eq domain
access-list dmz permit tcp host 192.168.2.2 host 192.168.1.203 eq smtp
access-list dmz deny ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list dmz permit ip 192.168.2.0 255.255.255.0 any

I will also need to add the nonat statements as was suggested by Brandon:

access-list nonat permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list nonat permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0
nat 0 (inside) access-list nonat
nat 0 (dmz) access-list nonat

My only concern here is the 3rd line in the dmz access-list and
whether it will deny communication from the inside network to the dmz
(except dns and smtp), but I will test that when I get home tonight.

Thank you for everyone's help.

Brian
_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxxxxx
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards



Relevant Pages

  • Re: [fw-wiz] PIX access-list help
    ... if you want access to the internet to from any interface you need to ... outside, inside, dmz. ... dmz can talk to the internet just fine and the inside can talk to the ... inside mail server I no longer have communication to the internet from ...
    (Firewall-Wizards)
  • Re: [fw-wiz] PIX access-list help
    ... access-list dmz permit ip any ... host 192.168.1.1 from going to the inside host 10.10.10.10. ... dmz can talk to the internet just fine and the inside can talk to the ... inside mail server I no longer have communication to the internet from ...
    (Firewall-Wizards)
  • Re: [fw-wiz] firewall-wizards Digest, Vol 20, Issue 13
    ... May I ask why you are going to the inside for the internet access for your dmz? ... access-list nonat permit tcp host 192.168.2.1 192.168.1.1 eq 3389 ... access-list dmz permit tcp host 192.168.2.1 192.168.1.1 eq 3389 ... many companies deny traffic out from the inside network ...
    (Firewall-Wizards)
  • Re: [fw-wiz] PIX access-list help
    ... basically says "allow all communication from the dmz to the internet" ... The short answer to your question is that PIX access-lists are read, ...
    (Firewall-Wizards)
  • [fw-wiz] PIX access-list help
    ... I'm a little befuddled with PIX access lists and need some help and ... outside, inside, dmz. ... inside mail server I no longer have communication to the internet from ...
    (Firewall-Wizards)