Re: best way to have an external firewall (not simple firewall)

[Chuck Yerkes <chuck+obsd@2004.snew.com>]

Quoting joe angth (joeangth@yahoo.com):
> hello all, i am trying to set up an external firewall,
> and i'm asking the best advice on how to do it.
> 
> Network config:
> 
> Internet -> ext-fw -> switch -> int-fw -> switch ->
> int
>                         ->server1
>                         ->server2
>                         ->etc
> 
> My question is this, is it easier/better to have
> ext-fw just be a firewalling bridge, or should i play
> with the routes and have it actually act like a
> router?, ie, pass all packets for everything else
> through, and then have it act as a gateway for all the
> servers and int network?

Pretty much that would depend on your environment, skills,
staff and needs. 

Common is a single bastion host with 3 (or more) interfaces,
(in/out/DMZ0[/dmz1[/dmz2]]).

We use a classic cheswick/bellovin DMZ, but we have 8 DMZs
with 50 machines and 20k employees.

Net -> router -> FW -> router -> FW2 -> internal networks
                 |->DMZ1
                 |->DMZ2
                 etc.