Skip to main content
time4pj
time4pj
Explorer
August 21, 2021
Solved

Newbie Design Question

  • August 21, 2021
  • 1 reply
  • 2755 views

Hi,

 

My area of technology is not security, but I have a project that I'm working on at home and I purchased a used Fortigate 60D which I have registered.  On Port 7, I have a WAP with DHCP serving my basic household needs and that is great.  

 

I would like to ask for general guidance on designing a specific, but common, setup.  I have three (3) computers that I want to use.  Computers 1 and 2 are Internet facing specifically using ports 443, 6000, 3001.  The third (3) data server needs to be shielded from external access by the web, but communicate on the subnet via port 3000 to Computers 1 & 2.

 

The first question I have is: Do I use the DMZ with port forwarding for Computers 1 & 2?  Can you suggest a general plan of attack for this design?

 

The second question I have is: Prior to my own hardware, I use AWS with private and public IPs.  I was successful with AW$, but I don't know how to mimic this.  I've just started the Fortinet trainings and will eventually get to the point I want to be, but it will take a while for me to get there.

 

Thank you in advance for any guidance.

 

    Best answer by ede_pfau

    Hi,

     

    yes, if you need to expose servers to the internet, a DMZ is the way to go. A DMZ is a network segment which potentially hosts hacked devices, so one golden rule is that there are no policies allowing traffic from the DMZ into the LAN.This could be tricky for, e.g., SMB traffic. The communication should work like the data is pulled from LAN, not pushed from DMZ - for policies, the session initiator determines the direction.

     

    Still, servers could be compromised to, for instance, send out SPAM mails. So, even policies allowing internet-bound traffic from the DMZ should be chosen very, very carefully. Open ports are what they are looking for, every single second. Use AV, and especially IPS to protect your servers, and even rate-limiting IPS to guard against abuse.

     

    The technical way to get a host to be accessible from the internet is destination NAT (DNAT). In FortiOS, this is done via 'VIP's. This is a translation rule to replace the destination 'your public WAN IP' to '192.168.x.y' on your DMZ. Again, only an example, internal addresses usually are from a private address range. After creating the VIP, you need to use it in an inbound policy, as the destination address object.

    You will find all of this in the Handbook for sure.

     

    In your case, you would not only forward all traffic for that public address to the internal server (singular!). Instead, you would at the same time translate the destination port as well, so called port-translation. This way, you can target different servers via the same public address, using different ports.

     

    1 reply

    ede_pfau
    SuperUser
    ede_pfauAnswer
    SuperUser
    August 22, 2021

    Hi,

     

    yes, if you need to expose servers to the internet, a DMZ is the way to go. A DMZ is a network segment which potentially hosts hacked devices, so one golden rule is that there are no policies allowing traffic from the DMZ into the LAN.This could be tricky for, e.g., SMB traffic. The communication should work like the data is pulled from LAN, not pushed from DMZ - for policies, the session initiator determines the direction.

     

    Still, servers could be compromised to, for instance, send out SPAM mails. So, even policies allowing internet-bound traffic from the DMZ should be chosen very, very carefully. Open ports are what they are looking for, every single second. Use AV, and especially IPS to protect your servers, and even rate-limiting IPS to guard against abuse.

     

    The technical way to get a host to be accessible from the internet is destination NAT (DNAT). In FortiOS, this is done via 'VIP's. This is a translation rule to replace the destination 'your public WAN IP' to '192.168.x.y' on your DMZ. Again, only an example, internal addresses usually are from a private address range. After creating the VIP, you need to use it in an inbound policy, as the destination address object.

    You will find all of this in the Handbook for sure.

     

    In your case, you would not only forward all traffic for that public address to the internal server (singular!). Instead, you would at the same time translate the destination port as well, so called port-translation. This way, you can target different servers via the same public address, using different ports.

     

    time4pj
    time4pjAuthor
    Explorer
    August 22, 2021

    Hi Ede,

     

    This is very helpful.  I understand the concepts and will continue to study to implement this.  I have two Internet facing relays in case one is hacked, and may add a third relay that is not listed publicly.  

     

    Thank you,

    t4pj

    Terms & ConditionsAccessibility statement