Hello everyone, I'm looking at the best way so set up my VPN.

If I have multihomed firewall system with a DMZ (similar to the setup shown at www dot linuxjournal.com/article/4415), what is the best way to set up a VPN connection to my internal network?

The intuitive way would be to forward VPN traffic through the firewall to a VPN server on the internal net. However this seems to go against the whole DMZ philosophy.

The more correct way would be to have a VPN server running in the DMZ, but this would require some form of access to the internal network as well.

Ol;ong a similar line, is it more usual to open ssh access by ssh'ing to the DMZ and allowing a user to ssh from there to the internal network?


Thanks in advance.

Knowabit.

hi,

that is a nice article.
it really depends on many things including your routing and firewalling administration skill, and the most important : finance and electricity.

no not really. A DMZ not necessarily on a separate subnets than your internal - you can administer a bastion host using your firewalling skills - how a certain traffic from and to bastion host should not communicate with other host in the same subnet?

a DMZ best implementation is to have it on a separate subnet than your ordinary LAN - so it must route - from there you can define a better security parameter such as NAT or firewall rules etc.

SSH is only a protocol and operates in its own way - there are many other protocol that any applications need to operate in certain ways.

HTH.

But assume my DMZ is a different subnet from my internal LAN, the question remains, should my multihomed firewall route VPN traffic via the DMZ or directly to the internal network?

The other thought I had - does it make more sense to allocate a public IP just for vpn.mydomain.com, put a dedicated firewall there and port it straight through to the internal network? Then I could use the same IP for extenal ssh access.

What do people think?

Moved: This thread is more suitable in Linux Security and has been moved accordingly to help your thread/question get the exposure it deserves.

Just giving this a bump.