Hi everyone,

Let's say I have a few hosts on the same subnet, and they are all connected to a central Linux box running a filtering bridge. If I tightly control the communications between the hosts using the filtering bridge, is this just as good as seperating hosts into different subnets (e.g. DMZ and Internal) ?

Thanks

It certainly can be and it can actually be better since you would still be able to see traffic even if they are different subnets if you aren't actively filtering it out anyway

How tightly are we talking here? If you can deny host A from communicating to host B while still allowing host B to communicate to host A, then yes. If not, then no, it is not as good. Besides that, it may not be as efficient. Admin'ing the rules is going be a greater task this way, you may end up having to create individual rules for every single host on your network. It's easier to separate things out by networks or zones, but I guess it depends.

The more I think about it, the more I don't like the idea.

Theoretically, if you can deny host A from communicating to host B while still allowing host B to communicate to host A, then it is just as good BUT that's assuming you have every rule in place. And since the rules are going to have to be pretty granular as all hosts are on the same subnet, I'd say there's some big potential that rules would/could be missed. But then again, if it's just a few hosts I guess it wouldn't be that hard.

Hi Everyone,

Yes, I appreciate the administrative burden when dealing with a single subnet.

I'll put my question into a little context:

I have (only) 2 servers. A web server and a DB server. They are both hosted on the same Xen host. I am able to firewall between the 2 hosts (using iptables on the Xen host) very tightly using iptables. However I'm in a bit of debate with someone who says that I should put the DB server onto a separate subnet...but I think that's pointless. I am able to create nice neat iptables chains on the Xen host for incoming and outgoing to each guest (web and db server).

IMHO, I don't think that subnetting provides any "magicness" except makes things easier to manage. However I'm only talking about 2 servers here.

You are correct, using different subnets just gives the illiusion of separation in most cases

I just wanted to add my two cents here:

First of all different subnet between two application layer does not require.

I believe Apache will initiates the connections to DB so secure your Web Server then thinking on the same subnet issues

By implementing filtering, you are playing with the performance.

I hope this helps to make your friend to understand certain things rather then blinding believing on him.

Thanks & Regards.
Ramesh Shihora