Hey everybody welcome to the next video.
So in this video we're gonna be going over how to configure a DMZ or demilitarized zone so as a quick
overview and recap a DMC is a network segment that is only allowing specific traffic to the Internet
and that's it or vice versa.
From inside the network to the Internet and to inside the network.
But it only touches that network.
It does not touch any other network.
It doesn't have a connection between the two it is completely self-contained in the event that anything
any host inside of that network were to be compromised.
So the first thing we need to do is go ahead and stop the VM for PFC and stop it completely whether
it's telling its sending at the shutdown signal orders powering off.
Either is fine once that's done.
Go to Settings network go to adapter 2 Now currently we have network after 1 which is our when interface
which is ah.
Think of that as our tunnel or gateway upstream gateway or RPF sense device.
So that's connecting to our router locally on our network.
However we want another interface attached to it so we can use that to as our DMZ.
So under adapter to enable the adapter and make sure you clicked bridged adapter this way it just gets
an IP address over DCP and then they're all good glad to click Okay.
And getting started
and I'll be right back.
Once this is started
okay now that we've gone ahead and let it move we're gonna go ahead and refresh the web browser.
Now that's going to let you log in again.
So in this case Edmund and then whatever the password was that you set up perfect.
Now they're in here.
The first thing we need to do is set up the interface because you can see at the bottom right.
We just have one which is going to our gateway router.
Now under interfaces go to assignments and what you should see here is a new section called available
network ports that shows M one.
In my case it might be something different for you.
However it's normally a plus one two whatever the digit is at the end.
So we go in and click add that should set it as land by default.
So go ahead click save once that's safe click on land or you can come off the interfaces land.
Now what we need to do is we need to configure that.
So we need to enable the interface by clicking the checkbox will change the description to DMZ.
We don't want it to be called land in this particular case.
Now for IP before.
So how is it gonna get its IP address for the interface itself.
In this case we could set it statically but I'm going to let it go let the DSP server kind of handle
that.
So we we don't need to worry about it.
So that's pretty much it.
We just hit safe.
Now what's important understand is YPF since it always makes.
It's always a.
Are you sure.
So at the top right.
When you hit apply change this is when it actually applies to the running config.
Now on a router in a firewall there is a configuration and then there's then there's the running configuration.
Now the running configuration is what's actually being used actively as the service is running and then
the standard configuration is what it save to so it saved its configuration to the configuration files.
However it needs to reload those configuration files for that particular part of the service.
In this case the network adapters.
So we hadn't hit apply change that takes a second and then it will say that it's been applied correctly
or something failed perfect.
Now what we need to do is we need to change the actual rules which is how the DMZ is is put in place.
So if we go into firewall go to rules now we'll see we have another option called DMZ one click that.
Now we have an anti lockout rule and this is only because there it was originally the first interface
after when it's land and then everything after that is just the next interface.
So the first two are special.
So in this case you'll see this this anti lockout rule.
However note that when this if you have a win or win in land already set and then you add another interface
so if we added another one and then enabled it and did everything exactly the same way this rule wouldn't
be here.
So just keep that in mind.
It's just an anti lockout rule for when and land.
But in our case we're just calling it DMC.
Now what we need to do is we're going to only allow specifically traffic through here.
So let's say we only want ICMP and DNS to go through.
Now again you can make a web a web interface you can put 18 4 4 3 and allow it out to the Internet which
is what you would do if you had a Web site.
So in our case I was going to set up ICMP to allow through India's we're gonna go ahead and hit ad down
so it's below the previous rule because rules are us are used in order of top down.
So we can keep passes there DMD fine instead of IP.
We're going to even as IP forward instead of DCP we're going to do ICMP.
So we'll leave it as any.
Which is perfectly fine and no really.
We're going to change the source to DMZ net which means anything in the DMZ network that we've assigned
it.
We'll leave destination as any so we can let the ICMP out and we'll do ICMP and then apply our changes.
So now we can see here that we're allowing I see any type of ICMP packets from our DMC network out to
the Internet.
Perfect go and click another one.
Now we're going to add DCP.
So in case you notice DCP isn't in here we're going to leave it to be the source.
Again it's going to be DMC.
And then for Destination Port we're just gonna go down here and it has a list of some common things
that you can use in our case we're looking for DNS.
So we'll click DNS and put in the description just so anybody future can know what's going on.
That's it.
Then apply changes.
So that's how a DMZ works.
So if we went onto that network and tried to push traffic through this machine we could only allow DNS
or ICMP traffic from inside the DMZ net to the outside world.
Currently it's it's only there's nothing allowing it inside.
So let's say we have a web server.
Right so we'll do pass TPP so the sources.
Any.
Which is perfectly fine.
And then our destination would be the DMZ net.
Now normally you're going to do DMZ address and only set the address to the web server that you want.
But in this case we'll set it to net.
And then we're going to allow is port 80 and that's it.
Now you can do 4 4 3 as well.
However in this case we're just going to HDTV and save and apply.
So now what we've done is we have created a network adapter and a whole new network that only allows
ICMP and DNS out of the network.
But HDP is allowed in.
So this is how you create a DMZ when PFA sets the general rules still apply when you're looking at this
from other firewalls.
However there are some firewalls out there that will just you just check a box and say that it's a DMZ
and it reconfigure is a lot of things for you in this case we're doing it manually one by one.