DMZ vs Open Ports and Rules.

Follow

Pimbox

• January 23, 2021 22:41

Hi Firewallers!

 I have a windows server in my house where I run commercial applications (for example: Apache, mySql Server and etc.) and also some applications for entertainment (for example: L4D2 Server, Terraria Server, TeamSpeak Server and etc).
 I bought Firewalla Gold because I was receiving a lot of attacks mainly coming from within TeamSpeak where once logged in, the client would dump a large amount of packages making the internet inoperable. The vast majority of times this attack came from Scandinavian countries and some regions in Africa.
 With the policy of blocking countries via the Rules menu, I was able to mitigate all attacks, as the client could only exploit the flaw once logged in to the server, and as his country was blocked by Firewall, he could no longer even enter to make the attack.
 However, I only managed to get my clients and friends to be able to access the server, when I added it to the DMZ (with the "Allow on Firewall" option enabled). Before placing the server in the DMZ, I tried to add the program ports via rules or even following the Open Ports and UPnP menu (unsuccessfully), I was only able to actually access the applications from outside when the server was placed in the DMZ.
 The question is: As I am using with Firewall ON even in the DMZ and I managed to mitigate the attacks in this way, am I at any risk of leaving the server like this?

Thx again!

0

• 

  Firewalla

  • January 23, 2021 23:06

  Can you please share when you are doing the port forwarding what rules do you have under the rule button? do you have a rule allowing connection to the port forwarded 'port'?

  0

  Comment actions Permalink
• 

  Pimbox

  • January 23, 2021 23:47

  Rule

  Action: Allow

   

  Matching: LocalPort UDP Port 27015 (L4D2 Server Exemple).

  On: Server (device)

  Schedule: Active Time> Always

  0

  Comment actions Permalink
• 

  Firewalla

  • January 24, 2021 00:32

  Do you have a port forwarding rule to port forward 27015?  

  0

  Comment actions Permalink
• 

  Pimbox

  • January 24, 2021 01:15

  Yes:

  Service: L4D2

  Protocol: UDP

  External Port: 27015

  Internal Port:

  Devide: Server

  Port: 27015

  Allow on Firewall: Enable (in Disable don't work too without server in DMZ).

  0

  Comment actions Permalink
• 

  Firewalla

  • January 24, 2021 01:46

  Your configuration is correct ... if DMZ works, my take is, very likely there are other ports that are not port forwarding.  You will need to double-check your application and make sure all the related ports are forwarded

  1

  Comment actions Permalink
• 

  Pimbox

  • January 24, 2021 23:08

   Okay, I'll check. But the strange thing is that before having the Firewalla Gold, everything was already configured on the TP-Link Archer C6 that it used as a router, now with Gold in place and exactly with the same settings, they only get access from the outside with the DMZ on . I deactivated all the NAT services of Tp-Link to not have conflict with Gold's but without results, anyway, as it is working, I will leave it this way.

   Is there any risk of leaving the server in the DMZ (with the Firewall on, as it is)?

  Thank`s

  0

  Comment actions Permalink
• 

  Firewalla

  • January 25, 2021 01:28

  Leaving the server in DMZ is like connecting your server directly to the internet.  Highly do not recommend this, unless you know what you are doing. 

  As of the DMZ works and port forward not working, you need to check your old configurations and see if there is anything that's missed.  

  0

  Comment actions Permalink
• 

  Pimbox

  • January 25, 2021 19:38

  Yes, i ll check all configs.

  In "simple" routers, DMZ is like connecting directly to the internet, but DMZ in Firewalla with Firewall flag allowed, my Firewall rules works in this DMZ Device right?

  0

  Comment actions Permalink
• 

  Firewalla

  • January 25, 2021 21:49
  • Edited

  The concept of DMZ is routing traffic;  while rules are more of controlling traffic.   They operate at different layers, so yes, even with DMZ traffic, rules will apply.

  1

  Comment actions Permalink
• 

  Pimbox

  • January 25, 2021 22:47

  Nice!
   I missed this OSI class hahaha.
   I will look for the settings more carefully and adapt the use of the server to get it out of the DMZ.
  Thanks.

  0

  Comment actions Permalink

Please sign in to leave a comment.