Re: [Xen-users] Re: Creating a DMZ domU

[Jeroen Torrekens <jeroen.torrekens@xxxxxxxxxxx>]

Christopher Isip wrote:

On Mon, Jul 14, 2008 at 6:24 AM, John A. Sullivan III <jsullivan@xxxxxxxxxxxxxxxxxxx> wrote:

On Sun, 2008-07-13 at 23:06 -0400, Christopher Isip wrote:
>
>
> On Sat, Jul 12, 2008 at 11:44 PM, Christopher Isip <cmisip@xxxxxxxxx>
> wrote:
>         I am going to try to create a domU webserver.  My current
>         setup is dom0 running Centos 5.1 with two ethernet interfaces.
>         One is pcibacked to a asterisk domU ( and hence invisible in
>         dom0 )and serves as the external interface there.  The
>         Asterisk domU is my gateway to the internet, default route,
>         dhcpd server, dns server and ip masquerade server as well.
>         The second interface in dom0 is the bridged interface to which
>         all the domUs are connected (including the Asterisk domU).
>         Everything seems to be working fine.  I have a simple two
>         interface shorewall configuration in the Asterisk domU.
>
>         My plan is to create a webserver domU and have shorewall run
>         in it as well.  The domU will have default drop policies for
>         all incoming and outgoing connections.  There will be a rule
>         to allow incoming ssh and outgoing ssh.  There will be a rule
>         for allowing incoming http as well. The webserver domU will
>         only have one interface, and that is the bridged interface
>         from domO.
>
>         In the Asterisk domU, I can write a DNAT rule to port forward
>         http connections from the internet to the webserver domU.
>
>         It seems that this should work If xen domUs really behave as
>         if they are independent LAN hosts which so far they have in my
>         setup.  My only question is how secure is this?.  Incoming
>         connections from the internet for http port will be forwarded
>         to a bridged interface. Or maybe this is where things will
>         break.
>
>         Anybody care to comment?
>
>             Thanks
>         Chris
>
> I just realized that iptables on a dmz is useless.  If an attacker
> gains access, the iptables rules could be rewritten and the dmz could
> be used to access the network.  Rather the other hosts need to have
> default rejectd policies for the DMZ host.  But I would rather not
> implement a firewall for each of the other hosts.  My thinking is that
> perhaps I should not give the DMZ host a vif interface that is bridged
> to a physical ethernet device.  If its possible to create a bridge
> interface without any physical ethernet cards attached to it, I could
> then present vif1 to the Asterisk domU and vif2 to the DMZ and have
> the Asterisk domU be the gateway to the rest of the lan and domUs.  I
> would simply convert to a three interface shorewall configuration in
> the Asterisk domU with one interface net, the other local and the
> third DMZ.
>
> Chris

<snip>
We have done quite a bit of this in our work on the ISCS network
security management project (http://iscs.sourceforge.net).  However, our
preference is always for a separate physical device for the Internet
gateway both for security and for management.  If something happens to
the dom0, we still have a way into the internal network to allow us to
try to troubleshoot the dom0 without sending anyone on site.

When severe budget constraints force us to use a single device, we've
always done this with three interface cards (Internet, internal and DMZ)
so packets moving from one network to the other must pass through
iptables and a user who has compromised the firewall cannot sniff the
physical device for other logical networks.  We usually also lock down
the dom0 to only allow ssh.

Of course, if someone has compromised the firewall, one is probably in
pretty serious trouble already so we try to run some form of HIDS (Host
Intrusion Detection System) on our firewalls as well.  Hope this helps -
John
>
--
John A. Sullivan III
Open Source Development Corporation
+1 207-985-7880
jsullivan@xxxxxxxxxxxxxxxxxxx

http://www.spiritualoutreach.com
Making Christianity intelligible to secular society

I managed to get things up and running.  I used three interfaces for the Asterisk domU : external (internet), local (eth0 bridge), dmz (bridge with no physical nic).  Seems to be working fine and I can access the dmz webserver from the internet.  My other question would be: is dom0 in danger since the dmz bridge is created in dom0 and there is really no firewalling there. 

Thanks
Chris

Normally not. There is no way for the 'outside' network to address your dom0 machine. If it does not have an IP address on the external bridge that is

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users