Modern Three Interface Firewall Design

Last Updated on Tue, 02 May 2023 | Network Security

Most designs today use the topology shown in Figure 7-6. This design has become the current gold standard in firewall edge deployments. More-secure options exist (see the next design), but this is the best balance of security, cost, and management.

Figure 7-6. Three-Interface Firewall Design

Figure 7-6. Three-Interface Firewall Design

Firewall Design

The biggest benefit this design provides is requiring that all traffic flow through the firewall. This includes traffic from the Internet to the public servers, which in all previous designs were only protected by a router with ACLs. For example, if an attacker finds an exploit that allows one of your public servers to be compromised (after the attacker gets through the firewall the first time), the attacker still must go back through the firewall (using a different filtering policy) to attack your internal systems.

This design can be modified by adding more segments off of the firewall, allowing public servers to be separated from one another.

Continue reading here: Figure SS Single Local DNS Server

Was this article helpful?

0 0

Related Posts

Readers' Questions

  • fethawi yusef
    When designing a firewall what is the recommended?
    7 months ago
    • The recommended best practice when designing a firewall is to create an ‘allow’ list. This means creating a rule for every type of traffic that is allowed through the firewall, as well as explicitly blocking all other traffic. For example, if only web browsing and email services are necessary, then these two ports should be allowed, while all other ports should be blocked. Additionally, it is also recommended to ensure that all ports are closed by default, with only the necessary ports opened when needed. Additionally, it is important to ensure that the firewall is properly configured with the latest security patches and updates.