# iptables DMZ dual firewall howto?

## pgu

I have a topology like this

```

        eth1   eth0         eth1    eth0

WAN <---->  FW1  <---- DMZ ---> FW2 <--- LAN --->

                 172.31.31.xxx      172.30.30.xxx

```

FW2 is also DHCP and DNS server for the two networks. The WAN will typically be some xDSL modem getting some dynamic IP, or it could be another router.

First step is to get the NAT running from the LAN and out to the WAN and the DNS server access the WAN so it can serve the LAN and the DMZ. 

Are there any good tutorials and examples on how to set up iptables for such a topology? I would assume it's not that uncommon.

----------

## pgu

I'm looking for information mostly on the NAT part, i.e. where do I NAT, one FW1 only (and forward using FW2), or do I NAT on both FW1 and FW2.

----------

## syn0ptik

There looks like double PC? You can do with one PC and play with vlan's.

provide dmz in one vlan

and provide another net in the second vlan

----------

## pgu

Yes. I have two physically PC's. Each with two NIC's and running Gentoo with netfilter.

----------

## chiefbag

Is there a reason why you need to use 2 physical machines?

As mentioned above this can easily be accomplished with one box.

You could use 3 NICs so as to have a physical hardware  running your DMZ.

----------

## papahuhn

In enterprise environments it is a common design to have separate hardware firewalls (and even separate vendors) for DMZ(s) and the internal network. Sometimes even VLANs are discouraged. pgu, you don't need NAT on FW2, as your DMZ and LAN have different networks.

----------

## pgu

I already have two PC's with integrated dual NIC's.

It seems like http://www.aboutdebian.com/firewall.htm describes  my setup and it states "The outside firewall is set up to do the proxy/NAT stuff for your internal network" so that answer my most important question.

----------

## pgu

 *papahuhn wrote:*   

> pgu, you don't need NAT on FW2, as your DMZ and LAN have different networks.

 

That's what I learned from the above link. I just have to make sure that packets are forwarded to the DMZ and translated there.

----------

