On Mon, 3 Feb 2003, Peter wrote:
> Just wondering what would be the best way to do this...
>
> INTERNET----FBSD FIREWALL----WINDOWS IIS SERVER Basically
> what would be the best way to have freebsd accept incoming connections,
> run them thru the firewall, and all the packets that pass forward them
> to internal windows machines. I dont' want the windows boxen directly
> on the net, I want to put a FBSD firewall in front of them, and so far
> the best option I've found on how to do this is to have the windows
> boxen be 192.168.x.x and have the fbsd boxen forward all connections to
> "public_ip" to the windows box via natd. Does this seem like a good
> plan? Or anyone know of another better way to do this?
Thought hat is a good way of doing things; I would strongly recommend,
if IIS is the only service, to do this differently and not do anything on
packet level but on app level:
internet---->publicIP [ FreeBSD ]<--private IP--> IIS
apache proxy
I.e: not run any NAT, routing etc; but simply use apache configured as
a pass through proxy:
<VirtualHost OUTSIDEIP:80>
ProxyPass / http://192.168.1.2/
ProxyPassReverse / http://192.168.1.2/
</VirtualHost>
As this will allow apache to guard against bogus headers, buffer overuns
and the usal fun and games. See directives like:
LimitRequestBody
LimitRequestFields
LimitRequestFieldsize
LimitRequestLine
Though they are sensible set; if oyu use a lot of ASP/VB-script you may
want to reduce a few.
This will also speed up your installation considerbaly if you have a lot
of slow modem users or high packet drop.
Dw
To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-questions" in the body of the message
