Build a DMZ and prove the traffic rules hold

short · 50 min · Objective 4.1

Task

Implement a three-zone design — internal, DMZ and external — with firewall rules that allow exactly the traffic the design permits, then test every allowed and every denied path. A DMZ is defined by what it cannot reach, so the denials are the interesting tests.

Steps

  1. Write the policy before touching a rule. External may reach the DMZ on 80 and 443 only. Internal may reach the DMZ on anything. The DMZ may not initiate anything toward internal. Internal may reach external. That fourth rule is the one that makes it a DMZ.
  2. Set the router's FORWARD policy to DROP, then add rules implementing the policy in order. Remember to permit established and related traffic first, or every reply will be dropped: sudo iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT.
  3. Add the permits: external to DMZ on 80 and 443; internal to DMZ; internal to external. Add nothing for DMZ to internal — the default policy handles it.
  4. Test every path in the matrix, including the ones that should fail. Four sources times three destinations is twelve tests, and the value is in the ones that must be refused.
  5. Now test the reason the DMZ exists: from Host C, try to reach Host A. It must fail. That is what contains a compromised web server.

Verify

sudo iptables -L FORWARD -n -v --line-numbers
curl -s -o /dev/null -w "ext to dmz 80: %{http_code}\n" --max-time 5 http://192.168.30.10/
ssh -o ConnectTimeout=5 -o BatchMode=yes user@192.168.30.10 hostname; echo "ext to dmz 22 exit $?"
ping -c 1 -W 2 192.168.10.10; echo "dmz to internal exit $?"

Port 80 from external must return 200; port 22 from external must fail; and the ping from the DMZ to internal must fail. Run the last one from Host C — that is the test the whole design exists to pass, and a non-zero exit code is the pass.

Notes

The rule most often missed is the conntrack permit, and its absence produces a confusing symptom: connections appear to start and then hang, because the request is permitted and the reply is not. If the matrix shows outbound connections timing out rather than being refused, check that rule first.

The counters in iptables -L -v are the troubleshooting tool. A rule with zero packets is not matching, and a rule above it is probably catching the traffic first. Reading counters beats reading rules.

Zones like this are the practical form of network segmentation, and the exam pairs it with three ideas worth naming. Screened subnet is the formal name for a DMZ. East-west traffic is between servers inside a zone, which traditional perimeter firewalls never see. And zero trust is the position that the internal zone should not be trusted either — every request authenticated and authorised regardless of where it came from.