Our corporate DMZ is a segment off of our firewall.
A bunch of systems hang off it, being carefully
controlled when they are attempting to access our
internal net.

But what about each other?

I am considering creating a Linux or *BSD many port
firewall to control access. I need to care about
speed, since multiple systems may be attempting
access, and they will be given GB connectivity
if possible.

I will have a dual Xeon at my disposal, with a
bunch of slots.

I will have a budget for decent multi-port GBit
cards.

In order of importance:
\tWorks / fast enough (hardware support for quad TOE boards).
\tSecurity.
\tEase of maintenance - OS patches - reflects back to security.
\tAbility to run monitoring software - ethereal, ntop, etc.

So, 1st I have to choose the TOE board.

This looks like a nice choice:
[link|http://www.intel.com/network/connectivity/products/pro1000mt_quad_server_adapter.htm|http://www.intel.com...erver_adapter.htm]
[link|http://www.intel.com/network/connectivity/resources/doc_library/tech_specs/spec_pro1000mt_quad_port_server_adapter.htm|http://www.intel.com...erver_adapter.htm]

Only lists Linux and FreeBSD as OS choices though.

Looking here for OpenBSD compat:
[link|http://www.openbsd.org/i386.html|http://www.openbsd.org/i386.html]
it seems to support it, except I see an bad note:

[link|http://www.openbsd.org/cgi-bin/man.cgi?query=em&arch=i386&sektion=4|http://www.openbsd.o...ch=i386&sektion=4]

"The driver supports IPv4 receive
IP/TCP/UDP checksum offload on all but 82542-based"

Ahh, according to the specs, it has the 82546EB processor,
should be OK.

So, using OpenBSD should be my best case on security. Using
the native firewall language looks very easy to implenent
(and understand) the rulesets required for locking the systems
down.

Ease of maintenance is an iffy. I need more info on this.
OpenBSD wants you to upgrade EVERYTHING at once in the event
of a patch, or so it seems. Which could be painful.

On the other hand, it is so small, disk snapshots should be trivial
for rollback.

Ability to run monitoring software looks pretty good. Almost all
the tools that I could do on Linux I can also do on OpenBSD.
[link|http://www.insecure.org/tools.html|http://www.insecure.org/tools.html], or so it seems. Or am
I assuming the the little deamon means all the BSDs, and I'm
going to get burned?

Let's consider FreeBSD, which the Intel adaper supports out
of the box.
[link|http://www.freebsd.org/|http://www.freebsd.org/]

It looks pretty complete, has a bunch of firewall options, including
a port of the OpenBSD PF environment:
[link|http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/firewalls-pf.html|http://www.freebsd.o...firewalls-pf.html]
They describe version differences which might bite me.
Maybe I don't even want to use PF, maybe I want IPF or IPFW.
How would I know, I need a BSD geek to tell me.

Do I have an unreasonable level of expection concerning the
security of OpenBSD VS FreeBSD? Based on the vendor hardware
support (Intel card), I'd probably want to go using FreeBSD
if possible. Also, as I read the FreeBSD feature list, it
seems more advance with lots more goodies.

[link|http://www.freebsd.org/features.html|http://www.freebsd.org/features.html]

OK, what issues have I missed?
\t

The harshest criticism in my environment is reserved for people who pretend to be techies, but use tools that hide complex environments from them with pretty interfaces.

If you review this, [link|http://z.iwethey.org/forums/render/content/show?contentid=227484|http://z.iwethey.org...?contentid=227484], you will see one of our guiding principles for our organization is:

would like to have a bunch of smart cross-trained geeks running the place, rather then vendor focused silos of knowledge


A recent example was a dump of a GUI generate iptables rule-set. The jr admin was showing it, and was unable to explain what it was doing. Now this admin is smart, but inexeperienced HERE. He has a comp-sci degree, and has setup and adminned many Linux and Unix systems. He is also a deep-diver, usually reading up on great detail when researching something. In other places he may qualify for Sr admin, just not here, where we have someone else we call senior, who has far more experience than this guy.

Anyway, he was wrong when he explained it. When I read the ruleset, I made the exact same mistake, but figured it out a few lines later, since I don't pretend to know the syntax of IPTables.

If I am responsible for this particular bit of security - firewalling the DMZ, then I'm going to follow my requirements list. Works 1st, securely.

I can test "works". I can theorize "securely". But only if the low level rules are written by me, as simply as possible, as restrictive as possible. If I use a pretty front end, I have been abstracted from the implementation. An I have NO trust for writers of pretty front ends, since the focus is not the security, it is the pretty front end.

Some day I am going to be called to explain every aspect of the security up on a white board. I'm not allowed to say: IPCOP says it should be OK.

But only if I can figure out the what the scripts it is writing does.

Thanks.

Do I need to define them (ftp, ssh, SQL/Net, etc) or is there something I can grab that I missed. I did an apt-get to setup.

Note: I'm not using NAT for this setup, all addresses to be specified are real.
I think!

1st of all, our DMZ is not all public space.
The goal is to have a series of boxes that
are externally accessable in a constrained fashion.
Which then also have specific limited access to our
internal systems.

So this means there could be a web server, an
FTP server, an ssh bouncebox, and specific client
based systems on the DMZ. A client might need a
particular server that only is accessable from
them via their IP address.

But if all these systems are on the same IP segment,
on the same physical LAN, then they can all see
each other, unless we put a high end switch that
has ACL setups. Which we don't want to do, since
it seems our LAN guys run into "issues" as they try
to setup these ACLs.

Which then means it is up to me to lock them down
via the above described method.

So I have to look to others such as [link|http://www.silicom.co.il/ProductsAndEventsinside.asp?id=87|http://www.silicom.c...sinside.asp?id=87]
Which is Broadcom - and I HATE broadcom.