DMZ host in same subnet as non DMZ hosts.

[theeht]

Hello-

I'd like to know how one might create a secure interface on a router when the host on in the DMZ is in the same subnet as non DMZ hosts.

Since a picture in this case might be worth a thousand words:

http://fqdn.com/net.jpg

host 'C' is the host to be in the DMZ. Further subneting isn't a choice for me. I have tried proxy arp and unnmbered, both not a solution for different reasons.

I was thinking it would be nice to put both ints into a common vlan but still be able to apply access lists to each interface.

look forward to hearing your ideas..

-g

 

[ChrisAC]

Router config? **********************
Chris Andrew, CCNA, CCSA
chris@iproute.co.uk
**********************

 

[theeht]

There is nothing to show at the moment. I've moved host C back into network A and e2 is shutdown. Currently I'm controlling access via access-lists but of course that is not going to protect the other hosts in the same segment should host C be compromised.

As you can see from the diagram the problem is host C shares the same subnet length and network as the others. When host C wishes to establish a connection with the other hosts in the 'A' network it will arp for them as it believes it is in the same collision domain (of course this works the other way around too.). The second issue is how would one number int e2? e1 has an IP of .214 with all the other hosts having it configured as the default gw. I can only spare one more IP from my pool of 5. This is partially why I wanted to place e1 and e2 (if this is do-able) in a vlan and then create a virtual interface between the two, if that doesn't sound too ridiculous. I was thinking this might allow me to apply unique access lists to e1 and e2. Anyway it seems like a bizarre setup to me and I wouldn't be surprised if it isn't possible. Thanks for taking a look at it anyway. The router by the way is connected to a 2924 switch.