TCP/IP Tutorial and Technical Overview - IBM Redbooks

Internal
DNS and
Mail server
Secure network
organization.com
Client1 Client2
Figure 22-21 Screened host firewall
This configuration allows an information server to be placed between the router
and the bastion host. Again, the security policy determines whether the
information server will be accessed directly by either outside users or internal
users, or if it will be accessed through the bastion host. If strong security is
needed, traffic from both the internal network to the information server and from
outside to the information server can go through the bastion host.
In this configuration, the bastion host can be a standard host or, if a more secure
firewall system is needed, it can be a dual-homed host. In this case, all internal
traffic to the information server and to the outside through the router is
automatically forced to pass the proxy server on the dual-homed host. The
bastion host is then the only system that can be accessed from the outside. No
one should be permitted to log on to the bastion host; otherwise, an intruder
might log on the system and change the configuration to bypass the firewall.
Screened subnet firewall (demilitarized zone)
This type of firewall consists of two packet-filtering routers and a bastion host.
Screened subnet firewalls provide the highest level security among the different
firewall types (see Figure 22-22 on page 809). This is achieved by creating a
808 TCP/IP Tutorial and Technical Overview
Bastion host gateway
Proxy
servers
Packet
filter
SOCKS
server
External
DNS
Public
server
Untrusted network
WWW
FTP
Internet
Router
Packet
filter