file system access through a firewall?

[FunkyGibbon]

Hi

We publish a lot of data onto our websites everyday (many megs all day). We currently do this via FTP from our production servers to the internet servers (which we host ourselves).

The problem is that the FTP service is crap - fails a lot and you can't track failed transfers very easily. This causes a lot of manual checking - not good.

As we host both the internal production servers and the internet servers in the same room, there has to be a better way. (All servers Win2K or Win 2003).

Can we simply allow regular filesystem access through the filewall (Firewall-1 is what we have), so from VB we can use all the filesystem objects etc. Clearly we need to set the security os that only certain internal servers have access and no external ones do.

I reckon we should be able to do this (but I know nothing!) but I'm getting strong resistance from the sysadmins.

TIA

FG

[aldi]

I'm standing by to be corrected but I guess if the internet facing servers are in your DMZ and you allow filesystem access from the LAN it kind of defeats a lot of the point of having a DMZ. For windows network shares I think the ports you need are quite commonly used by viruses also.

[ErnestM]

If you go to an appliance like Sonicwall you can then access your DMZ firewalled internet facing servers on whatever you want without giving pass through access to your firewalled servers...

ErnestM

[JamieBeeston]

You could just allow the IP of the machiens you want to connect to/from to chat unrestricted, or even just allow the NetBios ports for file/folder share.

Or, you could VPN, bit of a long winded solution, a few rules should be all thats neccesary..

or just run a second cat5 to the box and put this on an internal range (non routable!) but check with your internal policy guys if this is a breach of their security policy.

Checkpoint FW1 is a VERY powerful firewall, so should allow for good configurations

[FunkyGibbon]

From what I can gather about our network setup, our internet servers are not in the DMZ directly, but in a "service network".

That way we can independantly control access to the "Service Network" from the DMZ side and the internal LAN side - with different rules for both.

So (unless I'm taling bollox - quite likely ) we shold be able to have file access from LAN - Service Network but block it from DMZ - Service Network.

Make sense?

[MarkoTVR]

Is there a firewall between your internal LAN and the Service Network (where the servers you need access to are situated)?

If so, could you configure the firewall to allow only 'outbound triggered' access (I forget the exact phrase) from your internal LAN for a specific set of PCs (assuming these would have static IP addresses assigned)? That way, only those machines would have passage through the firewall, as any comms would need to be initiated from the internal side. Any attempt to initiate from the Service LAN, even on the same ports, should be denied.

I must admit, I've not tried this for Windows File Access, only FTP/SFTP which I guess is more of a discreet activity.

Or is it too late for me to be thinking about all this, because I've totally misunderstood it?! (Damn good chance....)



>> Edited by MarkoTVR on Thursday 18th August 22:24

[_deejay_]

MakroTVR - yep you're correct.

You should need a rule which allows access from the internal network to the service LAN.

It should be exactly the same as if you're using an alternate service, such as FTP.

If you're using a modern OS, then it should just be a case of opening TCP/445. If not the usual NetBIOS port (TCP/137 IIRC)

[_dobbo_]

I wouldn't worry too much about opening a hole - as long as it's one way from the LAN to the DMZ, then even if the webserver is exploited/infected, it has no filesharing path to the internal network.

[zumbruk]

You should also bear in mind the performance issues of having file sharing transit a firewall. The firewall has to examine every packet, and this can place an untenable load on the firewall. We do not normally allow file sharing protocols to transit firewalls for this reason.

The "right" way to do this (if there is such a thing) is to place machines inside and outside the firewall and connect a dual-ported disk to both of them. That way, they can transfer files between each other without worrying about the network or the outside machine being compromised.

Of course, it is still possible for the DMZ machine to catch a virus and transmit it via the shared disk to the inside machine.


>> Edited by zumbruk on Friday 19th August 12:03

[FunkyGibbon]

Thanks for the replies folks.

Just a thought, would setting up a VPN to the internet kit work? Or will that have the same performance hit on the firewall?

FG

[zumbruk]

Same. The problem with shared disk is the amount of data that's being transferred, not the format it's in. Don't forget that a firewall is a router with knobs on...

[aldi]

_dobbo_ said:

I wouldn't worry too much about opening a hole - as long as it's one way from the LAN to the DMZ, then even if the webserver is exploited/infected, it has no filesharing path to the internal network.

One could argue that one of the machines on the LAN is more likley to get infected and spread to the DMZ, than the other way around