On Mon, 3 Feb 2003, Peter wrote:

>       Just wondering what would be the best way to do this...
> what would be the best way to have freebsd accept incoming connections,
> run them thru the firewall, and all the packets that pass forward them
> to internal windows machines.  I dont' want the windows boxen directly
> on the net, I want to put a FBSD firewall in front of them, and so far
> the best option I've found on how to do this is to have the windows
> boxen be 192.168.x.x and have the fbsd boxen forward all connections to
> "public_ip" to the windows box via natd.  Does this seem like a good
> plan? Or anyone know of another better way to do this?

Thought hat is a good way of doing things; I would strongly recommend,
if IIS is the only service, to do this differently and not do anything on
packet level but on app level:

        internet---->publicIP [ FreeBSD ]<--private IP--> IIS
                              apache proxy

I.e: not run any NAT, routing etc; but simply use apache configured as
a pass through proxy:

        <VirtualHost OUTSIDEIP:80>
                ProxyPass               /
                ProxyPassReverse        /

As this will allow apache to guard against bogus headers, buffer overuns
and the usal fun and games. See directives like:


Though they are sensible set; if oyu use a lot of ASP/VB-script you may
want to reduce a few.

This will also speed up your installation considerbaly if you have a lot
of slow modem users or high packet drop.


To Unsubscribe: send mail to [EMAIL PROTECTED]
with "unsubscribe freebsd-questions" in the body of the message

Reply via email to