Network Setup
74
You may also want to configure your CyberGuard SG appliance to allow access from
servers on your DMZ to servers on your LAN. By default, all network traffic from the DMZ
to the LAN is dropped. See the section called Packet Filtering in the chapter entitled
Firewall.
Guest Network
Note
Not available on the SG300, SG530, SG550 or CyberGuard SG PCI appliances.
The intended usage of Guest connections is for connecting to a Guest network, i.e. an
untrusted LAN or wireless networks. Machines connected to the Guest network must
establish a VPN connection to the CyberGuard SG appliance in order to access the LAN,
DMZ or Internet.
By default, you can configure the CyberGuard SG’s DHCP server to hand out addresses
on a Guest network, and the CyberGuard SG’s VPN servers (IPSec, PPTP, etc.) to listen
for connections from a Guest network and establish VPNs. Aside from this, access to
any LAN, DMZ or Internet connections from the Guest network is blocked.
If you want to allow machines on a Guest network direct access to the Internet, LAN or
DMZ without first establishing a VPN connection, add packet filtering rules to allow
access to services on the LAN or Internet as desired. See the Packet Filtering section in
the chapter entitled Firewall for details.
Warning
Caution is advised before allowing machines on a Guest network direct access to your
LAN. This may make it a lot easier for an attacker to compromise internal servers.
Caution is also advised before allowing machines on a Guest network direct access to
the Internet, particularly in the case of Guest wireless networks. This may result in
unauthorized use of your Internet connection for sending spam, other malicious or illegal
activities, or simply Internet access at your expense.
To Next Page
Loading...
Need help?
General
