DMZ

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

DMZ

L1 Bithead

We only have one public IP. Can I still set up a DMZ? If so, can someone point me to a good article on setting one up? I have found several but nothing that specifies if it is okay to set up using a single IP.

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

here's an example NAT rule for a DMZ hosted webserver

 

In the original packet, you need to set untrust as source AND destination, this is because the original destination IP belongs to the external interface and the source IP originates from the internet. both of these zones are determined by doing a route lookup 

if you set a service (in this case https:443) only that port is translated, leaving you with all the other destination ports untranslated and free for additional rules that point to different destinations (smtp, ftp,...)

 

in the Translated Packet, we set the destination server's private IP so NAT can be applied, and you can also change the final destination port, in case the server is running a service on a different port from the default (ports can both be changed pre- and post NAT e.g. 4443 becomes 443 or 443 becomes 8443 etc. 

 

2023-08-18_13-31-12.png

 

hope this helps

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

View solution in original post

8 REPLIES 8

Cyber Elite
Cyber Elite

Hi @CGilbride ,

 

It is definitely possible to setup a DMZ with 1 public IP address.  A DMZ is recommended for all inbound traffic.

 

You would create a private subnet in the DMZ and use NAT to map the 1 public IP to the private IP addresses.  You could map different services (e.g., tcp/25, tcp/80, etc.) to different DMZ IP addresses.  You could also use other options in the rule.

 

Thanks,

 

Tom

Help the community: Like helpful comments and mark solutions.

@TomYoung, thank you. I think I found an article that will help. It looks like I would just add my public IP to the Destination Address field in the security policy I create. I'm new to Palo Alto, and normally deal with internal network infrastructure, so setting up DMZs is not my specialty, working on adding to my skill set. 

Cyber Elite
Cyber Elite

Hello,

Any protected subnet is technically a DMZ. Do you have services that are exposed to the internet?

Regards,

Hello @OtakarKlier, we do not. 

Cyber Elite
Cyber Elite

here's an example NAT rule for a DMZ hosted webserver

 

In the original packet, you need to set untrust as source AND destination, this is because the original destination IP belongs to the external interface and the source IP originates from the internet. both of these zones are determined by doing a route lookup 

if you set a service (in this case https:443) only that port is translated, leaving you with all the other destination ports untranslated and free for additional rules that point to different destinations (smtp, ftp,...)

 

in the Translated Packet, we set the destination server's private IP so NAT can be applied, and you can also change the final destination port, in case the server is running a service on a different port from the default (ports can both be changed pre- and post NAT e.g. 4443 becomes 443 or 443 becomes 8443 etc. 

 

2023-08-18_13-31-12.png

 

hope this helps

Tom Piens
PANgurus - Strata specialist; config reviews, policy optimization

Hello,

Since you are not hosting any services that the people on the internet need to connect to, then all you need to do is create a security zone and vlan on the PAN. From there create the access policies as normal. This is now your protected vlan/DMZ. Also make sure you have a DENY ALL policy so its all allowed by exception.

Hope that makes sense.

Excellent!! thanks for the help.

Yes, I will test this out. Thanks for the excellent support!

  • 1 accepted solution
  • 1415 Views
  • 8 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!