Holes Between Dmzs And Internal Networks - D-Link DFL-1600 User Manual

14 Chapter 3. Firewall Principles
Modem pools can be subject to direct attacks and, in extreme cases,
telephone lines can be tapped. Switches, located at any point in the
telecommunications network or in the office, can be reprogrammed without
the intruder needing to be anywhere near them.
When it comes to VPN connections, it is important to remember that
although the connection itself may be secure, the total level of security is
only as high as the security of the tunnel endpoints.
It is becoming increasingly common for users on the move to connect
directly to their company's network via VPN from their laptops. However,
the laptop itself is often not protected. In other words, an intruder can gain
access to the protected network through an unprotected laptop with
already-opened VPN connections.
A basic precaution to take in protecting your network against modem and
VPN connection attacks is to ensure that mobile computers never
communicate directly with the Internet. Instead, they should always be
routed through the VPN or modem connection and the company's network,
regardless of whom they wish to communicate with. This way, they enjoy
more or less the same level of protection as the rest of the network. For
VPN connections, a competent VPN client that can block all inbound
Internet traffic, aside from that which passes through the VPN connection,
must be installed on each laptop.
A VPN connection or modem pool should never be regarded as a direct
part of a protected network. The VPN endpoints should instead be located
in a special DMZ or outside a firewall that is dedicated to this task. By
doing this, you can restrict which services can be accessed via VPN and
modem and therefore ensure that these services are well protected against
intruders.
In instances where the firewall features an integrated VPN gateway, it is
usually possible to dictate the types of communication permitted. The
D-Link Firewall features just such a facility.
3.2.6

Holes between DMZs and Internal Networks

Although the advent of extranets and e-commerce has served to drive
development forwards, and as more and more companies begin to make
internal data available via web servers, security hazards are increasing as a
D-Link Firewalls User's Guide