the internet firewall provides security by preventing internet users from accessing machines inside the lan. this security, however, also prevents users from reaching servers intended for public access, such as a web or e-mail server, which are crucial for effective internet use.

    in order to allow such services, the internet firewall dmz comes with a special demilitarized zone (dmz) port which you use for setting up public servers. the dmz sits between the local network and the internet. servers on the dmz are publicly accessible, but they are protected from attacks such as syn flooding and ping of death. use of the dmz port is optional and you do not have to connect it.

    3com recommends that you use the dmz port as an alternative to public lan servers or to putting these servers on the wan port where they are not protected and not accessible by users on the lan unless intranet features are enabled.

    click network, and then select the dmz addresses tab. a window similar to that in figure 20 is displayed.

    figure 20 dmz addresses window

   

    alternatively you can select dmz port settings from the home screen graphic.

    each of the servers on the dmz needs a public ip address.

    obtain these ip addresses from your isp. usually, the isp can also supply information on setting up public internet servers.

    type the addresses for the dmz individually or as a range.

    type an individual address in the from address box. to enter a range of addresses, such as the 51 ip addresses from 199.168.23.50 to 199.168.23.100, type the starting address in the from address box and the ending address in the to address box. you can specify up to 64 address ranges.

    click update to send the configuration data to the internet firewall.

    to delete an address or range, select it in the address range list and click delete.

    network address translation (nat) does not apply to servers on the dmz.