1

I have a firewall VM which creates I have used to setup subnet for different purposes.

For example: (fake ips, of course)

  • 1.1.2.1/24 DMZ
  • 1.1.3.1/24 Internal
  • 1.1.5.1/24 security/logging

I use dovecot,spamassassin,postfix, and apache on the mail server.

The DMZ has a mail/web server. The firewall and server use OpenSuSe 13.1 with tumbleweed repository. (newest possible updates) I have combined iptables and ipset for blocking traffic.

The problem comes in with securing this plus the other computers. The whole point to a DMZ is to be separate from the internal network. So if mail/web server has an security issue to report it can't tell anybody because the firewall blocks it. I then setup a log server (on 5.1 with no internet or internal access), but the quantity of data logged is more than I have time to deal with.

I need something to correlate all the data so when an alert happens on the mail/web server it adds the IP to the ban list on the firewall. Also spamassassin needs to communicate to the firewall also.

I know that others manage dozens of computers so there must be a better solution that doing it manually. I know there are some hardware solutions, but just the maintenance package cost more than, I can afford. Hopefully open source projects. It would be even nicer if it could manage updates across all linux VMs for me.

any suggestions?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.