I have a firewall VM which creates I have used to setup subnet for different purposes.
For example: (fake ips, of course)
- 188.8.131.52/24 DMZ
- 184.108.40.206/24 Internal
- 220.127.116.11/24 security/logging
I use dovecot,spamassassin,postfix, and apache on the mail server.
The DMZ has a mail/web server. The firewall and server use OpenSuSe 13.1 with tumbleweed repository. (newest possible updates) I have combined iptables and ipset for blocking traffic.
The problem comes in with securing this plus the other computers. The whole point to a DMZ is to be separate from the internal network. So if mail/web server has an security issue to report it can't tell anybody because the firewall blocks it. I then setup a log server (on 5.1 with no internet or internal access), but the quantity of data logged is more than I have time to deal with.
I need something to correlate all the data so when an alert happens on the mail/web server it adds the IP to the ban list on the firewall. Also spamassassin needs to communicate to the firewall also.
I know that others manage dozens of computers so there must be a better solution that doing it manually. I know there are some hardware solutions, but just the maintenance package cost more than, I can afford. Hopefully open source projects. It would be even nicer if it could manage updates across all linux VMs for me.