Creating a DMZ

Hey Guys

I have done the following to create a DMZ for a network that I administer.

The method of setting it up like this, is keeping the following in mind:

# Internal and External networks being able to access the DMZ via special ports
# Hosts in the DMZ not being able to reach internal network.
# Hosts in the DMZ network are able to communicate to one another.

===

1. Created an additional network range for the total required hosts on the Additional Address tab as per the following:

Name:                     DMZ-Network
On Interface:           Bridge1
IPv4 address:          192.168.10.1
Netmask:                 255.255.255.248
Assigned to node:   All (this applies to H/A clusters setups)

2. Added the new DMZ-Network to my allowed networks for DNS resolution.

3. Create NAT | Masquerading rule for the DMZ-Network to have a route to the internet.

DMZ-Network --> Uplink Interfaces

4. Create firewall rules for DMZ to Internet:

DENY:    Internal [DMZ-Network) --> ANY --> INTERNAL
ALLOW: Internal [DMZ-Network) --> SRV --> INTERNET
ALLOW: Internal [DMZ-Network) --> ANY --> Internal [DMZ-Network)

5. Create Destination NAT rules for DMZ-Network to be reached from any network:

Traffic Selector:               Any --> SpecialPort --> InternetGateway (Interface)

Destination Translation:   SpecialHost --> SSH

====

* Notes

- No DHCP required as all in DMZ are configured with a static IP.
- This configuration is working for me, but would like to have other recommendations / best practices as I am fairly new to setting it up.

TIA
Chris