separate router and firewall

i am going to crazy of thinking about how to separate router and firewall
more securely and better. i have a linux machine and cisco router.i want to
ask is the router behind the firewall against the internet or firewall
behind the router is the best.i want to doing NAT also.
please give me some hint.

thanks

happy wrote:
> i am going to crazy of thinking about how to separate router and firewall
> more securely and better. i have a linux machine and cisco router.i want to
> ask is the router behind the firewall against the internet or firewall
> behind the router is the best.i want to doing NAT also.
> please give me some hint.
>
> thanks
>
>

I would put the router behind the firewall, no matter where you are
doing the NAT thing. This is because routers can be fooled and hacked
as any other machine in your network can, and the firewall will protect
your router. But I don't think it's really a very important
consideration, you should use the configuration that suits better your
networking needs, the firewall will protect your network anyway.

--

Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
(E-Mail Removed)
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÑA

The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
-- Jack Kerouac, "On the Road"

happy wrote on 02.09.2004 15:55:
> i am going to crazy of thinking about how to separate router and firewall
> more securely and better. i have a linux machine and cisco router.i want to
> ask is the router behind the firewall against the internet or firewall
> behind the router is the best.i want to doing NAT also.
> please give me some hint.

It depends if you want to see all traffic directed to your IP or not. I
prefer to have the router in front of the firewall so my firewall alarms
me about the real thing. But if you're interested in detecting trends,
portscans etc. you may put your firewall first.

Walter