The normal apologies for the noobie-type question... We have IPCop nicely segregating our orange (DMZ) and green (blocked) LANs. As time has gone on, I've realized that I'd like many more of our services to be on the orange network so they can be easily reached by customers/consultants who may not have fixed IPs. Many of our users are not SSH savvy and might not want us installing a tunneling client on their systems. Most of these services that I want to expose have some form of authentication but some of that is not terribly robust (mediawiki, mysql, bugzilla). Some are targets for DoS (SQL Server) or other attacks. My thoughts are to have a strong challenge/response login from a client to the firewall. This could be done via https to a non-standard port on the firewall. If this login succeeded, all (or configurable) ports would be available from the client to services inside the firewall as long as the 'session' was active. The session would be based on the client's IP and would have an inactivity time-out. The original https login would not need to stay active. The services behind the firewall would still have their normal authentication. Valid user logins to the firewall could be either via statically configured tables on the firewall or via LDAP, etc. I think I remember a scheme like this when I was using the Wingate proxy server. Is this available using iptables/IPCop or some other OSS package?
Sounds like a captive portal with authentication would be a good fit. Not sure if there is something like that for IPCop, I use it on m0n0wall and pfSense. You can authenticate users off RADIUS using a splash page (web traffic automatically redirected to login page), so you can integrate the authentication into your existing environment (Active Directory, *nix servers, etc.). In m0n0wall and pfSense, once you authenticate to the captive portal, you then have the defined firewall rules applied. I suggest searching for a captive portal add on for IPCop, maybe such a thing exists. Good luck
