DMZ setup for SBS 2011

Question

Any suggestions on a low end router capable of providing a decent firewall that would begin to meet the security requirements needed for a DMZ setup?  (example Cisco PIX 506 Firewall) 
And whether it can be done with just a couple of wireless routers, one with an enabled DMZ?   My initial thought on this is that the standard consumer wireless routers have an eight character password which is far from secure enough to do
much of anything. (brainstorm details below)
Thought is to place a web form login page in the DMZ... add a read only file to test the web form access.  Nothing fancy and for now, it does nothing except verify that user can login or is denied login.   Verified login goes nowhere except
"Success".  Build something later when the first part works (if it works).
Plan is to exist over two lans (or IP sets within the domain - one set is 192.168.01.xxx and the other set is 192.168.02.xxx) and set up bypass rules between the two.  The Lan 192.168.01.xxx would house the DMZ (with HTTP port 80 access) and the
Lan 192.168.02.xxx would house the internal domain (SBS 2011 DC running VPN, Sharepoint etc, HyperV server with virtuals running SQL and TFS, and laptop access).  The 192.168.01.xxx is a guest lan for non-domain (non-hostile) members.
So my questions: 
1) Can the HTTP header be forwarded from SBS 2011 router rules on the router firewall to hit the second lan (http requests from 192.168.02.xxx would be routed over to 192.168.01.xxx)?
2) Can an inexpensive router like the PIX ($30 used) above solve the "crack the eight character router password issue?"  (Maybe I just need a newer router in general where the passwords are more secure?)
Currently RWW open, SSL open, VPN (1723) open, 25 open... all other ports closed.  [Does this create any snafu's?]
Hard to make head or tails of
http://forums.untangle.com/networking/25935-setting-up-sbs-2011-secondary-internal-dmz-3.html
R, J

Answer 1

While all this is good information, I would clarify one point
Port 80 should not be open and port forwarded as it's the single most commonly attacked port
Users should be taught to come in via port 443, using https
Cris Hanna [SBS - MVP] (since 1997)
Co-Contributor, Windows Small Business Server 2008 Unleashed
http://www.amazon.com/Windows-Small-Business-Server-Unleashed/dp/0672329573/ref=pd_bbs_sr_1?ie=UTF8&s=books&qid=1217269967&sr=8-1
Owner, CPU Services, Belleville, IL
A Microsoft Registered Partner
MVPs do not work for Microsoft
Please do not submit questions directly to me.
<Linda Graham> wrote in message
news:[email protected]...
Hi,
I have deployed similar setups for clients. The main thing is the quality of the router/firewall facing the internet. I assume when you talk about open ports, you mean open via NAT (network address translation) otherwise, you are leaving the firewall to
do the hard work. I am a fan of Draytek 2830 adsl routers. They also have cable routers if you connect via cable. These are much more expensive than $30 - about £230 in the UK. Cheaper models by other manufacturers are available, but what you should look for
is a fully customisable NAT server (also called virtual server on some cheaper models) Have a look at Zyxel and TP-Link professional routers. Passwords with these routers can be as complex as you need.
I assume you have a static IP address or block of static IP addresses for your public wan address. Using dynamic DNS will create problems with spam filters if you are using an Exchange/smtp server on your SBS server to send email and is not recommended.
SBS needs to be able to access your server via ports 25, 80, 443 and 987. You may also want to use 1726 if you need a VPN connection. Use NAT to map these ports from WAN to LAN. for example if your WAN address is XXX.XXX.XXX.XXX and your LAN subnet
is 192.168.1.0 with your SNS server IP address set to 192.168.1.1 and your router IP is 192.168.1.254, then you would add the following to the NAT address table:
WAN XXX.XXX.XXX.XXX port 25 to LAN 192.168.1.1 port 25
WAN XXX.XXX.XXX.XXX port 80 to LAN 192.168.1.1 port 80
WAN XXX.XXX.XXX.XXX port 443 to LAN 192.168.1.1 port 43
WAN XXX.XXX.XXX.XXX port 987 to LAN 192.168.1.1 port 987
This will provide secure access to these ports from WAN to LAN and will enable SBS remote web access, SBS Exchange Email and Outlook Web Access. Computers connecting will require either a third party domain certificate (eg from Verisign or
GoDaddy etc) or the self issued certificate (found in the public document folder on the SBS server) to be distributed to machines to enable them to use this remote access.
For the non secure subnet, you will need another router connected to a LAN port on your main router. Configure the WAN address of the secondary router to be 192.168.1.253 and the LAN  subnet to be anything suitable but different from your primary
LAN, eg 192.168.2.0. On your main router, set the WAN IP address of your secondary router (192.168.1.253) on the DMZ. This opens the WAN port of the secondary router to the internet but isolates it from your primary LAN subnet.
This setup is suitable for a secure network with public wifi access via the secondary router. Use the secondary router to restrict bandwidth, download types adult content etc. to prevent public abuse of your Wifi network, but still making it suitble
for smatphones to connect.
I hope this is clear, but if you have any questions, post again.
regards,
Linda
Cris Hanna, Microsoft SBS MVP, Owner-CPU Services, Belleville, IL