I am trying to configure a DMZ using IPCop but it looks like the default configuration for a DMZ in IPCop is no DHCP and no access to Internet.
Even when I manually configure IPCop as my default gateway and DNS resolver, it seems that there is no NAT configured from the DMZ to Internet (only the other way).
I am wondering about the pros and cons of having Internet access inside the DMZ.
- I can easily run updates on the DMZ systems and even schedule automatic patching for security updates
- It will be much easier to install an Ubuntu system by downloading only necessary packages than install from a CDROM
- If compromised, machine can be used as part of a DDoS attack
Apart from the single argument of "if someone compromise my machine, it can be used to compromise someone else on Internet", I see no reason not to give access to Internet on my DMZ machines.
Is this a bad idea?