I'm looking at implementing a pfSense firewall on a network, and I've a number of options when it comes to implementation. Specifically, I can either:
- Stick each network zone (WAN, DMZ, core) on separate interfaces going into the firewall device.
- Pipe a single dot1q trunk into the firewall containing the 3 VLANs carrying the different networks and get it to firewall between them.
The nervous twitchy bit of me is leaning towards (1) as differently trusted traffic is neater on physically segregated networks. However, (2) seems a little neater, and requires fewer NICs on the firewall.
Obviously, (2) has a bandwidth disadvantage, I can only pipe 1Gbps total across all networks through the firewall, but this isn't a concern for the moment.
My question is, does going with (2) present any additional risks that I'm not aware of? Could an attacker sitting on the WAN network be able to intercept / alter traffic on the other two networks just by sharing a dot1Q trunk going into the firewall with them?