System Catalog › Gateways › IN - Input gateway with firewall (iptables)

IN - Input gateway with firewall (iptables)

Latest version: 3.0.2-1

Functional Overview

IN is an input gateway that provides a firewalled entry point for network traffic into an application.

IN accepts all allowed incoming traffic on its external interface and passes it through its out terminal. IN forwards only the traffic explicitly allowed through configuration of its firewall properties; IN discards all disallowed traffic.

IN supports up to 4 incoming interfaces (protocol/pair combinations), such as http, ssh, and so on. By default, IN allows only tcp port 80 (http).

IN is used to accept all network traffic for applications. All external traffic must pass through an IN gateway to access any resources or services within an application.

Boundary

Resources

Terminals

The external interface is enabled. It is used for incoming traffic. The external interface is configured through the properties listed in the following sections.

The default interface is enabled. It is used for maintenance (incoming SSH connections).

Properties

Base Configuration

The following property group defines the base network settings for the gateway.

Firewall Configuration

The following property group defines the firewall settings for the gateway. There are two filters that can be used together: by source IP address (allowed_hosts and denied_hosts) and by protocol/port (ifaceX). Up to four protocol/port pairs (interfaces) can be configured.

If all parameters are left to their defaults, no traffic will be allowed. To allow traffic in, configure at least the iface1_protocol and iface1_port values.

Notes:

• The iface4 filter can be configured to allow incoming protocols other than tcp and udp.
• All 4 interfaces can be configured independently; there is no requirement to have interface 1 and 2 to have 3. In particular, iface4 can be configured even if iface3 is not.

The port number for iface4 has slightly different behavior from the other port numbers. Setting iface4_port to 0 means that the port number is not going to be checked (works both for protocols that simply don't have port numbers, like GRE, and for tcp and udp). Setting iface{1,2,3}_port disables the interface (equivalent to setting the protocol to none).

Error Messages

The following messages may appear in either the appliance log file or the system log of the grid controller when the appliance fails to start:

• failed to start iptables
• Failed to set up rules (exit code code); using backup rule set

Failed to set up backup rule set (exit code code)

Typical Usage

Simple Input Firewall

The following diagram shows a typical usage of IN for a simple web server application:

Summary of Parts

• in1 - input gateway
• web1 - Web server appliance

in1 accepts HTTP requests on its external interface and passes them to web1 through its out terminal.

Example:

Advanced Firewall

In this example, the gateway is configured to allow the HTTP and HTTPS protocols, and the PPTP protocol (used by Microsoft Windows VPN).

Example:

In this example, note the use of iface4 for the GRE protocol. It is OK to fill iface4 even if lower-numbered interfaces are not filled in.

Notes

If a host is present, directly or as part of a subnet, both in the allowed_hosts and in the denied_hosts lists, it will be denied access. IN first rejects all denied hosts and then allows only those in allowed hosts (standard security practice).

IN is not used for accessing external services by the application. Applications access external services (outgoing traffic) through OUT and NET gateways.

iface4_protocol has not been tested with protocols other than tcp and udp (due to lack of appliances supporting GRE or other non-tcp/udp protocol).

Open source and 3rd party software used inside of the appliance

IN uses the following 3rd party open source packages in addition to the 3rd party open source packages used by its base class LUX5.