System Catalog › Gateways › NET - Network output gateway with firewall (iptables)

NET - Network output gateway with firewall (iptables)

View the Video

Latest version: 3.0.2-1

Functional Overview

NET is an output gateway that provides outgoing access to a network outside of an application. NET accepts traffic from the application on its in terminal and forwards it through its external interface to the outside network (for example, the Internet).

NET has a firewall that allows only outgoing traffic (connections and datagrams); it drops incoming traffic that is not for an already established connection or related to a datagram request. NET can be configured to further limit the set of IP addresses reachable through it.

NET serves as a default network gateway and DNS server for the appliance(s) connected to its in terminal.

Important! Only gateway output terminals should be connected to NET's in terminal.

NET is used for accessing services outside of an application whose host names are determined at runtime (for example, mail server addresses obtained from MX DNS records or search engine bots that need to traverse the web).

Boundary

Resources

Terminals

The external interface is enabled. It is used for outgoing traffic. Its network settings are configured through properties.

The default interface is enabled. It is used for maintenance (incoming SSH connections).

Properties

Error Messages

The following messages may appear in either the appliance log file or the system log of the grid controller when the appliance fails to start:

• iptables failed to start
• named service failed to start
• Failed to set up rules (exit code <code>); using backup rule set

Failed to set up backup rule set (exit code <code>)

Typical Usage

The following diagram shows a typical usage of NET for a simple mail server application that accesses the Internet for mail forwarding using NET:

Summary of Parts

• in - input gateway appliance, class in
• mailman - SMTP server appliance, class smtp
• out - output gateway appliance, class net

in passes inbound connections to the mailman server. Mailman serves the mail request and sends outbound mail through net gateway. The mail is sent in two steps for each message: first, sending a DNS request for the target mail server and then sending the message to that server . The net gateway forwards the DNS request from the mailman server to the specified DNS server and makes the connection to the target mail server.

The smtp appliance shown in the above example is not shipped with CA 3Tera AppLogic.

The following sections describe the configuration of net in several typical use cases.

Unrestricted Access to Standard Domains

In this mode, NET is configured in a way very similar to a regular network gateway (for example, for connecting a LAN to the Internet using ISP).

Example:

Note: Many companies have internal domains that can be resolved only through their private DNS servers (for example, .local or .localdomain). To use such domains, configure the dns1 and dns2 properties to point to those private DNS servers. Also see the possible hosts restrictions feature below.

Unrestricted Access to Standard Domains Using Root DNS Servers

In this mode, NET does not need specific DNS servers and uses a set of preconfigured Internet root servers.

Example:

Important! In this mode, NET needs access to the root DNS servers (otherwise NET will fail all DNS queries). The gateway property must be specified.

Restricted Access to Private Domains

In this mode, NET is restricted to accessing only specified networks, allowing and denying specific hosts and subnetworks.

Example:

Important! In this mode, the DNS servers must be within the set of allowed hosts.

Notes

General Notes

In general, the only type of output terminal that should be connected to NET's in terminal is a gateway output. These outputs differ from regular outputs by acting as default gateways for their appliances, allowing connections to multiple hosts (as opposed to the single-host access provided by regular outputs). Gateway outputs are shown visually with a blue square in the terminal shape, while regular outputs are shown with red arrows.

Notes:

• For more information about the output terminal types, see the ADL Language Reference Guide.
• Connecting a regular output to the NET gateway will provide only DNS resolutions. This is a valid use of the NET gateway (essentially as a DNS resolution service).
• If a host is present, directly or as part of a subnet, both in the allowed_hosts and in the denied_hosts lists, NET will deny access to that host. NET first rejects all denied hosts and then allows only those in allowed hosts (standard security practice).
• If your application doesn't need access to a whole network but to a particular host (for example, ftp.CA.com), it is better to use the OUT gateway appliance.

NET is not used for providing incoming requests to an application. Incoming request can be handled using the IN gateway appliance.

Open Source and Third Party Software Used Inside the Appliance

NET uses the following 3rd party open source packages in addition to the 3rd party open source packages used by its base class LUX5.