Reference Information › Appliance Catalog Reference Guide › System Catalog › Gateways › IN2 - Input Gateway Appliance

IN2 - Input Gateway Appliance

Latest version: 1.0.3-1

Functional Overview

IN2 is an input gateway that provides a firewalled entry point for network traffic into an application.

IN2 accepts all allowed incoming traffic on its external interface and passes it through its out terminal. IN2 forwards only the traffic that is explicitly allowed through configuration of its firewall properties. IN2 discards all disallowed traffic.

IN2 supports up to four incoming interfaces (protocol/pair combinations), such as http and ssh. By default, IN2 allows only TCP port 80 (http).

IN2 is used to accept all network traffic for applications. All external traffic must pass through an IN2 gateway to access any resources or services within an application.

Boundary

Resources

Terminals

The in terminal is used for inbound traffic. This terminal is configured via the Interfaces tab of Application Configuration Editor.

The default interface is enabled. It is used for maintenance (incoming ssh connections).

User Volumes

None

Properties

Firewall Configuration

The following property group defines the firewall settings for the gateway. There are two filters that can be used together: by source IP address (allowed_hosts and denied_hosts) and by protocol/port (ifaceX). Up to four protocol/port pairs (interfaces) can be configured.

If all parameters are left to their defaults, no traffic will be allowed. To allow traffic in, configure at least the iface1_protocol and iface1_port values.

Notes:

• The iface4 filter can be configured to allow incoming protocols other than tcp and udp.
• All four interfaces can be configured independently; there is no requirement to have interface 1 and 2 in order to have 3. In particular, iface4 can be configured even if iface3 is not.
• The port number for iface4 has slightly different behavior from the other port numbers. Setting iface4_port to 0 means that the port number is not going to be checked (works both for protocols that simply do not have port numbers, like GRE, and for tcp and udp). Setting iface{1,2,3}_port disables the interface (equivalent to setting the protocol to none).

Error Messages

The following messages may appear in either the appliance log file or the system log of the grid controller when the appliance fails to start:

• failed to start iptables
• Failed to set up rules (exit code code); using backup rule set
• Failed to set up backup rule set (exit code code)

Typical Usage

Simple Input Firewall

The following diagram shows a typical usage of IN2 for a simple web server application:

Summary of Parts

• in2 - input gateway
• web1 - Web server appliance

in2 accepts HTTP requests on its in terminal and passes them to web1 through its out terminal.

Example:

A valid IP address has to be configured for in teminal from the pool of available IP addresses provided by the Grid Controller. Netmask and Gateway for in terminal will be taken automatically from the Grid Controller.

Advanced Firewall

In this example, the gateway is configured to allow the HTTP and HTTPS protocols, as well as the PPTP protocol (used by MS Windows VPN).

Example:

A valid IP address has to be configured for in teminal from the pool of available IP addresses provided by the Grid Controller. Netmask and Gateway for in terminal will be taken automatically from the Grid Controller.

In this example, note the use of iface4 for the GRE protocol. It is OK to fill iface4 even if lower-numbered interfaces are not filled in.

Notes

• If a host is present, directly or as part of a subnet, both in the allowed_hosts and in the denied_hosts lists, it will be denied access. IN2 first rejects all denied hosts and then allows only those in allowed hosts (standard security practice).
• IN2 is not used for accessing external services by the application. Applications access external services (outgoing traffic) through OUT2 and NET2 gateways.
• iface4_protocol has not been tested with protocols other than tcp and udp (due to lack of appliances supporting GRE or other non-tcp/udp protocol).

Open source and 3rd party software used inside of the appliance

IN2 uses the following 3rd party open source packages in addition to the 3rd party open source packages used by its base class LUX6.