How to configure the web access in various Integra interfaces

Size: px

Start display at page:

Download "How to configure the web access in various Integra interfaces"

Prosper Wilkinson
5 years ago
Views:

How to configure the web access in various Integra interfaces How-to guides for configuring VPNs with GateDefender Integra Panda Security wants to ensure you get the most out of GateDefender Integra.

1 How to configure the web access in various Integra interfaces How-to guides for configuring VPNs with GateDefender Integra Panda Security wants to ensure you get the most out of GateDefender Integra. For this reason, we offer you all the information you need about the characteristics and configuration of the product. Refer to and for more information. How-to guides for Panda GateDefender Integra The software described in this document is delivered under the terms and conditions of the end user license agreement and can only be used after accepting the terms and conditions of said agreement. The anti-spam technology in this product is provided by Mailshell. The web filtering technology in this product is provided by Cobion. Copyright notice Panda All rights reserved. Neither the documents nor the programs that you may access may be copied, reproduced, translated or transferred to any electronic or readable media without prior written permission from Panda, c/ Buenos Aires, Bilbao (Biscay) Spain. Registered Trademarks Panda Security. TruPrevent: Registered in U.S.A Patent and Trademark Office. Windows Vista and the Windows logo are trademarks or registered trademarks of Microsoft Corporation in the United States and other countries. All other product names may be registered trademarks of their respective owners. D. L. BI Panda All rights reserved.

2 INDEX 1. INTRODUCTION PROCEDURE...5 Symbols and styles used in this documentation Symbols used in this documentation: Note. Clarification and additional information. Important. Highlights the importance of a concept. Tip. Ideas to help you get the most from your program. Reference. Other references with more information of interest. Fonts and styles used in the documentation: Bold: Names of menus, options, buttons, windows or dialog boxes. Codes style: Names of files, extensions, folders, command line information or configuration files, for example, scripts. Italics: Names of options related with the operating system and programs or files with their own name. Panda GateDefender Integra Page 2 of 9

3 1. Introduction Panda GateDefender Integra lets you access the Web console from a single interface. This access from a single interface can be configured from the Console access sub-menu in the System settings menu: Normally, access to the Web console is configured in one of the internal network interfaces (LAN or DMZ), as this is more secure than the WAN interface. However, it can be useful on occasions for Web console access to be enabled on several interfaces. For example, if Panda Software s tech support department requests remote HTTPS access to the machine to resolve an incident, it is not necessary to change the console settings. Using a simple DNAT rule it is possible to allow access to the Web console both on the LAN and WAN ports. To illustrate how to do this, we will use the following network as an example: Panda GateDefender Integra Page 3 of 9

4 In this simulation a Panda GateDefender Integra unit has been placed in the network perimeter to carry out corporate firewall functions (any other module can also be enabled along with the Firewall). In this context, Integra has been configured with three interfaces: Eth0 for the WAN zone, Eth1 for the LAN, and Eth2 for the DMZ. Normally, in the most common real set-ups, the WAN interface is given a private IP address, with an additional device providing it with WAN services - for example, an ADSL router, a cable modem, etc. - which has a public IP address (either dynamic or static). This device normally translates the Integra WAN private address to an Internet valid public address, through NAT. The figure shows how Panda GateDefender Integra is located behind an ADSL router that is doing nat of the packages received through its LAN interface. In order to make this document user-friendly, the ADSL has been configured to redirect (port forwarding ornat destination) of all the traffic received in its public interface ( ) to Integra s WAN interface, that is, to the IP address What s more, we are obviously taking for granted that Integra has been configured with SNAT rules, so both the LAN and the DMZ are transparent beyond the Integra WAN interface, whose IP is the sole "representative" of the network protected by Panda GateDefender Integra. This means the only way of reaching both Integra and its internal networks (LAN and the DMZ in this case) is through the public IP address assigned to the ADSL device whose traffic is redirected towards the GateDefender Integra unit. Index Panda GateDefender Integra Page 4 of 9

5 2. Procedure As can be seen in the previous illustration, access to the Web console is configured on the eth1 interface. By entering a DNAT rule, it is possible, without changing the console settings, to access the Web console both from the eth1 and eth0 interfaces. To do this and to map the HTTPS traffic in the eth0 interface towards the eth1 interface as if it were another corporate server offering external services, all you need to do is enter that rule. With this configuration, requests to the Integra in the eth0 interface IP address through port 443 will go through Integra, which will change the target IP address for the private IP address of the console assigned in its eth1 interface. Follow the steps below according to the defined scenario: 1. Network definitions are entered which might be useful when configuring rules. Panda GateDefender Integra Page 5 of 9

In this case, the LAN and DMZ ranges are defined as well as the IP address of the console and the IP address of the interface assigned to the WAN interface.

Define the service to be mapped. In this case it will not be necessary to add a new one as HTTPS in port 443 already exists in the predefined default services: 3.

6 In this case, the LAN and DMZ ranges are defined as well as the IP address of the console and the IP address of the interface assigned to the WAN interface. Note: This step is not obligatory. You can enter the addresses without having previously defined them, although it simplifies the task when entering a lot of rules. 2. Define the service to be mapped. In this case it will not be necessary to add a new one as HTTPS in port 443 already exists in the predefined default services: 3. Add the DNAT rule that maps the HTTPS traffic through port 443 to the eth1 (LAN) interface: Select DNAT as the action, which creates the DNAT rule: Panda GateDefender Integra Page 6 of 9

7 Assign a name and define the characteristics of the traffic affected by the rule: This will be applied to traffic from whatever source, as the source of requests from the Internet is unknown. The target should be the IP address of the interface to which traffic will be sent, in this case the WAN interface. The service for which this rule will be applied is, in this case, HTTPS, defined by default and which includes HTTPS traffic through port Define the parameters of the end target of the static mapping: In the NAT target address field, enter the target server of the HTTPS request. In this case, you can use the definition entered for IP address of the console or manually enter the IP address directly, which in this case will act as the target server for the HTTPS request. If the Keep original address option is enabled, the target header will not be modified. This can be used in special circumstances. The Target port option in this case is not necessary as the target port will not change. 5. Define the rest of the optional information parameters, rule planning, etc. Once all parameters are defined, the rule will be as illustrated below: Panda GateDefender Integra Page 7 of 9

8 Once you have entered the DNAT rule, it is important that traffic which will be redirected is not blocked by the firewall filter rules. In order to do so, a new filter rule to allow HTTPS traffic can be added, as shown in the figure below: Index Panda PGDIHT07-04-EN Panda GateDefender Integra Page 8 of 9

9 Panda GateDefender Integra Page 9 of 9

HOWTO: Practical guide to configuring high availability in Panda GateDefender Integra

HOWTO: Practical guide to configuring high availability in Panda GateDefender Integra How-to guides for configuring high availability in GateDefender Integra Panda Security wants to ensure you get the