Copyright 2005-20. NeoAccel Inc. SSL VPN-Plus TM NeoAccel Management Console: Firewall version 2.3
NeoAccel makes no warranty of any kind with regard to this manual, including, but not limited to, the implied warranties of merchantability and fitness for a particular purpose. NeoAccel shall not be held liable for errors contained herein or direct, indirect, special, incidental or consequential damages in connection with the furnishing, performance, or use of this material. The product and company names mentioned in this document may be the trademarks of their respective owners. Throughout this document NeoAccel has attempted to distinguish trademarks from descriptive terms by writing the name with the capitalization used by the manufacturer, or by writing the name with initial capital letters. NeoAccel cannot attest to the accuracy of this information. Use of a trademark in this document should not be regarded as affecting the validity of the trademark. Restrictions Information in this document is subject to change without notice and does not represent a commitment on the part of NeoAccel. The software described in this manual is furnished according to a license agreement with NeoAccel. The license agreement contains all of the terms and conditions governing your use of the software and documentation, including all warranty rights, limitations of liability, and disclaimers of warranty. Material contained in this document may describe NeoAccel products not available or features not available in your country. No part of this material may be reproduced in any form or by any means without permission in writing from the publisher. Printed in India. Edition history Edition 1: November 2007 Edition 2: July 2008 Edition 3: February 20 Copyright All Rights Reserved. Copyright (C) 20, NeoAccel Inc. 2005-20 NeoAccel Inc. 2
Contents Printing History... 4 Conventions... 5 In This Manual... 7 Audience... 7 Firewall... 8 Filters... 8 Add a Filter Rule... 9 Modify a Filter Rule... 11 Remove Filter Rule... 11 Port Mapping... 12 Add Port Mapping Rule... 13 Modify Port Mapping Rule... 14 Remove Port Mapping Rule... 14 2005-20 NeoAccel Inc. 3
Printing History The manual printing date and part number indicate its current edition. The printing date will change when a new edition is printed. Minor changes may be made at reprint without changing the printing date. The manual part number will change when extensive changes are made. Manual updates may be issued between editions to correct errors or document product changes. To ensure that you receive the updated or new editions, you should subscribe to the appropriate product support service. Table 1 Edition History Product number Revision Date Release V2.1.2106 November 2007 NeoAccel SSL VPN-Plus TM Release v2.1 V2.2.2216 July 2008 NeoAccel SSL VPN-Plus TM Release v2.2 V2.3 February 20 NeoAccel SSL VPN-Plus TM Release v2.3 2005-20 NeoAccel Inc. 4
Conventions Table 2 Following conventions are used in this document Convention Meaning Italic Document titles, and manual pages Provides emphasis Example Refer to NeoAccel SSL VPN- Plus User s Guide for more information You must install the NeoAccel kernel before installing other components Computer Specifies a variable that user should enter in a command Text and messages on computer screen Files and directory names Command names This is a note icon. Notes include helpful background information, as well as reminders that may simplify your process. This is a warning icon. Whenever you see this warning symbol, READ THE CONTENTS CAREFULLY. By doing so, you will avoid common At command prompt, type./displaytunnel tunn_id Error message is displayed: Bridge utils Package is not installed Run./install.sh script Run./displayprodinfo command 2005-20 NeoAccel Inc. 5
pitfalls that many encounter. Document Number Manuals SVP-UM-2.3-1011- SVP-UM-2.3-1012- SVP-UM-2.3-1013- SVP-UM-2.3-1014- SVP-UM-2.3-1015- SVP-UM-2.3-1016- SVP-UM-2.3-1017- SVP-UM-2.3-1018- NeoAccel Management Console System Administration NeoAccel Management Console Gateway Administration. NeoAccel Management Console Users/ Groups NeoAccel Management Console Authorization NeoAccel Management Console Network Extension NeoAccel Management Console Portal NeoAccel Management Console Firewall NeoAccel Management Console Tools Online Help NeoAccel SSL VPN-Plus Management Console provides context-sensitive (F1) help and help topics for various operations. 2005-20 NeoAccel Inc. 6
In This Manual The NeoAccel SSL VPN-Plus Firewall Manual describes the configuration of Dynamic IP, Private Network, Logon/Logoff Client Configuration and Configuration of Installation Package. Audience The manual is intended for administrators who are responsible for maintaining the NeoAccel SSL VPN-Plus solution. 2005-20 NeoAccel Inc. 7
Firewall NeoAccel SSL VPN-Plus TM Gateway can be configured to function as a firewall as well, thus, providing the functions such as filters and port mapping. Filters Filters are rules added to one of the chains INPUT, FORWARD and OUTPUT. Filters are used to allow/deny the LAN/WAN users from accessing the internet or internal network. Filter rules depend on IP table rules. There are five Factory Default (Firewall) Rules - FDR depending upon interface configurations. These are not editable. These FDR are created with a substring as _NASYS and you cannot use this substring while creating new rules. You can insert user defined rule in-between two FDR but at service restart, the position of the FDR gets appended after the user defined rules, therefore in order to maintain the position of the user defined rules in-between the FDR, you need to follow a workaround. The workaround is such that you need to redefine or recreate the same set of FDR rules and then append the user defined rules in-between them. Figure 1.1: Filters 2005-20 NeoAccel Inc. 8
Figure 1.2: Add Filter Rule SSL VPN-Plus supports three kinds of rules namely, Input Rules: rules that need to be followed when data packets are coming to a particular interface. Forward Rules: rules that are applicable when packets are getting forwarded from one interface to the other. Output Rules: rules applied to packets coming out from an interface. Add a Filter Rule Perform the following steps to add a filter rule: 1. Click on the node: Firewall from the Content Panel in the NMC. 2. Click on the sub-node: Filters; the existing filter rules along with the default system rules, are displayed in the Content Panel. Refer to Figure 1.1 2005-20 NeoAccel Inc. 9
3. Click on the button: Add to open a dialog box: Add Filter Rule. Refer to Figure 1.2 4. Assign a priority to the rule from the spinner box: Priority. The priority assigned is verified against the rule in a particular chain. 5. Select the rule type i.e. the chain it has to be added to, from the drop-down box: Rule Type. 6. Select the action to be performed, from the drop-down box: Action. 7. Enter the source IP address or source IP network in the field: Source IP. And also enter the sub-netmask in the adjoining field: Subnet Mask. Figure 1.3: Modify existing Filter Rule 8. Enter the destination IP address or destination IP network in the field: Destination IP. And also enter the destination sub-netmask in the adjoining field: Subnet Mask 9. Select a protocol from the drop-down box: Protocol. 10. Uncheck the option: Any to enter a range of source ports in the field: Source Port. 11. Uncheck the option: Any to enter a range of destination ports in the field: Destination Port. 12. Select the interface on which filter rule will be applicable, from the drop-down box: Source Interface. 13. Click on the button: OK to save and apply the configurations. Or Click on the button: Cancel to close the dialog box: Add Filter Rule 2005-20 NeoAccel Inc. 10
without saving any changes. Modify a Filter Rule Perform the following steps to add a filter rule: 1. Click on the node: Firewall from the Content Panel in the NMC. 2. Click on the sub-node: Filters; the existing filter rules along with the default system rules, are displayed in the Content Panel. Refer to Figure 1.1 Figure 1.4: Remove Filter Rule 3. Select the filter rule to be modified, from its respective chain displayed accordingly in the Content Panel. 4. Click on the button: Modify to open the dialog box: Modify Filter Rule. Refer to Figure 1.3 5. Do the required modification. 6. Click on the button: OK to save the modified contents. Or Click on the button: Cancel to close the dialog box: Modify Filter Rule without saving any changes. NOTE: Except for the field: Name, all the other fields are modifiable. Remove Filter Rule Perform the following steps to add a filter rule: 2005-20 NeoAccel Inc. 11
1. Click on the node: Firewall from the Content Panel in the NMC. 2. Click on the sub-node: Filters; the existing filter rules along with the default system rules, are displayed in the Content Panel. Refer to Figure 1.1 3. Select the filter rule to be removed, from the Content Panel. 4. Click on the button: Remove to remove the selected filter rule; a confirmation prompt: Remove Filter Mapping is displayed in the Content Panel. Refer to Figure 1.4 5. Click on the button: Yes to confirm removal of the selected filter rule. Or Click on the button: No to close the dialog box: Remove Filter Mapping without saving any changes. Port Mapping NeoAccel SSL VPN-Plus TM Gateway supports Port Mapping or port forwarding. Port mapping is the technique in which packets destined for a specific TCP/UDP port and machine gets forwarded or redirected to a different port and/or machine. Figure 1.5: List of existing Port Mappings 2005-20 NeoAccel Inc. 12
Add Port Mapping Rule Perform the following steps to add a Port Mapping Rule: 1. Click on the node: Firewall from the Content Panel in the NMC. 2. Click on the sub-node: Port Mapping;; a list of existing Port Mappings are displayed in the Content Panel. Refer to Figure 1.5 Figure 1.6: Add Port Mapping 3. Click on the button: Add to add a port mapping rule; a dialog box: Add Port Mapping is displayed in the Content Panel. Refer to Figure 1.6 4. Enter a name to the port mapping rule in the field: Name. 5. Assign the priority at which you want the port mapping rule to be executed, from the spinner box: Priority. 6. Enter the source IP address or source IP network in the field: Source IP. And also enter the sub-netmask in the adjoining field: Subnet Mask. 7. Enter the destination IP address or destination IP network in the field: Destination IP. And also enter the destination sub-netmask in the adjoining field: Subnet Mask 8. Enter the IP address to which port mapping is done, in the field: Forward To IP. Also assign a port number in the adjoining field: Port. 9. Select the interface for application of port mapping, from the dropdown box: Source Interfaces. 2005-20 NeoAccel Inc. 13
10. Click on the button: OK to save and apply the configurations. Or 11. Click on the button: Cancel to close the dialog box: Add Port Mapping without saving any changes. Modify Port Mapping Rule Perform the following steps to modify any existing port mapping rule: 1. Click on the node: Firewall from the Content Panel in the NMC. 2. Click on the sub-node: Port Mapping;; a list of existing Port Mappings are displayed in the Content Panel. Refer to Figure 1.5 Figure 1.7: Confirm removal of Port Mapping 3. Select a port mapping rule to modify, from the list displayed in the Content Panel; a dialog box: Modify Port Mapping. Refer to Figure 1.7 4. Do the required modifications. 5. Click on the button: OK to save the modifications. Or Click on the button: Cancel to close the dialog box: Modify Port Mapping without saving any changes. NOTE: Except for the field: Name all the other fields are modifiable. Remove Port Mapping Rule 1. Click on the node: Firewall from the Content Panel in the NMC. 2. Click on the sub-node: Port Mapping; a list of existing Port Mappings 2005-20 NeoAccel Inc. 14
are displayed in the Content Panel. Refer to Figure 1.5 Figure 1.8: Confirm removal of Port Mapping 3. Select a port mapping rule to delete, from the list displayed in the Content Panel; a confirmation prompt: Remove Port Mapping is displayed. Refer to Figure 1.8 4. Click on the button: Yes to remove the selected port mapping from the SSL VPN-Plus TM Database. Or Click on the button: No to close the confirmation prompt: Remove Port Mapping without saving any changes. 2005-20 NeoAccel Inc. 15