r11 - 20 Dec 2007 - 22:08:41 - BeckyHYou are here: Wiki >

December 24 - AppLogic 2.4.7 is now available and is the latest production release!

Subnet Output Gateway Appliance

Latest version: 2.2.1

	At a Glance
	Catalog	System
	Category	Gateways
	User volumes	no
	Min. memory	40 MB
	OS	Linux
	Constraints	no
	Questions/Comments	Ask Forum

Functional overview

NET is an output gateway that provides outgoing access to a network outside of an application. NET accepts traffic from the application on its in terminal and forwards it through its external interface to the outside network (e.g., the Internet).

NET has a firewall that allows only outgoing traffic (connections and datagrams); it drops incoming traffic that is not for an already established connection or related to a datagram request. NET can be configured to further limit the set of IP addresses reachable through it.

NET serves as a default network gateway and DNS server for the appliance(s) connected to its in terminal.
Only gateway output terminals should be connected to NET's in terminal.

NET is used for accessing services outside of an application whose host names are determined at runtime (e.g., mail server addresses obtained from MX DNS records or search engine bots that need to traverse the web).

Boundary

Resources

Resource	Minimum	Maximum	Default
CPU	0.05	4	0.05
Memory	40 MB	2 GB	40 MB
Bandwidth	1 Mbps	100 Mbps	1 Mbps

Terminals

Name	Dir	Protocol	Description
`in`	in	any	Accepts all incoming traffic
`mon`	out	cce	Output for performance and resource usage statistics

The external interface is enabled. It is used for outgoing traffic. Its network settings are configured through properties.

The default interface is enabled. It is used for maintenance (incoming ssh connections).

User Volumes

None

Properties

Property name	Type	Description
`ip_addr`	IP Address	Defines the IP address of the external interface of the gateway. This property is mandatory.
`netmask`	IP address	Defines the network mask of the external interface. This property is mandatory.
`gateway`	IP address	Defines the default IP network gateway (router) for the external interface. If left blank, only hosts on the same subnet as `ip_addr`/`netmask` will be accessible.
`dns1`	IP address	Defines the primary DNS server to which NET will forward DNS requests. If left blank, NET will use the root DNS servers.
`dns2`	IP address	Defines the backup DNS server to which NET will forward DNS requests if the primary is not available. If left blank, NET will not use a backup DNS server.
`allowed_hosts`	String	List of hosts and/or subnets to be accessible through NET. Separate multiple entries with spaces or commas. Supported format example: `192.168.1.2 192.168.1.0/24 192.168.2.0/255.255.255.0`. Default: `0.0.0.0/0` (all allowed)
`denied_hosts`	String	List of hosts and/or subnets to which access will be denied. The format is the same as for `allowed_hosts`. Default: (empty) (none denied)

Typical Usage

The following diagram shows a typical usage of NET for a simple mail server application that accesses the Internet for mail forwarding using NET:

Summary of Parts

in � input gateway appliance, class in
mailman - SMTP server appliance, class smpt
out - output gateway appliance, class net

in passes inbound connections to the mailman server. mailman serves the mail request and sends outbound mail through net gateway. The mail is sent in two steps for each messake: first, sending a DNS request for the target mail server and then sending the message to that server . The net gateway forwards the DNS request from the mailman server to the specified DNS server and makes the connection to the target mail server.

The following sections describe the configuration of net in several typical use cases:

Unrestricted access to standard domains

In this mode, NET is configured in a way very similar to a regular network gateway (e.g., for connecting a LAN to the Internet via ISP).

Example:

Property name	Value	Description
`ip_addr`	`192.168.1.12`	IP address of the external interface.
`netmask`	`255.255.255.0`	Network mask for the external interface.
`gateway`	`192.168.1.1`	Gateway for the external interface.
`dns1`	`192.168.1.2`	Primary DNS server.
`dns2`	`192.168.2.1`	Backup DNS server.

Many companies have internal domains that can be resolved only through their private DNS servers (e.g., .local or .localdomain). To use such domains, configure the dns1 and dns2 properties to point to those private DNS servers. Also see the possible hosts restrictions feature below.

Unrestricted access to standard domains using the root DNS servers.

In this mode, NET does not need specific DNS servers and uses a set of preconfigured Internet root servers.

Example:

Property name	Value	Description
`ip_addr`	`192.168.1.12`	IP address of the external interface.
`netmask`	`255.255.255.0`	Network mask for the external interface.
`gateway`	`192.168.1.1`	Gateway for the external interface.

In this mode, NET needs access to the root DNS servers (otherwise NET will fail all DNS queries). The gateway property must be specified.

Restricted access to private domains

In this mode, NET is restricted to accessing only specified networks, allowing and denying specific hosts and subnetworks.

Example:

Property name	Value	Description
`ip_addr`	`192.168.1.12`	IP address of the external interface.
`netmask`	`255.255.255.0`	Network mask for the external interface.
`gateway`	`192.168.1.1`	Gateway for the external interface.
`dns1`	`192.168.1.2`	Primary DNS server.
`dns2`	`192.168.2.1`	Backup DNS server.
`allowed_hosts`	`192.168.1.0/24 192.168.2.0/24`	Allowed subnets.
`denied_hosts`	`192.168.1.4 192.168.2.4`	These IP addresses will not be reachable.

In this mode, the DNS servers must be within the set of allowed hosts.

Notes

In general, the only type of output terminal that should be connected to NET's in terminal is a gateway output. These outputs differ from regular outputs by acting as "default gateways" for their appliances, allowing connections to multiple hosts (as opposed to the single-host access provided by regular outputs). Gateway outputs are shown visually with a blue square in the terminal shape, while regular outputs are shown with red arrows; see the usage example above.

For more information on the output terminal types, see the ADL Language Reference and the class editor help topic.

Connecting a regular output to the NET gateway will provide only DNS resolutions. This is a valid use of the NET gateway (essentially as a DNS resolution service).

If a host is present, directly or as part of a subnet, both in the allowed_hosts and in the denied_hosts lists, NET will deny access to that host. NET first rejects all denied hosts and then allows only those in allowed hosts (standard security practice).

If your application doesn't need access to a whole network but to a particular host (e.g., ftp.3tera.com), it is better to use the OUT gateway appliance.