IN: Input Gateway Appliance

Latest version: 2.3.2

	At a Glance
	Catalog	System
	Category	Gateways
	User volumes	no
	Min. memory	64 MB
	OS	Linux
	Constraints	no
	Questions/Comments	Ask Forum

Functional overview

IN is an input gateway that provides a firewalled entry point for network traffic into an application.

IN accepts all allowed incoming traffic on its external interface and passes it through its out terminal. IN forwards only the traffic explicitly allowed through configuration of its firewall properties; IN discards all disallowed traffic.

IN supports up to 4 incoming interfaces (protocol/pair combinations), such as http, ssh, etc. By default, IN allows only tcp port 80 (http).

IN is used to accept all network traffic for applications. All external traffic must pass through an IN gateway to access any resources or services within an application.

Boundary

Resources

Terminals

The external interface is enabled. It is used for incoming traffic. The external interface is configured through the properties listed in the following sections.

The default interface is enabled. It is used for maintenance (incoming ssh connections).

User Volumes

None

Properties

Base Configuration

The following property group defines the base network settings for the gateway.

Firewall Configuration

The following property group defines the firewall settings for the gateway. There are two filters that can be used together: by source IP address (allowed_hosts and denied_hosts) and by protocol/port (ifaceX). Up to four protocol/port pairs (interfaces) can be configured.

If all parameters are left to their defaults, no traffic will be allowed. To allow traffic in, configure at least the iface1_protocol and iface1_port values.

The iface4 filter can be configured to allow incoming protocols other than tcp and udp.

All 4 interfaces can be configured independently; there is no requirement to have interface 1 and 2 in order to have 3. In particular, iface4 can be configured even if iface3 is not.

The port number for iface4 has slightly different behavior from the other port numbers. Setting iface4_port to 0 means that the port number is not going to be checked (works both for protocols that simply don't have port numbers, like GRE, and for tcp and udp). Setting iface{1,2,3}_port disables the interface (equivalent to setting the protocol to none).

Error Messages

The following messages may appear in either the appliance log file or the system log of the grid controller when the appliance fails to start:

• failed to start iptables
• Failed to set up rules (exit code code); using backup rule set
• Failed to set up backup rule set (exit code code)

Typical Usage

Simple Input Firewall

The following diagram shows a typical usage of IN for a simple web server application:

Summary of Parts

• in1 - input gateway
• web1 - apache web server appliance

in1 accepts HTTP requests on its external interface and passes them to web1 through its out terminal.

The web1 appliance used in this example is not shipped with AppLogic. However, AppLogic does provide a similar appliance named WEB.

Example:

Advanced Firewall

In this example, the gateway is configured to allow the HTTP and HTTPS protocols, as well as the PPTP protocol (used by MS Windows VPN).

Example:

In this example, note the use of iface4 for the GRE protocol. It is OK to fill iface4 even if lower-numbered interfaces are not filled in.

Notes

• If a host is present, directly or as part of a subnet, both in the allowed_hosts and in the denied_hosts lists, it will be denied access. IN first rejects all denied hosts and then allows only those in allowed hosts (standard security practice).

• IN is not used for accessing external services by the application. Applications access external services (outgoing traffic) through OUT and NET gateways.

• iface4_protocol has not been tested with protocols other than tcp and udp (due to lack of appliances supporting GRE or other non-tcp/udp protocol).

Related Documents

• Implementation Design

Questions and Comments

To post a question or comment on this appliance, visit our forum.

-- PeterNic - 31 Dec 2005