IN2: Input Gateway Appliance

Latest version: 1.0.5-1

	At a Glance
	Catalog	System
	Category	Beta
	User volumes	no
	Min. memory	64 MB
	OS	Linux
	Constraints	no
	Questions/Comments	Ask Forum

Functional overview

IN2 is not available in AppLogic 2.8+. Please use IN instead.

IN2 is an input gateway that provides a firewalled entry point for network traffic into an application. External traffic passes through an IN2 gateway to access resources or services within an application.

IN2 accepts all allowed incoming traffic on its external interface and passes it through its out terminal. IN2 forwards only the traffic explicitly allowed through configuration of its firewall properties; all other traffic is discarded.

IN2 supports up to 4 incoming interfaces (protocol/pair combinations), such as http, ssh, etc. By default, IN2 allows only tcp port 80 (http).

If the log terminal is connected then IN2 logs via the log terminal to a remote syslog server.

IN2 is implemented using BusyBox to provide a small and efficient environment tailored to support its functionality. It boots from a read-only volume and uses a 2MB ramdisk to store files which change during boot or run time.

Please note: the log terminal is not used for storing logs on a mounted cifs file system, but rather for sending logging messages to a remote syslog server. In the future other AppLogic appliances will be updated to log via their log terminals to a remote syslog server.

Boundary

Resources

Terminals

Name	Dir	Protocol	Description
out	out	any	Sends all traffic out to the destination address and receives the responses.
log	out	syslog	Sends logging messages using the syslog protocol. This terminal may be left unconnected if it is not used. Please note: the log terminal is not used for storing logs on a mounted cifs file system, but rather for sending logging messages to a remote syslog server.
mon	out	cce	Sends performance and resource usage statistics.

The external interface is enabled. It is used for incoming traffic. The external interface is configured through the properties listed in the following sections.

The default interface is enabled. It is used for maintenance (incoming ssh connections).

Boot volume

IN2 appliance is based on custom Linux distribution with a read-only boot volume and inherits its file system layout. Almost all files reside on the boot volume. Files or folders that need to be modified either reside on the RAM drive or are symbolic links to the RAM drive.
Any changes applied to an instance of the IN2 appliance will be lost after appliance stop or restart.

User Volumes

None

Properties

Base Configuration

The following property group defines the base network settings for the gateway.

Firewall Configuration

The following property group defines the firewall settings for the gateway. There are two filters that can be used together: by source IP address (allowed_hosts and denied_hosts) and by protocol/port (ifaceX). Up to four protocol/port pairs (interfaces) can be configured.

If all parameters are left to their defaults, only tcp port 80 will be allowed.

The iface4 filter can be configured to allow incoming protocols other than tcp and udp.

All 4 interfaces can be configured independently; there is no requirement to have interface 1 and 2 in order to have 3. In particular, iface4 can be configured even if iface3 is not.

The port number for iface4 has slightly different behavior from the other port numbers. Setting iface4_port to 0 means that the port number is not going to be checked (works both for protocols that simply don't have port numbers, like GRE, and for tcp and udp). Setting iface{1,2,3}_port disables the interface (equivalent to setting the protocol to none).

Error Messages

The following messages may appear in either the appliance log file or the system log of the grid controller when the appliance fails to start:

• Failed to start iptables
• Failed to set up rules (exit code code); using backup rule set
• Failed to set up backup rule set (exit code code)

Typical Usage

Simple Input Firewall

The following diagram shows a typical usage of IN2 for a simple web server application:

Summary of Parts

• IN2 - input gateway
• web - apache web server appliance

IN2 accepts HTTP requests on its external interface and passes them to web through its out terminal.

Example:

Advanced Firewall

In this example, the gateway is configured to allow the HTTP and HTTPS protocols, as well as the PPTP protocol (used by MS Windows VPN).

Example:

In this example, note the use of iface4 for the GRE protocol. It is OK to fill iface4 even if lower-numbered interfaces are not filled in.

Notes

• If a host matches, directly or as part of a subnet, both the allowed_hosts and the denied_hosts lists, it will be denied access. IN2 first rejects all denied hosts and then allows only those in allowed hosts (standard security practice).

• IN2 can not be used for accessing external services by the application. Applications access external services (outgoing traffic) through OUT2 and NET2 gateways.

• iface4_protocol has not been tested with protocols other than tcp and udp (due to lack of appliances supporting GRE or other non-tcp/udp protocol).

Open source and 3rd party software used inside of the appliance

IN2 use the following open source and 3rd party packages in addition to its base install of Busybox OS.

To see the full list of open source packages used in this appliance, please see its implementation design.

Related Documents

• Implementation Design
• Test Plan

Questions and Comments

To post a question or comment on this appliance, visit our forum.

-- AndriyMayevskyy - 27 Jul 2009