Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 8 replies
  • Subscribers 6 subscribers
  • Views 13984 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Publish app server and TCP port to internet - WAF or DNAT?

mahaddon

Hi

I'm running ASG software UTM v9.411 which is installed as a backend proxy.  UTM has internal and DMZ interfaces and edge firewall NATs public facing IPs through to UTM DMZ interface additional IPs for my WAF standard HTTP/S webserver rules which are working fine.

I now need to publish an application server to the internet so that my app devs can roll out an android app.  The app connects to a FQDN.  The app connects to the app server over a non web TCP port e.g. TCP.4321.  I've tested using WAF for the FQDN and DNAT for the custom port and I'm obviously doing something wrong.  Get so far with DNAT but can't work out where the issue is.

My DNAT rule

No Group, position 1 (no other DNAT rules)

DNAT (Destination)

Matching Condition

For traffic from: Any

Using Service:  custom defined service definition e.g. TCP.4321

Going to:  External (WAN) "server DMZ listener IP" [Address] where this is the additional IP added to the external interface

Action

Change the destination to: "internal app server network definition"

Automatic firewall rule & Log initial packets both ticked

 

My app dev can sucecssfully test from his smartphone over the internal network so we know that the app can connect to the app server directly.

When he tests over an external 4g connection he gets a connection error.  Firewall log shows a single entry

TIME   NAT rule #1   TCP   SOURCEIP:37177   →  UTMAdditionalIP:4321   [SYN]   len=60   ttl=47   tos=0x00   srcmac=MAC ADDRESS   dstmac=MAC ADDRESS

Edge firewall logs looked clear and nothing is showing in my WAF log presumably because the traffic is hitting DNAT first but I'm assuming that I can't do this with WAF anyway?

For info, my WAF rule Virtual Server is set as Encrypted (HTTPS) & redirect with a port set to the custom port e.g.4321 and a certificate approrpiate to the FQDN.  I've also set the custom port in the port field for the Encrypted (HTTPS) Real Webserver definition.



This thread was automatically locked due to age.
  • 0

    Hi,

    I don't beleive you need the WAF rule for the custom port.  Essentially, it should be the same kind of setup as if you were publishing FTP or SSH from your internal app server i.e. just the DNAT rule.

  • 0

    Waf expects standard html trafcic.  If you are passing that content, the port does not matter.  If you are wrapping non-HTML traffic, WAF is limely to take ofcense and block stuff.

  • 0 in reply to DouglasFoster

    Shaun and Douglas, thanks for the replies.  Interesting and kindov what my thinking was although I wasn't sure why so these explanations are helpful.  Just have to work out why the DNAT isn't working now and how to work out where it's breaking

  • 0 in reply to mahaddon

    While you have the DNAT, WAF will not trigger (DNAT triggers first), so the WAF rule will have no effect.

    The single rule you see in your firewall log, I suppose its a white-colored rule. You can also view the automatically created firewall rules and then find the corresponding rule (automatically created by the DNAT rule), edit it and enable logging. That way you should also be able to see that the actual NAT traffic is also allowed.

    Since I expect this to also give a green (allowed) log message due to automatic firewall ticked, also check your IPS logs to see if it's blocked from there.

    Managing several Sophos firewalls both at work and at some home locations, dedicated to continuously improve IT-security and feeling well helping others with their IT-security challenges.

  • 0 in reply to apijnappels

    ahhh.  I had looked at the firewall rules and didn't see the automatically created rule.  Bit of a Homer moment I reckon.  I looked again and spotted the dropdown list to select auto created rules and have now enabled logging on the auto rule.

    Thanks for the help

  • 0 in reply to apijnappels

    and yes it was a white rule.  we're not using IPS (this is a backend firewall so we're leaving that to edge firewall to improve UTM performance) so IPS logs are empty

  • 0 in reply to mahaddon

    Still only seeing the white firewall log entry however the app dev showed me the app error and it's a "timeout of 10000ms esceeded" error so I've asked him to speak to his app supplier to see if that can be increased.  10 second timeout through UTM WAF/DNAT seems a bit hopeful to me  :)

  • 0 in reply to mahaddon

    Found entries in the full archive firewall log.  I've edited it to remove IP/mac details but it all looks OK to me.  I'm assuming that fwrule="62001" is the DNAT rule and fwrule="3000000001" is the auto created firewall rule? 

    /var/log/packetfilter.log:2017:09:13-09:08:46 UTM ulogd[26430]: id="2000" severity="info" sys="SecureNet" sub="packetfilter" name="Packet logged" action="log" fwrule="62001" initf="external interface" srcmac="client mac" dstmac="server mac" srcip="client IP" dstip="internal app server IP" proto="6" length="60" tos="0x00" prec="0x00" ttl="47" srcport="48255" dstport="custom TCP port" tcpflags="SYN"

    /var/log/packetfilter.log:2017:09:13-09:08:46 UTM ulogd[26430]: id="2002" severity="info" sys="SecureNet" sub="packetfilter" name="Packet accepted" action="accept" fwrule="3000000001" initf="external interface" outitf="internal interface" srcmac="client mac" dstmac="server mac" srcip="client IP" dstip="internal app server IP" proto="6" length="60" tos="0x00" prec="0x00" ttl="46" srcport="48255" dstport="custom TCP port" tcpflags="SYN"

    09:03:46   NAT rule #1   TCP   "client IP":41112  →  "Ext interface additional IP":"custom TCP port"   [SYN]   len=60   ttl=47   tos=0x00   srcmac="client mac"   dstmac="app server mac"
    09:03:46   Auto-generated rule #1   TCP   "client IP":41112  →  "internal app server IP":"custom TCP port"   [SYN]   len=60   ttl=46   tos=0x00   srcmac="client mac"   dstmac="app server mac"

    thanks

    Mark

Unfiltered HTML