Continuity Cloud Virtual Firewall Guide

Transcription

1 Cloud Virtual Firwall Guid uh6 Vrsion 1.0 Octobr 2015 Foldr BDR Guid for Vam Pag 1 of 36

2 Cloud Virtual Firwall Guid CONTENTS INTRODUCTION... 3 ACCESSING THE VIRTUAL FIREWALL... 4 HYPER-V/VIRTUALBOX CONTINUITY CLOUD NODES... 4 VMWARE CONTINUITY CLOUD NODES... 4 CONFIGURING THE LAN INTERFACE... 5 DHCP SERVER CONFIGURATION... 6 FIREWALL RULES & NAT... 7 SET OUTBOUND TRAFFIC... 7 PORT FORWARDING... 8 OPENVPN NEW CERTIFICATE AUTHORITY NEW SERVER CERTIFICATE GENERAL SERVER INFORMATION SET UP REMOTE USER ACCOUNTS DOWNLOAD A FULLY-CONFIGURED OPEN VPN CLIENT SOFTWARE INSTALLER IPSEC VPN CONCLUSION Foldr, Inc. All rights rsrvd. Pag 2

3 Cloud Virtual Firwall Guid INTRODUCTION Each Foldr Continuity Cloud nod is provisiond with a virtual firwall to handl Intrnt traffic for your rstord virtual machins and provid scur accss to your srvrs. In this guid, you will larn how to: accss your assignd pfsns virtual firwall configur th LAN intrfac of th firwall st up rquird accss ruls or NAT translations to support your rstord nvironmnt. Additional Assistanc At Foldr, w valu fdback from our customrs. Not only do w want to hlp you quickly rsolv your tchnical issus, w valu your input and build our products to incorporat your suggstions. To contact Foldr Tchnical Support, call or Submit qustions to [email protected]. For how-to articls and FAQ, s th pfsns documntation at: Additional matrial is availabl in th Foldr Partnr Portal Th Foldr Support pag is at Copyright 2015 Foldr Inc. All rights rsrvd. All tradmarks ar th proprty of thir rspctiv ownrs. Foldr and th Foldr logo ar tradmarks of Foldr Inc. FOLDER MAKES NO WARRANTIES, EXPRESSED OR IMPLIED, IN THIS DOCUMENT Foldr, Inc. All rights rsrvd. Pag 3

4 Cloud Virtual Firwall Guid ACCESSING THE VIRTUAL FIREWALL Us th information providd by Foldr to gain accss to th pfsns virtual firwall running on your assignd Continuity Cloud (CC) Nod. Hypr-V/VirtualBox Continuity Cloud Nods 1. To accss th consol of your pfsns virtual firwall, first log in to your CC Nod, thn opn a wb browsr and go to th WAN Alias IP addrss of your virtual firwall. (It will look similar to th xampl shown blow.) This is a locally accssibl privat IP addrss. Thr is also a shortcut on th dsktop of th CC Nod. 2. Nxt, ntr th crdntials you rcivd from Foldr for your virtual firwall and click Login. Plas not that th usrnam and password ar cas snsitiv. VMwar Continuity Cloud Nods 1. To accss th consol of your pfsns virtual firwall, opn a wb browsr and go to th link providd by Foldr. It will look similar to th link blow. This is a publicly accssibl IP addrss, so you can accss this URL from any computr with an intrnt connction Nxt, ntr th crdntials you rcivd from Foldr for your virtual firwall and click Login. Plas not that th usrnam and password ar cas snsitiv Foldr, Inc. All rights rsrvd. Pag 4

5 Cloud Virtual Firwall Guid CONFIGURING THE LAN INTERFACE Configur th LAN intrfac of th pfsns virtual firwall with th propr IP addrss and subnt mask rquird for th virtual machins you ar rstoring. This IP addrss will srv as th dfault gatway for all virtual machins you rstor to th Continuity Cloud nod. 1. From th mnu, hovr ovr Intrfacs and thn slct LAN from th drop-down list: 2. In th Static IP configuration sction of th pag, ntr th IP addrss for th virtual firwall: IMPORTANT: Do not chck th block privat ntworks option. This would block traffic from th WAN-DMZ. This IP addrss will bcom th dfault gatway IP for virtual machins on your LAN. In th xampl shown abov, th VM usd to b on th ntwork /24 (ntmask ) with th dfault gatway having an IP of Mak sur that th Gatway is st to Non. Click Sav whn you r finishd. 3. At th top of th pag, click th Apply changs button: 2015 Foldr, Inc. All rights rsrvd. Pag 5

6 Cloud Virtual Firwall Guid DHCP SERVER CONFIGURATION Nxt, nabl and configur th DHCP srvr or lav it disabld within your nvironmnt. 1. In th mnu at th top of th pag, choos Srvics, DHCP Srvr. 2. Click th LAN tab. If you nd a DHCP srvr on th LAN ntwork, nabl th DHCP srvr and ntr th rang of IPs you want th DHCP srvr to us in its pool. Not: Typically you can lav th DNS srvr IPs blank, and it will us Foldr s DNS infrastructur. If you do not want th firwall to act as a DHCP srvr, unchck th option. Eithr way, click th Sav button at th bottom of th pag. 3. Click th Apply changs button Foldr, Inc. All rights rsrvd. Pag 6

7 Cloud Virtual Firwall Guid FIREWALL RULES & NAT Now, configur any rquird firwall ruls to allow xtrnal accss to srvics running on your rstord virtual machins. St outbound traffic 1. By dfault, all outbound traffic is allowd. If you want to disabl all outbound traffic as th dfault, brows to th Firwall mnu and thn Ruls. 2. Click th LAN tab. Find th rul from LAN nt to any dstination. Click th grn arrow on th lft to disabl th rul: 3. Thn click th Apply changs button Foldr, Inc. All rights rsrvd. Pag 7

8 Cloud Virtual Firwall Guid Port forwarding Nxt, st up any ports that nd to b forwardd from your assignd public IPs to intrnal IPs. 1. Hovr ovr Firwall in th main mnu and slct NAT. 2. Click th + icon to add a nw rul undr th Port Forward tab: Normally, you should lav th Intrfac st to WAN and Protocol st to TCP. 3. For th Dstination, choos th propr IP addrss that corrsponds to your dsird public IP. Not that th WAN addrss ntry is your primary public IP. If you hav additional public IP addrsss assignd, thy will b prsnt at th bottom of th drop-down list. In this xampl, w ar slcting th third WAN IP: XXX.XX 2015 Foldr, Inc. All rights rsrvd. Pag 8

9 Cloud Virtual Firwall Guid 4. From th Dstination port rang drop-down list, choos which protocol you want to forward, or you can manually ntr a rang of ports. In this xampl, w ar forwarding rmot dsktop: 5. For th Rdirct targt IP and Rdirct targt port, ntr th virtual LAN IP addrss of th srvr that should rciv th forwardd traffic. Th targt port should normally b th sam (in this xampl, rmot dsktop): 6. Typically, you should nabl th NAT rflction stting. This allows srvrs in your intrnal LAN to connct to forward ports using your assignd public IPs. (This is somtims calld NAT loopback.) Not that this may not work in all scnarios. 7. Th Filtr rul association stting dtrmins whthr to automatically add a rul to th Firwall ruls to allow th port-forwardd traffic. Slct Add associatd filtr rul. 8. Aftr you ar finishd configuring th port forward rul, click Sav. Thn click Apply Changs. Rpat this for all ports that you want to forward. Not: You can also stup 1:1 NAT if dsird. Normally you do not nd to customiz Outbound NAT Foldr, Inc. All rights rsrvd. Pag 9

10 Cloud Virtual Firwall Guid OPENVPN Configur an OpnVPN Srvr to allow rmot usrs accss to rsourcs on th LAN sid of th virtual firwall. 1. To accss th OpnVPN configuration, go to th navigation bar and slct OpnVPN from th VPN drop-down mnu. 2. Any configurd OpnVPN srvrs will b displayd hr. If non ar prsnt (as in th scrnshot blow), click on th Add icon to th right and bgin configuring a nw srvr. 3. Th Srvr Stup Wizard will launch. Ensur Local Usr Accss is slctd in th dropdown mnu and click Nxt Foldr, Inc. All rights rsrvd. Pag 10

11 Cloud Virtual Firwall Guid Nw crtificat authority Complt th form with your information for gnrating a nw crtificat authority. Ensur th Ky lngth is st to 4096 bit. All filds ar rquird. Aftr all of th filds ar complt, click Add nw CA Foldr, Inc. All rights rsrvd. Pag 11

12 Cloud Virtual Firwall Guid Nw srvr crtificat Complt th form with your information for gnrating a nw srvr crtificat. Ensur th Ky lngth is st to 4096 bit. All filds ar rquird. Aftr all of th filds ar complt, click Crat nw Crtificat Foldr, Inc. All rights rsrvd. Pag 12

13 Cloud Virtual Firwall Guid Gnral srvr information 1. St th Intrfac to WAN, Protocol to TCP, Local Port to 1194 and ntr a dscription for th OpnVPN srvr. 2. Configur th Cryptographic Sttings for th OpnVPN connctions as shown in th following scrnshot. Not: No TLS Shard Ky is rquird Foldr, Inc. All rights rsrvd. Pag 13

14 Cloud Virtual Firwall Guid 3. For Tunnl Sttings, st th Tunnl Ntwork to th uniqu privat ntwork to b usd for communication btwn th rmot hosts and this OpnVPN srvr. St th Local Ntwork to th LAN subnt of your pfsns firwall. This is th ntwork that will b accssibl to your rmot hosts that connct to th Opn VPN srvr. Ensur that Concurrnt Connctions is st high nough to accommodat th numbr of xpctd rmot hosts. All rmaining filds should b lft at thir dfaults, as shown blow Foldr, Inc. All rights rsrvd. Pag 14

15 Cloud Virtual Firwall Guid 4. For Clint Sttings, nabl Dynamic IP and Addrss Pool. St th DNS Dfault Domain to th domain nam you want appndd to th connction for rmot hosts. St th DNS Srvr 1 to th IP addrss of th rmot DNS srvr you want rmot hosts to us for nam rsolution. Enabl NtBIOS ovr TCP/IP to allow for propagation of NtBIOS traffic ovr th VPN connction. Aftr th abov filds ar configurd, click Nxt Foldr, Inc. All rights rsrvd. Pag 15

16 Cloud Virtual Firwall Guid 5. On th Firwall Rul Configuration scrn, nabl both chckboxs to allow all traffic to b opn to and from rmot hosts connctd ovr th VPN connction. Thn click Nxt. Click Finish on th compltion scrn Foldr, Inc. All rights rsrvd. Pag 16

17 Cloud Virtual Firwall Guid 6. Vrify th OpnVPN srvr has th Srvr mod st to Rmot Accss ( Usr Auth ) and Local Databas is slctd for Backnd authntication Foldr, Inc. All rights rsrvd. Pag 17

18 Cloud Virtual Firwall Guid St up Rmot Usr Accounts 1. To stup usr accounts for rmot usrs, hovr ovr Systm in th navigation bar and slct Usr Managr. 2. On th Usrs tab, slct th add usr button in th bottom right cornr Foldr, Inc. All rights rsrvd. Pag 18

19 Cloud Virtual Firwall Guid 3. St th Usrnam and Password for th nw usr. You can ntr a Full nam for your rfrnc, if ndd. Thn click Sav. Th nw usr account will now b listd on th Usrs tab of th Usr Managr Foldr, Inc. All rights rsrvd. Pag 19

20 Cloud Virtual Firwall Guid Download a fully-configurd Opn VPN clint softwar installr 1. To download a fully configurd OpnVPN Clint softwar installr, brows to th OpnVPN Srvr managr and click th Clint Export tab. NOTE: This installr will fully install and configur th clint softwar to a rmot host. Usrs will only nd to ntr thir usrnam and password aftr installation. 2. Undr th Clint Install Packags sction, slct th appropriat x86 or x64 clint softwar installr that you want to distribut to your rmot usrs. IPSEC VPN If you want to ti your virtual LAN to your actual LAN through an IPSc sit-to-sit VPN tunnl, plas s th dtaild instructions at: Foldr, Inc. All rights rsrvd. Pag 20

21 Cloud Virtual Firwall Guid CONCLUSION Congratulations - You hav now compltd th Foldr Continuity Cloud Virtual Firwall stup. If you hav any problms during this procdur or notic rrors in th log fil, plas call Foldr Tchnical Support at or or submit qustions to [email protected]. Additional Assistanc At Foldr, w valu fdback from our customrs. Not only do w want to hlp you quickly rsolv your tchnical issus, w valu your input and build our products to incorporat your suggstions. To contact Foldr Tchnical Support, call or Submit qustions to [email protected]. For how-to articls and FAQ, s th pfsns documntation at: Additional matrial is availabl in th Foldr Partnr Portal Th Foldr Support pag is at Th Popl Bhind Your Cloud 2015 Foldr, Inc. All rights rsrvd. Pag 21