MilsVPN VPN Tunnel Port Translation. Table of Contents Introduction VPN Tunnel Settings...2

Transcription

1 Page 1 of 8 Table of Contents Table of Contents Introduction VPN Tunnel Settings VPN Settings MilsVPN Service Properties Service Object Creation Firewall rules with PAT PAT Introduction PAT at the Active side PAT at the Passive side Verification Firewall Status at the Active side Firewall Status at the Passive side...8

2 Page 2 of 8 1. Introduction The present document explains how to use a port different from the standard one for the MilsVPN Tunnel between two MilsGates. The standard port for the MilsVPN Tunnel is Port 691. We recommend not changing this port unless there are severe constraints forcing you to do so. The description below proceeds from the fact that you have a VPN Tunnel with an Active and a Passive side. Only in this case the Firewall rules mentioned below are valid. 2. VPN Tunnel Settings 2.1 VPN Settings In the example below, the Active and the Passive sides have the following VPN Tunnel configuration: The Active side initiates the Tunnel by connecting to the external IP of the Passive side, while the Passive side is waiting for Tunnel initiation from the external IP of the Active side.

3 Page 3 of MilsVPN Service Properties Due to the fact that at the MilsGate of the Passive side we need to perform a redirect from one local IP address to another, we have to make sure that the VPN Service is listening to the required IPs. How to activate listening IP addresses for the MilsVPN Service: In the Config Tree of the MilsGate at the Passive side, open the [Service Properties] of the MilsVPN Service: Select the required [Service IPs] in the [Service Availability] and/or [Explicit Service IPs] fields: 3. Service Object Creation In order to be able to use e.g. TCP/UDP port 666 in the Firewall rules, we need to create a corresponding Service Object at the MilsGate at the Passive side as described below. How to create a new Service Object: In the Config Tree of the MilsGate at the Passive side, open the [Forwarding Rules] of the Firewall Service, go to [Services] and execute the [New] function of the context menu:

4 Page 4 of 8 Type in a [Name] for the new Service Object: Use the [New Object] button to create the two new ports TCP 666: and UDP 666:

5 Page 5 of 8 Verify that the final Service Object looks as below: 4. Firewall rules with PAT 4.1 PAT Introduction In order to use a different port for the MilsVPN Tunnel, you need to perform a Port Address Translation (PAT) from 691 to e.g. 666 at the Active side and to perform the inverse operation at the Passive side. PAT is made by adding the port number separated by a colon behind the target IP address in the [Redirection] field of a Firewall rule: 4.2 PAT at the Active side At the Active side, we have to translate the standard TCP/UDP port 691 to the desired port 666 in the Host Firewall. How to create the Redirect rule in the Host Firewall: In the Config Tree of the MilsGate at the Active side, open the [Host Firewall Rules] in the [Infrastructure Services]:

6 Page 6 of 8 In the [Outbound] tab execute the [New] function from the context menu: Create the following [Redirect] rule: Make sure that this newly created rule is placed above the standard [OP-SRV-VPN] rule: 4.3 PAT at the Passive side At the Passive side, we have to translate the TCP/UDP port 666 back to the standard port 691 in the Forwarding Firewall.

7 Page 7 of 8 How to create the Local Redirect rule in the Forwarding Firewall: In the Config Tree of the MilsGate at the Passive side, open the [Forwarding Rules] of the Firewall Service: In the [Main Rules] tab execute the [New] function from the context menu: Create the following [Local Redirect] rule:

8 Page 8 of 8 5. Verification 5.1 Firewall Status at the Active side In the Firewall [Status] tab of the MilsGate at the Active side, we can verify the correct port translation. The following two rules must be active: 5.2 Firewall Status at the Passive side In the Firewall [Status] tab of the MilsGate at the Passive side, we can verify the correct port translation. The following two rules must be active: