This article describes a detailed configuration example that demonstrates how to configure Cyberoam to provide the access of internal resources.

Size: px

Start display at page:

Download "This article describes a detailed configuration example that demonstrates how to configure Cyberoam to provide the access of internal resources."

Osborn Stevenson
8 years ago
Views:

1 How To Configure Port Forwarding using Virtual Host to access devices on Internal network Applicable to versions build 14 or above This article describes a detailed configuration example that demonstrates how to configure Cyberoam to provide the access of internal resources. Article covers how to Create virtual host Create firewall rule to allow the inbound traffic Virtual host Virtual host implementation is based on the Destination NAT concept of older versions of Cyberoam. Virtual Host maps services of a public IP address to services of a host in a private network. In other words it is a mapping of public IP address to an internal IP address. This virtual host is used as the Destination address to access internal or DMZ server. A Virtual host can be a single IP address or an IP address range or Cyberoam interface itself. Cyberoam will automatically respond to the ARP request received on the WAN zone for the external IP address of Virtual host. Sample schema Throughout the article we will use the network parameters displayed in the below given network diagram. Outbound traffic from LAN and DMZ is allowed while inbound traffic is restricted. The public servers - mail and web server are hosted in DMZ. Network components External IP address (Public) IP address (Internal) Web server (Mapped) Mail server (Mapped) For virtual host: External IP: IP address through which Internet user s access internal server. Mapped IP: IP address bound to the internal server.

Article covers how to Create virtual host Create firewall rule to allow the inbound traffic Virtual host Virtual host implementation is based on the Destination NAT concept of older versions of

2 Configuration Entire configuration is to be done from Web Admin Console unless specified. Step 1: Create virtual host for Web server Go to Firewall Virtual Host Create and create virtual host with the parameters as specified in sample schema In our example, Internet users will access internal web server using public IP which is mapped to local IP In other words, all the inbound requests from will be forwarded to

parameters as specified in sample schema In our example, Internet users will access internal web server using public

3 Note If servers are hosted on LAN, change the Physical Zone to LAN. In case you have custom zones, change the Physical Zones accordingly. Public IP address is the IP address through which Internet user s access internal server/host. If public IP address is already configured as main Interface IP or alias IP, then use the option Interface IP to select it as an external IP or else select the option IP and add the Public IP Address. Step 2: Create virtual host for Mail server Go to Firewall Virtual Host Create and create virtual host with the parameters as specified in sample schema In our example, Internet users will access internal mail server using public IP which is mapped to local IP In other words, all the inbound requests from will be forwarded to

If public IP address is already configured as main Interface IP or alias IP, then use the option Interface IP to select it as an external IP or else select the option IP and add the Public IP Address.

4 Step 3: Loopback firewall rule Once the virtual host is created successfully, Cyberoam automatically creates a loopback firewall rule for the zone of the mapped IP address. Loopback firewall rule is created for the service specified in virtual host. Loopback rules allow same zone internal users to access the internal resources using its public IP (external IP) or FQDN.

Loopback firewall rule is created for the service specified in virtual host.

5 For our example, DMZ to DMZ firewall rule is created as virtual host (mapped IP address) belongs to DMZ interface subnet. Check creation of loopback rule from Firewall Manage Firewall Step 4: Add Firewall rules Rule 1 Go to Firewall Create Rule and create firewall rule for each server with the parameters as displayed in the below given screens. Click Create and the Firewall Rule for Webserver will be created successfully.

Check creation of loopback rule from Firewall Manage Firewall Step 4: Add Firewall rules Rule 1 Go to

6 Click Create and the Firewall Rule for Mailserver will be created successfully. Note Change the Destination Host according to the actual server Location (Zone). To create firewall rules to allow internal users to access resources in DMZ using its public IP (external IP) or FQDN follow the below mentioned steps: Go to Firewall Create Rule and create firewall rule for each server with the parameters as displayed in the below given screens. Click Create and the Firewall Rule for Webserver will be created successfully.

To create firewall rules to allow internal users to access resources in DMZ using its public IP (external IP) or FQDN follow the

7 Click Create and the Firewall Rule for Mailserver will be created successfully. Note: DO NOT Apply NAT for inbound SMTP rules. This will setup the MailServer as an OPEN RELAY. Document version /05/2011

How To Load balance traffic of Mail server hosted in the Internal network and redirect traffic over preferred Interface

How To Load balance traffic of Mail server hosted in the Internal network and redirect traffic over preferred Interface How To Configure load sharing and redirect mail server traffic over preferred Gateway