RuggedCom RuggedRouter RX1000 用户手册
RuggedRouter
User Guide
Gauntlet Security
RX1100 owners can use the Gauntlet security appliance to restrict access to critical
assets. This section details how to activate Gauntlet and determine currently
negotiated sessions. Details and recommendations on applying the Gauntlet system
to networking may be found in texts referenced in the About This Guide section of
the user guide.
assets. This section details how to activate Gauntlet and determine currently
negotiated sessions. Details and recommendations on applying the Gauntlet system
to networking may be found in texts referenced in the About This Guide section of
the user guide.
What And How Gauntlet Protects
Gauntlet protects against unauthorized access to critical assets, including the router
itself. Gauntlet allows connection from known management devices to assets behind
the firewall operating on known TCP/UDP port numbers. Gauntlet does not encrypt
communications which occur in the clear, such as the Telnet protocol. Protocols such
as SSH and HTTPS offer their own encryption and are suitable for use with Gauntlet.
itself. Gauntlet allows connection from known management devices to assets behind
the firewall operating on known TCP/UDP port numbers. Gauntlet does not encrypt
communications which occur in the clear, such as the Telnet protocol. Protocols such
as SSH and HTTPS offer their own encryption and are suitable for use with Gauntlet.
Gauntlet And The Firewall
Gauntlet integrates tightly with the firewall, opening it for communications between
vetted clients and critical assets on a demand basis. There are three steps in
activating the Gauntlet security appliance.
vetted clients and critical assets on a demand basis. There are three steps in
activating the Gauntlet security appliance.
1. The firewall must be configured with some default rules required by the
appliance (described below), and then activated or restarted.
2. The rrsetup utility must be used to configure a Gauntlet passphrase and enable
the Gauntlet daemon.
3. The Gauntlet daemon and Shorewall must both be enabled in the Webmin
Bootup and Shutdown Menu to "Start at boot".
Shorewall requires you to assign the router interfaces to zones and then control traffic
between these zones.
Typically, the zone for WAN interfaces is named "net" while the zone for local
interfaces is named "loc". The following instructions assume those names.
The gauntlet daemon requires rules for certain ports (shown below) to be installed.
Contact RuggedCom support for assistance if you wish to reassign these ports.
between these zones.
Typically, the zone for WAN interfaces is named "net" while the zone for local
interfaces is named "loc". The following instructions assume those names.
The gauntlet daemon requires rules for certain ports (shown below) to be installed.
Contact RuggedCom support for assistance if you wish to reassign these ports.
1. Visit the Shorewall Network Zones sub-menu and create the net and loc IPv4
zones.
2. Visit the Network Interfaces sub-menu and assign interfaces to the zones.
3. Visit the Default Policies sub-menu and assign the following policies:
3. Visit the Default Policies sub-menu and assign the following policies:
Source zone
Destination zone
Policy
fw
any
ACCEPT
loc
net
ACCEPT
all
any
REJECT
4. Visit the Firewall Rules sub-menu and assign the following rules:
Action
Source zone Destination zone Protocol
Src-Port
Dst-Port
ACCEPT
net
fw
UDP
any
30000
ACCEPT
net
fw
UDP
any
30001
Gauntlet
net
loc
Gauntlet
net
fw
TCP
any
31000
Gauntlet
net
fw
TCP
any
31002
240 RuggedCom