INSTALLATION MANUAL FOR THE EMS I-MO 540 SERIES APPLIANCE
Version
1.2
ELECTRONIC MEDIA SERVICES LIMITED
PASSFIELD BUSINESS CENTRE, LYNCHBOROUGH ROAD, LIPHOOK, HAMPSHIRE, GU30 7SB, UK
Tel:
01428 751655 |
Fax:
01428 751654 |
E-mail:
Page
37
of
58
With this option you can allow access to e.g. your mailserver. The machines must have valid public IP ad-
dresses.
The format of the rule is a space separated list of <source network>,<destination net-
work>[,protocol[,destination port[,flags]]]
If the protocol is icmp then port is interpreted as icmp type
The flags parameter is a comma separated list and may consist of one or more of the following:
•
ipsec
matches packets that originate from an IPsec tunnel
•
zonein=zone name
matches packets entering on interfaces in the specified zone
•
zoneout=zone name
matches packets leaving on interfaces in the specified zone
Examples:
•
"1.1.1.1,2.2.2.2" allow the host 1.1.1.1 to access any service on the host 2.2.2.2
•
"3.3.3.3/16,4.4.4.4/24" allow the network 3.3.3.3/16 to access any service in the network 4.4.4.4/24
•
"5.5.5.5,6.6.6.6,igmp" allow routing of IGMP messages from 5.5.5.5 to 6.6.6.6
•
"0/0,0/0,udp,514" always permit udp port 514 through the firewall
•
"192.168.1.0/24,10.10.0.0/16,,,ipsec \ 10.10.0.0/16,192.168.1.0/24,,,ipsec" permit traffic
from 192.168.1.0/24 to 10.10.0.0/16 and vice versa provided that both networks are connected via
an IPsec tunnel
•
"fd76:9dbb:91a3:1::/64,fd76:9dbb:91a3:4::/64,tcp,ssh" allow ssh from one IPv6 network to another
This following example shows masquerading enabled for all data from the local subnet except for the traffic
that will be routed over the VPN tunnel to the remote 10.0.0.0/24 subnet.
[fw]
enabled="yes"
masq="yes"
masqnets="0/0"
nomasqnets="192.168.0.0/24,10.0.0.0/24"
# Enable routing over the VPN tunnel between the remote and local IPs
# Note the rule includes both the forward and reverse direction!
forward="192.168.0.0/24,10.0.0.0/24 10.0.0.0/24,192.160.0.0/24"
The [tunneling] section configures one or more tunnels that are used for encrypting traffic or for bonding mul-
tiple physical links into a single logical link.
A tunnel is defined by setting its logical name. This should match the available tunnel names on the Concen-
trator.
The protocol version allows for communication with Concentrators running different i-MO releases. It should
normally be configured for a value of 2.
The IP is the internal endpoint of the tunnel on the i-MO appliance which is used on the Concentrator for
routing and must be unique.
The key is a shared secret used to authenticate the i-MO appliance with the Concentrator. The randomness
and length of the key affects the quality of the encryption if enabled. For applications that require good secu-
rity you should use a 16 or 32 character key and it should consist of numbers plus upper and lower case let-
ters. Standard dictionary words should not be used.