Novell ACCESS MANAGER 3.1 SP2 - README 2010, Manual

Page: 40 / 374

40 Novell Access Manager 3.1 SP2 Identity Server Guide
n
ov
do
cx (e
n)
16
Ap
ril 20
10
5 Add the following lines under the
fw_custom_before_port_handling()
section:
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to
10.10.0.1:8443
iptables -t nat -A OUTPUT -p tcp -o eth0 --dport 443 -j DNAT --to
10.10.0.1:8443
true
The first command rewrites all incoming requests with a destination TCP port of 443 to TCP
port 8443 on the 10.10.0.1 IP address for eth0. Modify the IP address to match the IP address of
your Identity Server.
The second command rewrites the health checks.
6
Select one of the following:

If you need to add commands for the SSL VPN server, continue with “Adding the SSL
VPN Commands” on page 40 .

If you don’t need to add any other commands, save the file, then continue with Step 7 .
7 At the system console, restart the firewall by executing the following command:
/etc/init.d/SuSEfirewall2_setup restart
8
After rebooting, verify that port 443 is being routed to the Identity Server by entering the
following command:
iptables -t nat -nvL
You should see an entry similar to the following:
pkts bytes target prot opt in out source
destination
17 748 DNAT tcp -- eth0 * 0.0.0.0/0 0.0.0.0/0
tcp dpt:443 to:10.10.0.1:8443
This entry states that eth0 is routing TCP port 443 to IP address 10.10.0.1:8443.
9 (Conditional) If your Identity Server cluster configuration contains more than one Identity
Server, repeat these steps on each server in the cluster.
Adding the SSL VPN Commands
These steps assume that you have completed at least Step 3 in “Adding the Identity Server
Commands” on page 39 .
1 Add the following lines to the
fw_custom_before_masq
section of the
/etc/sysconfig/
scripts/SuSEfirewall2-custom
file.
iptables -t nat -A POSTROUTING -s 10.8.0.0/16 -j SNAT --to 10.1.1.1
The 10.8.0.0/16 address is configured as a tunnel subnet, and the 10.1.1.1 address is your
private interface.
2 Add the following lines to the
fw_custom_before_denyall
section.
iptables -A $chain -j ACCEPT -s 10.8.0.0/22
iptables -A $chain -j ACCEPT -d 10.8.0.0/22
The file should look similar to the following: