RuggedCom RX1000 Gauntlet Security, What And How Gauntlet Protects, Gauntlet And The Firewall

RuggedRouter™ User Guide

Gauntlet Security

RX1100 owners can use the Gauntlet security appliance to restrict access to critical assets. This section details how to activate Gauntlet and determine currently negotiated sessions. Details and recommendations on applying the Gauntlet system to networking may be found in texts referenced in the About This Guide section of the user guide.

What And How Gauntlet Protects

Gauntlet protects against unauthorized access to critical assets, including the router itself. Gauntlet allows connection from known management devices to assets behind the firewall operating on known TCP/UDP port numbers. Gauntlet does not encrypt communications which occur in the clear, such as the Telnet protocol. Protocols such as SSH and HTTPS offer their own encryption and are suitable for use with Gauntlet.

Gauntlet And The Firewall

Gauntlet integrates tightly with the firewall, opening it for communications between vetted clients and critical assets on a demand basis. There are three steps in activating the Gauntlet security appliance.

1.The firewall must be configured with some default rules required by the appliance (described below), and then activated or restarted.

2.The rrsetup utility must be used to configure a Gauntlet passphrase and enable the Gauntlet daemon.

3.The Gauntlet daemon and Shorewall must both be enabled in the Webmin Bootup and Shutdown Menu to "Start at boot".

Shorewall requires you to assign the router interfaces to zones and then control traffic between these zones.

Typically, the zone for WAN interfaces is named "net" while the zone for local interfaces is named "loc". The following instructions assume those names.

The gauntlet daemon requires rules for certain ports (shown below) to be installed. Contact RuggedCom support for assistance if you wish to reassign these ports.

1.Visit the Shorewall Network Zones sub-menu and create the net and loc IPv4 zones.

2.Visit the Network Interfaces sub-menu and assign interfaces to the zones.

3.Visit the Default Policies sub-menu and assign the following policies:

Source zone	Destination zone	Policy
fw	any	ACCEPT
loc	net	ACCEPT
all	any	REJECT

4. Visit the Firewall Rules sub-menu and assign the following rules:

Action	Source zone	Destination zone	Protocol	Src-Port	Dst-Port
ACCEPT	net	fw	UDP	any	30000
ACCEPT	net	fw	UDP	any	30001
Gauntlet	net	loc
Gauntlet	net	fw	TCP	any	31000
Gauntlet	net	fw	TCP	any	31002

240 RuggedCom