Configuring NG Firewall for AWS using routed subnets - Revision history

Bcarmichael: /* Step 3. Create an internal subnet */

2020-05-14T23:28:48Z

Step 3. Create an internal subnet

← Older revision		Revision as of 23:28, 14 May 2020
Line 33:		Line 33:
	#Click '''Create Subnet'''.		#Click '''Create Subnet'''.
	#Select the VPC containing your NG Firewall and AWS instances.		#Select the VPC containing your NG Firewall and AWS instances.
	#Select an availability zone.		#Select the same availability zone as your NG Firewall instance.
	#Assign an IPv4 block that is within the scope of your VPC.		#Assign an IPv4 block that is within the scope of your VPC.
	#Click '''Create''' to confirm the new subnet.		#Click '''Create''' to confirm the new subnet.

Bcarmichael: /* Step 1. Configure a Security Group */

2018-08-31T16:32:44Z

Step 1. Configure a Security Group

← Older revision		Revision as of 16:32, 31 August 2018
Line 11:		Line 11:
	#In the [https://aws.amazon.com/console AWS Management Console] go to your VPC configuration from the '''Services''' menu.		#In the [https://aws.amazon.com/console AWS Management Console] go to your VPC configuration from the '''Services''' menu.
	#Click '''Security Groups'''.		#Click '''Security Groups'''.
	#Select the default security group or a custom security group you designate for instances belonging to your internal subnet.[[File:Aws-securitygroups-inbound.png\|none\|thumb\|upright=1.2\|Security group with permissive inbound rule]]		#Select the default security group or a custom security group you designate for instances belonging to your internal subnet.
	~~#In the Inbound Rules tab, click '''Edit'''.~~		#In the Inbound Rules tab, click '''Edit'''.[[File:Aws-securitygroups-inbound.png\|none\|thumb\|upright=1.2\|Security group with permissive inbound rule]]
	#Add or confirm a rule allowing all traffic for all protocols where the source is 0.0.0.0/0.		#Add or confirm a rule allowing all traffic for all protocols where the source is 0.0.0.0/0.
	#Confirm this same policy in the Outbound Rules tab.		#Confirm this same policy in the Outbound Rules tab.

Bcarmichael: /* Step 1. Configure a Security Group */

2018-08-31T16:32:09Z

Step 1. Configure a Security Group

← Older revision		Revision as of 16:32, 31 August 2018
Line 11:		Line 11:
	#In the [https://aws.amazon.com/console AWS Management Console] go to your VPC configuration from the '''Services''' menu.		#In the [https://aws.amazon.com/console AWS Management Console] go to your VPC configuration from the '''Services''' menu.
	#Click '''Security Groups'''.		#Click '''Security Groups'''.
	#Select the default security group or a custom security group you designate for instances belonging to your internal subnet.[[File:Aws-securitygroups-inbound.png\|thumb\|upright=1.2\|Security group with permissive inbound rule]]		#Select the default security group or a custom security group you designate for instances belonging to your internal subnet.[[File:Aws-securitygroups-inbound.png\|none\|thumb\|upright=1.2\|Security group with permissive inbound rule]]
	#In the Inbound Rules tab, click '''Edit'''.		#In the Inbound Rules tab, click '''Edit'''.
	#Add or confirm a rule allowing all traffic for all protocols where the source is 0.0.0.0/0.		#Add or confirm a rule allowing all traffic for all protocols where the source is 0.0.0.0/0.

Bcarmichael: /* Step 1. Configure a Security Group */

2018-08-31T16:31:40Z

Step 1. Configure a Security Group

← Older revision		Revision as of 16:31, 31 August 2018
Line 7:		Line 7:

	== Step 1. Configure a Security Group ==		== Step 1. Configure a Security Group ==
	~~[[File:Aws-securitygroups-inbound.png\|thumb\|upright=1.2\|Security group with permissive inbound rule]]~~AWS instances and network interfaces inherit traffic rules defined by [https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html security groups]. The security group assigned to your NG Firewall instance and instances on the private network behind NG Firewall should have an open policy to avoid conflicts. Confirm that the security group designated for your instances has rules to permit all incoming and outgoing traffic.		AWS instances and network interfaces inherit traffic rules defined by [https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html security groups]. The security group assigned to your NG Firewall instance and instances on the private network behind NG Firewall should have an open policy to avoid conflicts. Confirm that the security group designated for your instances has rules to permit all incoming and outgoing traffic.

	#In the [https://aws.amazon.com/console AWS Management Console] go to your VPC configuration from the '''Services''' menu.		#In the [https://aws.amazon.com/console AWS Management Console] go to your VPC configuration from the '''Services''' menu.
	#Click '''Security Groups'''.		#Click '''Security Groups'''.
	#Select the default security group or a custom security group you designate for instances belonging to your internal subnet.		#Select the default security group or a custom security group you designate for instances belonging to your internal subnet.[[File:Aws-securitygroups-inbound.png\|thumb\|upright=1.2\|Security group with permissive inbound rule]]
	#In the Inbound Rules tab, click '''Edit'''.		#In the Inbound Rules tab, click '''Edit'''.
	#Add or confirm a rule allowing all traffic for all protocols where the source is 0.0.0.0/0.		#Add or confirm a rule allowing all traffic for all protocols where the source is 0.0.0.0/0.

Bcarmichael: /* Overview */

2018-08-31T16:30:51Z

Overview

← Older revision		Revision as of 16:30, 31 August 2018
Line 1:		Line 1:
	== Overview ==		== Overview ==
	Untangle NG Firewall deployment in AWS can secure Internet access for other AWS instances. This scenario is useful if you have for example [https://aws.amazon.com/workspaces Amazon Workspaces] and you need to apply Intrusion Prevention, Content Filtering, Bandwidth Control, and other next generation firewall capabilities to those instances. This type of deployment requires advanced Virtual Private Cloud (VPC) configuration to establish an internal subnet for AWS instances that routes through NG Firewall.[[File:Aws_schemas_advanced.png\|thumb\|none\|upright=1.5\|alt=Diagram illustrating Untangle NG Firewall in relation to AWS instances and VPN tunnels.\|Diagram illustrating Untangle NG Firewall in relation to AWS instances and VPN tunnels.]]		[[File:Aws_schemas_advanced.png\|thumb\|right\|upright=1.4\|alt=Untangle NG Firewall in relation to AWS instances and VPN tunnels.\|Untangle NG Firewall in relation to AWS instances and VPN tunnels.]]Untangle NG Firewall deployment in AWS can secure Internet access for other AWS instances. This scenario is useful if you have for example [https://aws.amazon.com/workspaces Amazon Workspaces] and you need to apply Intrusion Prevention, Content Filtering, Bandwidth Control, and other next generation firewall capabilities to those instances. This type of deployment requires advanced Virtual Private Cloud (VPC) configuration to establish an internal subnet for AWS instances that routes through NG Firewall.

	== Before you begin ==		== Before you begin ==

Bcarmichael: /* Step 9. Associate the route table */

2018-08-31T15:26:10Z

Step 9. Associate the route table

← Older revision		Revision as of 15:26, 31 August 2018
Line 85:		Line 85:
	== Step 9. Associate the route table ==		== Step 9. Associate the route table ==
	To associate the route table to your internal subnet:		To associate the route table to your internal subnet:
	#Select the new route table entry and click '''Subnet Associations''' from the configuration panel. [[File:Aws-associate-subnet.png\|thumb\|none\|upright=1.4\|Associating a subnet in AWS]]		#Select the new route table entry and click '''Subnet Associations''' from the configuration panel.
	~~#Click '''Edit''' and associate the route table to your internal subnet.~~		#Click '''Edit''' and associate the route table to your internal subnet.[[File:Aws-associate-subnet.png\|thumb\|none\|upright=1.4\|Associating a subnet in AWS]]
	#Click '''Save'''.		#Click '''Save'''.

Bcarmichael: /* Step 9. Associate the route table */

2018-08-31T15:25:42Z

Step 9. Associate the route table

← Older revision		Revision as of 15:25, 31 August 2018
Line 85:		Line 85:
	== Step 9. Associate the route table ==		== Step 9. Associate the route table ==
	To associate the route table to your internal subnet:		To associate the route table to your internal subnet:
	#Select the new route table entry and click '''Subnet Associations''' from the configuration panel. [[File:Aws-~~default~~-~~route~~.png\|thumb\|none\|upright=1.4\|Associating a subnet in AWS]]		#Select the new route table entry and click '''Subnet Associations''' from the configuration panel. [[File:Aws-associate-subnet.png\|thumb\|none\|upright=1.4\|Associating a subnet in AWS]]
	#Click '''Edit''' and associate the route table to your internal subnet.		#Click '''Edit''' and associate the route table to your internal subnet.
	#Click '''Save'''.		#Click '''Save'''.

Bcarmichael: /* Step 9. Associate the route table */

2018-08-31T15:25:05Z

Step 9. Associate the route table

← Older revision		Revision as of 15:25, 31 August 2018
Line 85:		Line 85:
	== Step 9. Associate the route table ==		== Step 9. Associate the route table ==
	To associate the route table to your internal subnet:		To associate the route table to your internal subnet:
	#Select the new route table entry and click '''Subnet Associations''' from the configuration panel. [[File:Aws-default-route.png\|thumb\|none\|upright=1.2\|Associating a subnet in AWS]]		#Select the new route table entry and click '''Subnet Associations''' from the configuration panel. [[File:Aws-default-route.png\|thumb\|none\|upright=1.4\|Associating a subnet in AWS]]
	#Click '''Edit''' and associate the route table to your internal subnet.		#Click '''Edit''' and associate the route table to your internal subnet.
	#Click '''Save'''.		#Click '''Save'''.

Bcarmichael: /* Step 9. Associate the route table */

2018-08-31T15:24:47Z

Step 9. Associate the route table

← Older revision		Revision as of 15:24, 31 August 2018
Line 85:		Line 85:
	== Step 9. Associate the route table ==		== Step 9. Associate the route table ==
	To associate the route table to your internal subnet:		To associate the route table to your internal subnet:
	#Select the new route table entry and click '''Subnet Associations''' from the configuration panel.		#Select the new route table entry and click '''Subnet Associations''' from the configuration panel. [[File:Aws-default-route.png\|thumb\|none\|upright=1.2\|Associating a subnet in AWS]]
	#Click '''Edit''' and associate the route table to your internal subnet.		#Click '''Edit''' and associate the route table to your internal subnet.
	#Click '''Save'''.		#Click '''Save'''.

Bcarmichael: /* Check your Untangle Instance */

2018-08-31T15:23:46Z

Check your Untangle Instance

← Older revision		Revision as of 15:23, 31 August 2018
Line 88:		Line 88:
	#Click '''Edit''' and associate the route table to your internal subnet.		#Click '''Edit''' and associate the route table to your internal subnet.
	#Click '''Save'''.		#Click '''Save'''.

	~~==<span style="color: #000000; font-weight: 400; text-decoration: none;">Check your Untangle Instance </span>==~~
	~~# <span style="color: #000000; font-weight: 400; text-decoration: none;">Navigate to Services → EC2 → </span>~~
	~~## <span style="color: #000000; font-weight: 400; text-decoration: none;">Verify the Instance is running</span>~~
	~~## <span style="color: #000000; font-weight: 400; text-decoration: none;">Make note of the Public IP</span><span style="color: #000000; font-weight: 400; text-decoration: none;"></span>~~
	~~# <span style="color: #000000; font-weight: 400; text-decoration: none;">Login to Untangle</span>~~
	## <span style="color: #000000; font-weight: 400; text-decoration: none;">Point your browser at: https://</span>''<span style="color: #000000; font-weight: 400; text-decoration: none;"><publicIP> e.g.: </span>''[https://34.22.127.3 ''<u>https://34.22.127.3</u>'']
	~~## <span style="color: #000000; font-weight: 400; text-decoration: none;">Configure Untangle~~
	<br>Your browser may show a message indicating that connecting to your new server needs caution. This message is simply telling you that there isn't yet a server certificate in place because the server is not yet configured. Once the Untangle setup process is complete, this warning will no longer occur when you direct a browser to your new server.