Configuring NG Firewall for AWS using routed subnets

Overview

Untangle NG Firewall deployment in AWS can secure Internet access for other AWS instances. This scenario is useful if you have for example Amazon Workspaces and you need to apply Intrusion Prevention, Content Filtering, Bandwidth Control, and other next generation firewall capabilities to those instances. This type of deployment requires advanced Virtual Private Cloud (VPC) configuration to establish an internal subnet for AWS instances that routes through NG Firewall.

Diagram illustrating Untangle NG Firewall in relation to AWS instances and VPN tunnels.

Before you begin

• Follow the steps outlined in Deploying NG Firewall in AWS.
• Review VPCs and Subnets in the AWS documentation.

Step 1. Configure a Security Group

Security group with permissive inbound rule

AWS instances and network interfaces inherit traffic rules defined by security groups. The security group assigned to your NG Firewall instance and instances on the private network behind NG Firewall should have an open policy to avoid conflicts. Confirm that the security group designated for your instances has rules to permit all incoming and outgoing traffic.

1. In the AWS Management Console go to your VPC configuration from the Services menu.
2. Click Security Groups.
3. Select the default security group or a custom security group you designate for instances belonging to your internal subnet.
4. In the Inbound Rules tab, click Edit.
5. Add or confirm a rule allowing all traffic for all protocols where the source is 0.0.0.0/0.
6. Confirm this same policy in the Outbound Rules tab.

Step 2. Configure a Network ACL

Network ACL with permissive inbound rule

Each subnet inherits the policies of network ACLs. Confirm that the network ACL designated for your internal subnet contain rules to permit all incoming and outgoing traffic.

1. In the AWS Management Console go to your VPC configuration from the Services menu.
2. Click Network ACLs.
3. Select the default network ACL or a custom network ACL if designated for your internal subnet.
4. In the Inbound Rules tab, click Edit.
5. Add or confirm a rule allowing all traffic for all protocols where the source is 0.0.0.0/0.
6. Confirm this same policy in the Outbound Rules tab.

Step 3. Create an internal subnet

AWS subnet configuration wizard

To route traffic for AWS instances through NG Firewall you must designate an internal [subnet]. You assign this subnet to network interfaces belonging to your AWS instances and NG Firewall.

1. In the [AWS Management Console] go to your VPC configuration from the Services menu.
2. Click Subnets.
3. Click Create Subnet.
4. Select the VPC containing your NG Firewall and AWS instances.
5. Select an availability zone.
6. Assign an IPv4 block that is within the scope of your VPC.
7. Click Create to confirm the new subnet.

Step 4. Create a network interface

Network interfaces in AWS attach to instances and facilitate network access to the VPC. The NG Firewall and instances protected by the firewall must be assigned to the internal subnet you created in the previous step. If you created your instances and network interfaces prior to creating the internal subnet, you can create new network interfaces to associate your instances to the internal subnet.

1. In the AWS Management Console go to your EC2 configuration from the Services menu.
2. Click Network Interfaces.
3. Click Create Network Interface.

   

   AWS network interface configuration wizard

4. Select the internal subnet you created in the previous step.
5. Keep Private IP as auto assign.
6. Select the permissive security group you created in the first step.
7. Click Yes, Create.

Step 5. Attach the network interface

Attaching a network interface to an instance in AWS

After you create a network interface you must attach it to an instance.

1. In the Network Interfaces screen select an available interface that belongs to the internal subnet.
2. In the Actions menu choose Attach.
3. Select the Instance ID of your NG Firewall
4. Repeat the steps for creating and attaching network interfaces for all instances that you intend to place on the internal subnet.

If you attach a new network interface to an instance other than NG Firewall, it is recommended to detach the previous network interface to prevent traffic from bypassing NG Firewall. To detach an interface, select the network interface and choose Detach from the Actions menu.

Routes

Create a new route table and add a default route using the internal network interface you’ve created:

Navigate to Services → VPC → Route Tables

Select “Create Route Table”

1. Set a Name Tag for the Route: e.g. Untangle - Private
2. Select the VPC the Untangle is in:  e.g. vpc-79ceo5f0
3. Add the default route and attach it to the internal network interface:
4. Select the route table you just created
5. Select the Routes tab and then the “Edit” button
   1. Destination:   0.0.0.0/0
   2. Target - select the internal Network Interface you created:  e.g. eni-f360b9e4
   3. Select the “Save” button.
   4. Next, select the Subnet Associations tab and select the “Edit” button:
   5. Select the internal subnet
   6. The select the “Save” button:

Create Internet Gateway

The VPC must have an Internet Gateway.   Most VPC will already have one pre-configured.  If one does not exist, create one:

1. Navigate to Services → VPC → Internet Gateway
2. Select “Create Internet Gateway” button
3. Enter a Name tag: e.g. VPI -IGW
4. Select the “Save” button

Launch the Untangle - AMI

1. Navigate to Services → EC2 → Select the Launch Instance Button
2. Select AWS Marketplace and search for Untangle
3. Select the “Launch” button for the Untangle NG Firewall
4. Select the Instance type
5. Select the “Next: Configure Instance Details"
   1. Subnets:  Select the External Subnet you created:
      1. Select the “Add Device” Button
      2. Set eth1 to the Internal Subnet you created
   2. Select the “Next: Add Storage” Button
   3. Select the “Next: Add Tags” Button:
   4. Tags - You can add tags to help you identify the AMI / Resources
   5. Select the “Next: Configure Security Group” button:
      1. Configure Security Group:
      2. Choose the “Select existing Security Group” radio button
      3. Choose the Security group you configured:
   6. Select the “Review and Launch” button:
6. Review your configuration - Make any adjustments if needed:
7. Select the “Launch” button:
   1. Key Pair
   2. Select an existing key pair or create new one
   3. Select “Launch Instance” button

Check your Untangle Instance

1. Navigate to Services → EC2 →
   1. Verify the Instance is running
   2. Make note of the Public IP
2. Login to Untangle
   1. Point your browser at: https://<publicIP>  e.g.: https://34.22.127.3
   2. Configure Untangle

Your browser may show a message indicating that connecting to your new server needs caution. This message is simply telling you that there isn't yet a server certificate in place because the server is not yet configured. Once the Untangle setup process is complete, this warning will no longer occur when you direct a browser to your new server.