Getting Started with Shared Internet Access (SIA) using I2B

I2B Transparent Link Sharing

ePipe's Intelligent Internet Bonding (I2B) provides faster Internet access using inexpensive dial-up connections. By enabling the I2B service on each link in an ePipe bundle, outgoing WWW connections are routed down whichever link is least busy. I2B can also be used to provide faster access for other stream protocols, such as e-mail (SMTP), Usenet news, or POP downloads.

By default, I2B only acts on HTTP connections (TCP port 80). You can configure I2B to act on other protocols using the ePipe Management Assistant GUI or via the Command Line Interface (CLI).

I2B will be enabled by default for each link you create. By default I2B acts on the HTTP protocol (connections to TCP port 80). You can learn how to configure I2B to act on additional protocols below.

ePipe Management Assistant GUI Configuration (Recommended)

To use the ePipe I2B configuration wizard, go to the Setup section and choose the SIA setup wizard. Then select "Enable I2B for protocols".

To add support for most common protocols to the I2B service, check the "Add Protocol to I2B" radio button, select the protocol from the pull-down menu, and click the "Add Port" button.

To add support for a protocol that is not listed in the menu, select the "Add custom TCP port" radio button, enter the port number, and click the "Add Port" button.

When finished adding ports, click the "Configure>" button.

Currently configured ports are shown beneath "I2B Enabled Protocol/Port List". You can delete a configured port by clicking the red X at the right of each entry (you must click "Configure>" for any changes to take effect).

Once the "Configure>" button is clicked, any changes will take effect for all new outgoing connections.

Command Line Configuration (For advanced users)

To modify I2B behaviour using the command line interface, enter:

 

CHANGE INTERNET I2B PORTS <portlist> ENABLED

For example:

CHANGE INTERNET I2B PORTS 25,110 ENABLED

To view which ports are currently intercepted:

SHOW INTERNET I2B

To delete entries from the list of intercepted ports:

CHANGE INTERNET I2B PORTS <portlist> DISABLED

To reset to the default (port 80 only) configuration:

CHANGE INTERNET I2B PORTS DEFAULT

Back to Top

---

Configuring the ePipe Firewall

• Packet Filtering Firewalll
• Network Address Translation (NAT)
• Integrating ePipe into Existing Networks

The ePipe protects your private network from external attack via the use of the ePipe firewall. The ePipe firewall consists of two components:

• Packet Filtering Firewall
• Network Address Translation (NAT)

Packet Filtering Firewall

The ePipe has a built-in packet filtering firewall that protects your network from attack or being accessed from the Internet and simultaneously allows you to control what types of services your LAN users can access on the Internet.  A packet filtering firewall does this by rejecting any traffic that does not meet the policy set by the user.  This means that specific types of traffic (or network protocols and/or ports) will be allowed or disallowed through the ePipe, in either direction.  Some examples of traffic types or protocols that you may want to filter on include:

• Domain Name Service protocol (DNS)
• World Wide Web protocols such as HTTP, HTTPS and FTP
• E-Mail and News related protocols such as SMTP, POP2, POP3, IMAP and NNTP
• Internet Services protocols such as ICQ, NTP and IRC
• VPN related protocols such as PPTP, E2B (port 2000), ESP (IPSec), L2TP and IP/IP
• Terminal emulation and host access protocols such as Telnet and rlogin
• Microsoft Windows protocols such as NetBIOS and NetMeeting
• IP network infrastructure protocols such as RIP and ICMP (Ping)

The ePipe Management Assistant (web-based graphical user interface) offers you the option of creating a Traffic Filter during the SIA (Shared Internet Access) setup wizard.  A Traffic Filter is a collection of filter rules.  Each rule will accept, reject or discard different traffic types or protocols that are being received or sent by an interface (port or modem or Ethernet).  In the ePipe Management Assistant these options have been combined into the following actions (for each traffic type):

Action	Description
Rejected	Traffic is NOT allowed through the ePipe interface and any appropriate control messages are sent.
Discarded	Traffic is NOT allowed through the ePipe interface and NO control messages are sent.  Traffic is rejected silently.
Allowed into internal network	Traffic is allowed to pass through the ePipe interface but only for connections originating from the external network of this traffic type.
Allowed out of internal network	Traffic is allowed to pass through the ePipe interface but only for connections originating from the internal network of this traffic type.
Allowed into/out of internal network	Traffic is allowed to pass through the ePipe interface in either direction for connections of this traffic type.

For example, if you wish to allow LAN users to browse the Web then you would allow the HTTP and DNS protocols to be "Allowed out of internal network".

NOTE:  All other traffic is discarded.  You do not need to explicitly reject or discard other traffic types to prevent them going through the ePipe.

Filter Design

In general terms, when designing an effective filter you need to do the following:

1. Decide which protocols or traffic types you need to allow through the ePipe.
2. Decide in which direction these traffic types will be allowed through, either out of the internal network or into the internal network.
3. Select an appropriate timeout for each rule which specifies the idle timeout for bringing down inactive links (bandwidth-on-demand).

Idle Timeouts

In the Add Rule and Advanced Rule screens in the Traffic Filter Details screen, you have the option for specifying a value for how long this traffic type will maintain a link (or dialler).  This value specifies how long a filter will keep a link connected after not seeing this type of traffic.  For example, if you set the value to 300 seconds (5 minutes) for HTTP then a link that does not receive or transmit any HTTP traffic for 5 minutes will be disconnected, unless another filter rule is maintaining the link or bandwidth-on-demand is maintaining the link for other reasons.

Also, if a filter rule has a non-zero value for the idle timeout, then that filter rule can initiate a new link in a bundle if the bundle's upper threshold has been met.  See Bundles, Dialers, and Scalable Bandwidth for more information.

A value of zero (0) will prevent a new link from being initiated for this type of traffic but will still allow this traffic through on any existing links in the bundle.

Time based Filters

Time based filters are filtering rules that can be configured to apply at certain times of the day and/or on particular days of the week. The filters can be used to increase security if some facilities are only needed at particular times or to block certain types of traffic during or outside of office hours.

User Interface

This section describes how to set up time based filter rules. The lower section of the 'Traffic Filtering Rules' screen (figure 1.1) is used to configure time based rules. Once the other parameters for a rule have been set up (as described above), you can select the times/days for which the rule will be effective.

Days of the Week

To create rules which change on days of the week select the check box at 1 in figure 1.1, and select the start and end day of the time you want the rule to work.

Time of Day

Time of Day conditions work much the same way as the day of week conditions. These are enabled by selecting the checkbox at 2 in figure 1.1 and selecting the start and end times for the rule.

Advanced

The time based filter rules can be appended to an existing filter rule as follows. A standard rule to allow all http traffic looks like:

tcp tx tcp_dport=http accept 0
tcp rx tcp_sport=http accept 0

If the rule was to be changed so that it only applied in between the hours of 9:00am and 5:00pm it would become:

tcp tx tcp_dport=http time>=9:00 time<=17:00 accept 0
tcp rx tcp_sport=http time>=9:00 time<=17:00 accept 0

NOTE: All time is represented in 24 hour notation.

Similarly if the above rule was only applicable between Monday and Friday during the week the following would be added to each rule:

day>=monday time<=friday

NOTE: sunday = 0, monday = 1, tuesday = 2, wednesday = 3, thursday = 4, friday = 5, saturday = 6.

The rule is used if all conditions in the rule are met by an arriving packet.

If a time period runs over a boundary (i.e. overnight, or past the end of a week to the next), more than one rule must be specified. If for example a rule was needed to accept HTTP traffic between Friday and Tuesday each week, (Friday, Saturday, Sunday, Monday, Tuesday) the above rule would look like:

tcp tx tcp_dport=http day>=friday accept 0
tcp tx tcp_dport=http day<=tuesday accept 0
tcp rx tcp_sport=http day>=friday accept 0
tcp rx tcp_sport=http day<=tuesday accept 0

This would be similar for a rule that ran between one day and the next (overnight).

Creating a New Traffic Filter

You can create a new traffic filter in either of two ways:

1. Creating a filter in the SIA setup wizard
   After creating dialers you will be given the opportunity of creating a traffic links filter for the bundle you are creating.  Other options include using an existing filter or using no filter.
2. Creating a filter through Advanced
   In Advanced options you can create stand-alone filters and set a bundle to use a chosen filter.

Creating a filter in the SIA setup wizard

The SIA (Shared Internet Access) setup wizard leads you through the complete process of connecting an ePipe to the Internet, including the creation of new or use of existing filters.  After the creation and selection of your Links (sometimes called Dialers), you will be presented with the following options (on the screen titled "Specify the Traffic Filter for the Bundle"):

• Create new Traffic Filter
  Takes you to the Filter creation wizard.
• Use an existing Traffic Filter
  Allows you to select from any existing filters.
• Don't use a Traffic Filter
  No filter will be used, allowing any and all traffic to go through the ePipe.

WARNING:

Operating without a Traffic Filter is NOT recommended as the ePipe will allow all traffic to pass through, potentially allowing unwanted access or intrusion onto your LAN and the computers connected to that LAN.  If NAT is enabled (by default NAT is enabled) then your LAN has a basic level of protection, however the ePipe itself is still exposed to the Internet on several ports (including HTTP, DNS, RIP and Telnet).

For more information on setting up the filter see the on-line help on each screen while using the setup wizard.

Creating a filter through ePipe Management Assistant Advanced Option

You can create a new filter at any time by following these steps:

1. Browse to the ePipe using a web browser and select the Advanced option.
2. Start the Filter Manager by selecting Filter.
3. Create a new filter by selecting the New Traffic Filter button.
4. Name the filter using a name that suits the filter's purpose, e.g. "Internet Filter 1".  Select Next when ready to continue.
5. Add rules to the filter using the Add Rule and Advanced Rule buttons.  When finished select the Configure button to save the filter. Your changes are not saved until you click Configure.

For more information on setting up the filter see the on-line help on each screen while using the setup wizard.

Changing the Traffic Filter on a Bundle

You can change the filter on a bundle at any time to another filter or to no filter by following these steps:

1. Browse to the ePipe using a web browser and select the Advanced option.
2. Start the Connection Bundle Manager by selecting Bundle.
3. Select the bundle you wish to change by selecting the name of the bundle in the left-hand column.
4. Change the filter on this bundle by selecting a filter in the Filter drop-down list.  
5. Select the Configure button when you wish to save the change to the bundle.

WARNING:

Operating without a Traffic Filter is NOT recommended as the ePipe will allow all traffic to pass through, potentially allowing unwanted access or intrusion onto your LAN and the computers connected to that LAN.  If NAT is enabled (by default NAT is enabled) then your LAN has a basic level of protection, however the ePipe itself is still exposed to the Internet on several ports (including HTTP, DNS, RIP and Telnet).

There is more information on setting up filters in the application note "Configuring the ePipe Firewall: Basic Filters".

Back to Top

---

Network Address Translation (NAT)

Most Internet Service Providers (ISPs) only allocate one IP address to each customer (which is all that is needed for a single client PC). However if you are connecting a Local Area Network (LAN) to the Internet, each computer normally needs its own address.

Network Address Translation (NAT) is one widely accepted way of avoiding this problem---when a network request is relayed from a computer on your LAN, the ePipe modifies the return address to be that of the ePipe. When a response is received, the ePipe forwards it to the originating computer. There are special ranges of "private" IP addresses reserved for computers that are not directly connected to the Internet (eg. via a NAT device such as ePipe)---there is no registration or payment required to use these addresses.

NAT gives you two benefits:

• You only need to be allocated one address by your ISP, yet you can have as many computers "behind" that address as you like.
  
• Because your computers are "hidden" behind your ePipe, they cannot be directly accessed from the Internet, thus protecting them from many kinds of cracking or denial-of-service (DOS) attacks.

NAT Rules

For most networks, you will not need to know how to write NAT rules; simply select "NAT enabled" when creating your dialout links (see "NAT for outgoing connections" below). You can probably skip this section if you haven't tried the default NAT configuration yet.

Network Address Translation is controlled by a table of "NAT Rules" that are maintained by the ePipe's operating system.

The contents of the active NAT rule table can be shown using the ePipe Command Line Interface (CLI):

SHOW INTERNET NAT STATUS

For more detailed information on syntax of NAT refer to "Syntax of Net Address Translation (NAT)" in the Advanced Section.

NAT for Outgoing Connections (Mapping)

The simplest way to use NAT is also the default.

When you create a modem dialer using the ePipe Management Assistant, the NAT flag is turned on by default. The Command Line equivalent is "CHANGE DIALER dialername NAT ENABLED").

When the dialer is activated and connects to the Internet, two NAT rules are installed which will re-map most outgoing connections. (The outgoing traffic is still subject to filter rules, if any). The first rule maps general TCP connections (eg. web and mail access). The second is a special case needed for correct mapping of outgoing FTP connections. This default configuration will very probably suit your needs.

If you want more complicated mappings (perhaps for UDP protocols), you should create a table of NAT rules (CHANGE INTERNET NAT ruleset ENTRY number RULE "natrule"), and configure the bundle to use the new rule table (CHANGE INTERNET DOD bundlename NAT ruleset). See also the Command Line Interface (CLI) Help for the IPNAT advanced interface (HELP IPNAT).

NAT for Incoming Connections (NAT Redirect)

Traditional Internet firewall installations generally use one of the following arrangements:

• multipurpose firewall host acts as WWW server, mail server and firewall
• filtering router protects "public network" containing web server, mail server and internal-network firewall.

ePipe allows a third, less complicated arrangement. The ePipe acts as a filter/firewall. From the outside world, it *appears* to act as WWW and mail server, but actually redirects incoming connections to servers on your secure internal network.

This arrangement has several advantages:

• servers are highly immune to attack
• servers can be easily accessed for management, as they are on internal "secure" network.
• you only need one "real" IP address.

You can configure redirected access to your servers using the ePipe Management Assistant. Go to the "Advanced" section of the ePipe WWW configuration system and select NAT.

If you have an existing NAT ruleset defined, select the ruleset, otherwise follow the prompts to create a new set.

To provide worldwide access to an internal server, click the "add rule" button, select the protocol type, and enter the IP address of the internal server.

The ePipe Management Assistant does not provide a way to manage mapping (outgoing) rules. Refer to "Mapping Rules" in the Advanced section for information on how to add mapping rules to a rule-set using the CLI.

There is more information on setting up NAT in the application note "Implementing Network Address Translation and Port Redirection in ePipe".  

Back to Top

---

Integrating ePipe into Existing Networks

If you have an existing network and/or Internet connection, there are several ways in which you can use the ePipe with your existing network infrastructure.  In general terms, this section is designed to help you make the right decisions when using the ePipe with an existing infrastructure.

Connecting a LAN to the Internet

There are many ways in which a network of computers can be connected to the Internet.  The method you choose usually depends on factors such as bandwidth needs, security requirements, the ISP you select, your geographical location, etc.  However there are some common methods for connecting to the Internet and these include:

• Direct connection using a single Internet access device or router.  This device can, of course, be an ePipe, some other router or a host acting as a router or proxy server.
• Using a DMZ (De-Militarised Zone).  This can be done in two different ways:
  • Placing the DMZ between the LAN and the Internet
  • Connecting the DMZ and LAN to the Internet access device or router.

There are other ways of connecting LANs to the Internet but most involve variations on these methods.

ePipe Behind a Router

If a network has an existing Internet Router then an ePipe can be placed on the internal LAN or in the DMZ to provide:

• SRA (Secure Remote Access) using PPTP (with RADIUS support where required).  For more information see Secure Remote Access.
• SSV (Site-to-Site Virtual Private Networks) using IPSec and E2B.  For more information see Site-to-Site VPNs.
• DCS (Direct Connection Services) for direct dial-in remote access (PPP), RADIUS authentication and terminal server features.  For more information see Direct Connection Services.

If your Internet access device uses NAT (Network Address Translation) then you will need to configure NAT in the router to allow the appropriate connections through or redirect these connections to the ePipe for the termination of VPN tunnels.  See the above sections for more information.

Configuring ePipe for DNS 

If your network has an existing DNS server for local network name resolution, you can configure the ePipe to resolve names against this name server.  To do this follow these steps:

1. Browse to the ePipe and select the Setup option.
2. Select any of the available setup wizards.
3. Select the link Domain Name Servers for the ePipe.
4. Add the name and IP address of each DNS server you have on your network.
5. Select Configure when you wish to save the changes.

You will also need to configure the ePipe with your domain name.  Your domain name is allocated to you by a domain name registration authority in your region.  This can usually be organized by your ISP.  Your domain name will look something like "yourcompany.com" or "my_business.net" and may also have a country identifier on the end.  To configure the ePipe with your domain name follow these steps:

1. Browse to the ePipe and select the Setup option.
2. Select any of the available setup wizards.
3. Select the link General ePipe Settings.
4. Type your domain name in the Domain Name field.
5. Select Configure when you wish to save the changes.

Routing Issues

Your existing network may already be using routers to connect different sites together using various local and wide area networking technologies.  If you have more than one (1) IP network (that is you have a network subnetted into multiple IP subnets) then you will have existing routers and may be using routing protocols so that these routers have a complete view of the network.  Some common routing protocols include RIP, OSPF and BGP.  If you are not using any routing protocols then you are most likely using static routes in each router so that the routers know where to send packets going to other subnets.  UNIX and Windows NT/2000 hosts can also participate in the routing process as these operating systems support RIP and well as other routing protocols.

The ePipe can inter-operate in a network using the RIP protocol (RIP version 1 and 2).  ePipe listens for both version 1 and 2 RIP route updates on the LAN and will broadcast RIP version 1 updates by default.  This behaviour can be modified in the following ways:

• The broadcast of routing information using the RIP protocol can be enabled or disabled.
• The reception of routing information using the RIP protocol can be enabled or disabled.
• The type of RIP information broadcast by the ePipe can be set to RIP version 1, RIP version 2 broadcast or RIP version 2 multicast.

The ePipe can also be configured with static routes to other networks by adding specific routes to the ePipe routing table.  You can look at the contents of the ePipe routing table by running the following command using the CLI (Command Line Interface):

SHOW INTERNET GATEWAY

If you wish to add a static route then you can use the following command to add it using the CLI:

CHANGE INTERNET GATEWAY gateway NETWORK net_address

Where gateway is the IP address of the router to which packets destined for the network, specified by net_address, should be sent.

If you wish to add a default route then use the command:

CHANGE INTERNET GATEWAY gateway NETWORK ANY

Back to Top

---

Configuring Client Computers

This section discusses how the client computers on your internal network should be configured to take best advantage of ePipe.

Client Routing Configuration

If you are using I2B or NAT (or both) to provide Internet access for your internal PCs, the only configuration needed for client PCs is to ensure that their "default gateway" setting contains the address of the ePipe.

Do not configure client computers to use the ePipe as a WWW proxy server. If you have an internal caching proxy (see below) use that host as your proxy server. If you have no caching proxy, configure your client computers for "Direct Connection to the Internet"---as long as the clients are configured to use the ePipe as the default gateway, outgoing connections will be transparently proxied by either the I2B or NAT services on the ePipe.

Client DNS Configuration

If you have a local Domain Name System (DNS) server, configure your clients to use this as your name server.

Your network DNS server, can either use the root name servers, or use the ePipe as it's "parent" server; the ePipe will then relay name lookups to the ISP's name servers.

If you have no local DNS server, configure your clients to use the ePipe as their DNS server. ePipe has a "DNS Proxy" service, which will relay name-server lookups to the ISP's name-server (which will have been discovered as part of the login process when ePipe connected to the Internet).

Caching Proxy Servers

If you have a caching proxy server on your internal network, you can still use this in combination with I2B. Using a caching proxy server in combination with I2B's transparent link sharing will provide the fastest possible WWW access for your users.

• Configure your client computers to access the proxy server as their HTTP/FTP/Security proxy
• Configure the proxy server machine to use the ePipe as its default gateway
• Enable the I2B service on the ePipe.

WWW access will then be via the proxy server, which will fetch pages on behalf of the client. The proxy server's requests will be intercepted by the ePipe, and redirected out the best available Internet link.

Using the ePipe DHCP Server

Both default gateways and DNS servers can be set by the ePipe's DHCP server, so any PCs getting DHCP addresses from the ePipe will be set up automatically.  For details on how to do this, see the documentation on ePipe's DHCP server here. 

Choosing IP Addresses from the Private Range

Several ranges of IP addresses have been set aside for "free-for-all" use in networks that do not need globally unique Internet addresses (either the network is not to be connected to the Internet at all, or its addresses will be translated into valid ones using NAT).

The Internet standard document RFC1918 describes the reserved addresses in detail. The ranges it lists as reserved are:-

10.0.0.0 - 10.255.255.255 (10/8 prefix)
172.16.0.0 - 172.31.255.255 (172.16/12 prefix)
192.168.0.0 - 192.168.255.255 (192.168/16 prefix)

The most appropriate range for a small network is the 192.168.xx.xx range.

For example, choose your network address as "192.168.1", and number the hosts.

ePipe = 192.168.1.1
PCs 192.168.1.2 and onward

If you anticipate connecting two networks, use different network addresses (eg. 192.168.1.x for one site, and 192.168.2.x for another). Two networks that have same network address will not be able to be easily connected to each other (even via a VPN tunnel), so try to use a different address for each network if you have more than one.

Back to Top

about ePipe | products | solutions | support | information center | contact us

Copyright © 2002 ePipe Pty. Ltd. All rights reserved.