Feeling thick: Smoothwall Transparent Proxy

[sonofsanta]

SWG-1200, Guardian 3, updated to main 68.

 

I always got the idea that all I had to do for guest access via SSL login page was:

* Plug in a second network port, give it an address in the guest VLAN

* Set the default gateway of devices to this IP

* Set up a transparent auth policy for all traffic coming in to this NIC for SSL Login page

 

I cannot get anywhere though.

 

The SSL Login page works on my normal range if I set it on a different proxy port (I don't want to break lots of things by testing transparent here though).

 

The laptop I'm testing with can ping the Smoothwall IP, that is set as default gateway (all this is done statically for now)

 

But when I try and load any page, nothing happens. Fiddler is telling me that requests are bouncing with 502, Failed DNS lookup. I've tried setting DNS to Google's servers, our ISPs servers, even to the Smoothwall IP, but nothing.

 

What am I missing? Do I need DNS setting up internally to this range as well? Or is transparent proxy for guest access inherently undoable on an SWG device and I'll be forced into paying the big fat upgrade fee for a UTM device?

 

/so confused

[sonofsanta]

Right, setting up SSL login as a non-transparent proxy on the guest NIC, and inspecting traffic again in Fiddler, the system keeps trying to tunnel to smoothwall.domain.internal - which won't resolve because this is the guest VLAN with no access to main DNS. Is there a way of forcing the Smoothwall to use the IP of this secondary NIC instead of the FQDN?

 

It actually repeatedly chains the request, so that very quickly the request header is

GET /clogin?https://smoothwall.domain.internal:442/clogin?https://smoothwall.domain.internal:442/clogin?https://smoothwall.domain.internal:442/clogin?https://smoothwall.domain.internal:442/clogin?...clogin?http://microsoft.com/

 

I've got to be doing something wrong here

[drewp]

Have you checked that you have setup the external access rules?

 

System>> Administration>>External access

Interface second NIC , Source All, Service other web access on HTTP (80)

Interface second NIC , Source All, Service other web access on HTTPS (442)

[sonofsanta]

Yup, found that on another thread round here - for source I set the network range of the guest devices, but even setting Port9_GUEST, ALL, ALL got me nowhere

 

Further to the above, I've tried adding smoothwall.domain.internal to the hosts file of my test laptop to see if it helped, and it made no difference, even though pinging that domain name resovled correctly.

[sonofsanta]

Anyone else?

 

Can't load smoothwall.com today to get to the knowledge base...

[tom_newton]

Our website is suffering a spot of downtime.

Your issue is definitely dns related. The first thing i'd try is get this domain resolving on that network: that's the easiest. There is an option to go via ip, but it is hidden (backend config tweak). I will dig that out for you, but that would be a less preferred option.

[tom_newton]

In the file settings/main/settings

USE_HOSTNAME_IN_REDIRECTS=on

is the thing to twiddle. Gets gui exposure ~main75

[sonofsanta]

Our website is suffering a spot of downtime.

Your issue is definitely dns related. The first thing i'd try is get this domain resolving on that network: that's the easiest. There is an option to go via ip, but it is hidden (backend config tweak). I will dig that out for you, but that would be a less preferred option.

 

I'll start playing with the Ubuntu VM for the DHCP and see if I can set up a DNS zone solely for this record then... bit of a faff for the sake of the single record though, but I suppose mucking around with the backend setting would also affect the main network and involve more faff with certificates?

[sonofsanta]

Well I'm narrowing the issue down, but it still isn't working

 

I have an Ubuntu VM running dnsmasq acting as DHCP server and DNS server. The problem now appears to be that the Smoothwall won't let it make DNS requests.

 

The Ubuntu VM is in the same subnet as the second SW interface and can ping the second SW interface. I can't ping anything else. If I try and ping google.com from the command line I get told ping: unkonwn host google.com

 

If I add a static DNS entry e.g. address=/google.co.uk/173.194.41.191 and then ping google.co.uk from within Ubuntu, I get told From 10.45.208.3 icmp_seq=1 Destination Port Unreachable

 

smoothwall.domain.local is added as a static entry in dnsmasq. Trying to access google.co.uk gets me nowhere - it still reports that the DNS lookup failed, as earlier.

 

With the static google.co.uk entry in dnsmasq, though, I can get the SSL login page up (only if I browse to google.co.uk), login and then browse google.co.uk to my heart's content - just not any of the links.

 

So: the issue specifically appears to be with the Ubuntu VM getting access through the Smoothwall. There's a transparent proxy policy against the VM's IP, for no authentication (set to Network Admin), and there's a non-transparent policy set to the same, with Ubuntu configured to use it (via the installation option). I can run apt-get update successfully so it seems the machine can talk to the internet, just not in all the ways it requires.

 

System > Admin Options > External Access has HTTP and HTTPS traffic from the guest VLAN allowed on the guest NIC. I've tried setting the following policies under Zone Bridging but it's made no difference:

I tried switching dnsmasq to use port 5353 and amending them accordingly with no gain.

 

Help!

[sonofsanta]

Anyone?

[caffrey]

Just a guess but tried DNS proxy ? Services » DNS » DNS proxy on the interface ?

[sonofsanta]

Just a guess but tried DNS proxy ? Services » DNS » DNS proxy on the interface ?

 

UTM only, doesn't exist on our SWG

[sonofsanta]

Just tested setting an IP on the VLAN and if the Ubuntu box has that as the default gateway (i.e. has a route to the internet that isn't via the Smoothwall) everything works beautifully. Devices get the Smoothwall's second NIC as the default gateway, the first time they try to get to the internet they get the login page, and they can then browse to their heart's content until they hit a blocked page.

 

I don't want an IP setting for this VLAN though, such that it's wholly segregated from the rest of the network. I would really like to get Ubuntu getting its DNS through the Smoothwall - I just need a way, any way, for the Smoothwall to whitelist any and all traffic from the source IP of the Ubuntu box. @tom_newton? @OB1? @AMLightfoot? Anyone?

[AMLinington]

Zone bridging?

 

I'm having some trouble working out what you're looking for but @ibpalle suggested Zone Bridging

[sonofsanta]

Zone bridging?

 

I'm having some trouble working out what you're looking for but @ibpalle suggested Zone Bridging

 

Tried setting up zone bridging as shown in post #9 (the tiny image near the bottom that blends almost seamlessly into the edgueek background ) but I don't know if that's not working because a) it fundamentally won't work or b) I've set it up wrong (likely the case).

Do these look right? Do I need to set up the converse rule as well? Should I use the default gateway's internal IP for destination rather than the DNS servers I'm trying to get to? (10.45.208.2 is the IP of the Ubuntu box, the Smoothwall's second NIC is 10.45.208.3)

[sonofsanta]

I've managed to do it for now by creating an IP on that VLAN, that the Ubuntu box can use as a default gateway, then setting an Access Control List for the VLAN

acl number 3002 name VLAN208_Restrictions
rule 0 permit ip source 10.45.208.2 0
rule 10 deny ip source 10.45.208.0 0.0.15.255
int vlan 208
ip address 10.45.208.1 255.255.240.0
packet-filter 3002 outbound
packet-filter 3002 inbound

 

Which seems to be working in that it only allows traffic out of the VLAN from the Ubuntu box's IP, and any other device has its inward and outward traffic blocked. I'd still prefer to have the Smoothwall as the only route out if possible - less points to be breached - but at least I'm at a working solution for now.