Payzone in School Network and using Internet

[popeel]

Hi All,

 

We have been using Payzone payment terminal and it was used separate connection and they have upgrade the system to connect payzone through Internet. Unfortunately, payzone wants all the ports 443 and 80 opening for outside world to those terminal which is a huge security risks.

 

 

Payzone technical team doesn't have any clue about firewall and filter etc. I wonder if anyone using this system in the school and how they cut that traffic down to specify external IP's rather open everything ?

 

Any help would be much appreciate.

 

When I checked the firewall logs it's trying to connect to various different IP addresses and they are changing every time.

 

Only IP is not changing is 217.135.168.186 port 7701 and that is not enough to run the full function and will need to open 80 & 443 in full.

 

Thanks in advanced

[Guest Guest]

Outbound 80 and 443? Surely there open anyway as they're required for browsing the web

[popeel]

They are open only for the proxy. Proxy is handling the traffic for http and https. Unfortunately, this payzone terminal do not have option for proxy.

 

I will try more packet capture and set more in wpad.dat file to redirect correct traffic. I doubt if the terminal understand the redirect traffic.

Let's find out tomorrow.

 

Thanks for the reply.

[MatthewL]

So put your Payzone on a static, create a rule outbound to allow 80 and 443, no different to a PC web browsing but not going through a proxy. If you know destination IP add this as destination to make it more secure simple as. The company will be able to provide a list of destinations and ports needed, if not tell them bye bye.

[popeel]

I wish if that's simple as we think. These terminal device don't like DHCP reservation and static IP address don't have option for DNS.

 

This company lack of expertise to help the backend stuff. They don't have any idea what is firewall and proxy. Company wants direct internet connection which is not that simple in corporate network.

 

If anyone has public IP addresses they use for the service please post it here or pm me.

 

I might need to start packet capture and may be tcpdump to find out more details. Only issue with that is the IP address they use for different services keep changing.

 

Thanks for your comments and suggestions.

[localzuk]

I'm confused by your statement "these terminal devices don't like DHCP reservation". An endpoint doesn't know it is a reservation or not, it is just an IP it gets sent by the DHCP server. The client requests an address like normal, and the DHCP server replies, as normal, the only difference is that the server always returns that same address.

[popeel]

Thanks and these terminal have very basic function and I have Linux DHCP works best with every devices apple, android, Linux and windows. Unfortunately this device only take the IP address one DNS ip and the subnet mask. It doesn't accept any other option in DHCP. There are two terminals (one doesn't have option for proxy server and doesn't accept auto proxy configuration.)

 

I am trying to get the traffic divert in Layer 3 and already setup tcpdump to get all the necessary IP Address to open. I will get this working by end of the day.

 

I wonder if anyone in here use this payzone terminals before or has any configuration already. Looks like no schools using this. There are few universities using the system with dedicate internet connection to the terminals due to security issues which is not help me as we are trying to use the same Internet connection.

 

Thanks everyone for the comments and suggestions.