So you want to remotely access a server or computer that’s
residing on your local network, there are quite a few ways to reach this goal.
From remote access applications such as: logmein, teamviewer, to VPN access.
What I’d like to emphasize is that if you are going to setup a device to be
accessible both internally and externally that device must reside in the DMZ.
With that in mind let’s start by building our network and
outlining the general actions as we move alone.
DMZ: it stands
for demilitarized zone, it’s also known as the Perimeter. In other words, it’s
the segment of your network that hosts publicly accessible servers/computer
through the internet and accessible through your internal network as well.
Let’s look at the diagram as we move along.
We have basic network setup. There’s firewall with two interfaces,
one of the interface is configured for the DMZ or perimeter and the other
interface is configured for the LAN.
Let’s say that the LAN segment is a 192.168.20.0/24 and the
DMZ segment is a 172.16.10.0/16. Hosts in the LAN segment are able to
communicate among each other and so are hosts in the DMZ, however they are not
able to communicate between segments yet.
As you can the LAN and DMZ are complete different subnets
therefore a “router” needs to be configured to direct traffic from one segment
to the other. The routing function in our example is going be performed by the
firewall; usually firewalls designed for small and medium sized businesses also
include other services such as routing, vpn, dhcp, dns, web content filtering,
etc.
The steps to configure the firewall settings will vary from
vendor to vendor but the concept behind its functionality is the same.
Keep this is mind: your firewall isn’t a router, the
firewall has routing functionality. This what you need to focus on: find the
routing section of your router where you can add routes to allow traffic from
one segment to the other. Many firewalls will do this for you automatically by updating
the routing table every time you create a new segment, once you have verified
that both segments are able to communicate you need to decide the type of
traffic you’ll allow to between the DMZ and your LAN.
This is where you need to take what I call: a methodical process because you’ll
be opening a public door into your network. When I configure firewalls I follow
the basic principle of: everything is
denied unless it’s explicitly allowed, that gives me a granular control
which will allow me to control what type of traffic flows between segments.
As an administrator you’ll need to create the firewall rules
to allow traffic from the internet to the DMZ, and from your LAN to DMZ and
vice versa. Remember the principle: everything is denied unless it’s explicitly
allowed.
So let’s see how process occurs: I’m hosting my own web
server that’s being accessed by Local users to make changes to our in house
application. One of my internal users
accessing the server has an IP address of 192.168.20.5, my Web server in the
DMZ has an IP of 172.16.10.10. As described previously routing between these
segments is working and I configured the firewall rules to allow traffic
between the two segments.
Now, you might ask yourself this question: How do external
users access my web server residing in my internal network?
I can either use Network
Address Translation (NAT) or I could use Port Forwarding for the external users to access the web server.
NAT, in its basic
form is simple masquerading an internal IP address behind a
public address. So let’s says we were assigned a public IP address of 1.2.3.4
which is assigned to the WAN interface of the firewall.
When my users go the public network (internet) they’ll be
seen as coming from IP address 1.2.3.4. (There’s a NAT PAT process in the
background that makes this magic happens.)
When a remote user attempts to connect to 1.2.3.4 IP address
over port 80 the user will be hitting the firewall’s WAN interface, that’s not
where you want to go. So the Firewall administrator needs to configure a
firewall object that’s going to represent the Web server and assign it a public IP address to it.
So in this case the web server has a private IP address
(configured on the physical interface) and a Public IP address that’s been
logically configured in the firewall rules and settings. Let’s say that the
other public IP address in our block is 1.2.3.5,( in this case your ISP
provided you with multiple public IP addresses) as the firewall administrator I create a
firewall object for my web server and assigned the public IP address in the NAT
section of it.
Now that I have this configuration in place, when users
decide to go to www.jdtechsolutions.net
to learn more about the network, information security, and technical services I
provide in New York City area, DNS resolution is going to point them to 1.2.3.5
IP address (keep in mind I omitted explaining how DNS registration and how it
works, to learn more about it check my DNS document).
When the connection arrives to our firewall it understand
that there’s a NAT rule which will send traffic to the webserver based on our
natting rule.
Port Forwarding: For
it to make sense you need to have a basic understanding of tcp/ip so
summarizing everything this is what happens:
Network applications such as HTTP, DNS, FTP use transport
protocols for communication. TCP and UDP are the transport protocols in charge
of allowing the flow of data, each application has corresponding port number assigned to it by design, for instance HTTP is TCP port 80,
RDP is TCP port 3389 ( for a complete list visit iana.org web site or http://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt)
so the information travels from one host to another the port representing the
application number comes along with it, when it reaches the receiving end it
presents itself with the port number. In a port forwarding process the firewall
is configured in a way that when it receives traffic with a specific port
number it understand that the traffic must be forwarded or directed to another
host based on the firewall port forwarding rules.
Let’s do an example based on our network. Let’s say the
users want to get to my web site ww.jdtechsolutions.net that’s being hosted in
my local network.
The process to configure port forwarding is pretty simple
and straight forward:
Configure the Port forwarding setting in your firewall, in
our case we are going to forward traffic coming on TCP port 80 (HTTP) to our
internal webserver IP address of 172.16.10.10.
So when traffic from a remote user to our website reaches
the firewall, it automatically forwarding that traffic to the web server based
on forwarding rules.
Let’s do another example, let’s say you’d like to access
your Windows desktop computer from any location outside your network. You’d
have to take the following steps:
- Enable RDP on your local PC
- Make sure your internal pc’s IP address remains the same by either setting a static IP or a reservation in your DHCP server.
- Know the public IP address (keep in mind it might change if you have a dynamic IP, you can circumvent this either requesting a static IP from you ISP or registering with a service such as dyndns.org)
- Create the port forwarding rule in your firewall. Forward TCP port 3389 to your internal IP.
That should cover it all, now every firewall is different
but the concept behind what you need to do is the same. The following is an
example of port forwarding in a Sonicwall firewall.
Remote Desktop Connection from a remote network to your
office PC
Now, if you are new to this concepts you realized by now
that there are many missed steps along the way. I didn't plan on doing a step
by step process on how things work but rather a general overview of how port
forwarding and NAT work. I’m sure that with this information, your technical intuition and the firewall documentation you’ll be able to fill in the
holes I left out empty.
Feel free to drop us notes with questions or suggestions
about this or any other of our published documents. You can also contact us for
IT consulting services in the New York metropolitan area at info@jdtechsolutions.net or calling
us at 646-500-0032.
