eWON Application User Guide

AUG 021 / Rev 1.0

Y
o
u

S
e
l
e
c
t
,

W
e

C
o
n
n
e
c
t
ENDIAN with eWON
Getting started
C
o
n
t
e
n
t
This guide will e!lain in a "ew ste!s h#w t# $#n"igure and use %#ur ENDIAN t# $reate a &'N
netw#r( with eWONs.
Table of Contents
1. Hardware and software requirements..................................................................................................3
Hardware requirements....................................................................................................................3
Software requirements.....................................................................................................................3
eWON Firmware Version.................................................................................................................3
2. What is ENDIAN for eWON...............................................................................................................!
What is ENDIAN.............................................................................................................................!
What is ENDIAN for eWON............................................................................................................!
3. Networ" Setu#.....................................................................................................................................$
ENDIAN %onfi&uration......................................................................................................................$
ENDIAN 'onne%tion..................................................................................................................$
Interfa%es 'onfi&uration.............................................................................................................(
O#enV)N 'onfi&uration.............................................................................................................*
eWON 'onfi&uration......................................................................................................................13
)' %onfi&uration.............................................................................................................................1(
!. Networ" to#o+o&ies............................................................................................................................1,
On+- eWONs..................................................................................................................................1,
ENDIAN Settin&s.....................................................................................................................1,
On+- eWONs . eWONs see eWONs..............................................................................................1*
ENDIANSettin&s......................................................................................................................1*
eWONs . /o%a+ networ" of eWONs . eWONs see eWONs...........................................................20
ENDIAN Settin&s.....................................................................................................................20
$. Se%urit-..............................................................................................................................................22
1.1e2isions............................................................................................................................................2!
Hardware and software requirements 'ha#ter 1.
1. Hardware and software requirements
Hardware requirements
In order to fo++ow this &uide -ou3++ need4
1 ENDIAN ser2er a##+ian%e 5in this do%ument6 we use an ENDIAN78ini9
1 5or se2era+9 eWON7V)N with an Internet a%%ess
Software requirements
eWON configuration software:
:he eWON is %onfi&ured throu&h its we; ser2er. So a++ -ou need is a standard We;
<rowser software +i"e Internet E=#+orer
i
or Firefo=
ii
.
Additiona++- we su&&est -ou to down+oad the e<udd- uti+it- on our we;site 4
htt#4>>su##ort.ewon.;i?.
:his uti+it- a++ows to +ist a++ the eWONs on -our networ" and to %han&e the defau+t I)
address of an eWON to mat%h -our /AN I) address ran&e. With e<udd- -ou %an a+so
easi+- u#&rade the firmware of -our eWON 5if required9.
eWON Firmware Version
:o ;e a;+e to fo++ow this &uide -our eWON needs a firmware 2ersion $.$ or hi&her.
A sim#+e wa- to do an eWON firmware u#&rade is to use e<udd-6 the eWON software
%om#anion.
ENDIAN with eWON 5@ettin& started9 )a&e 3>2!
What is ENDIAN for eWON 'ha#ter 2.
2. What is END!N for eWON"
What is END!N"
ENDIAN is an Open Source Firewall UTM Appliance.
We;site4 htt#4>>www.endian.%om
:he Endian Firewa++ is an o#en sour%e /inu= distri;ution that s#e%ia+i?es on
1outin&>Firewa++in& and Anified :hreat 8ana&ement. It is ;ein& de2e+o#ed ;- the
Ita+ian Endian Sr+ and the %ommunit-.
:he 2ersion of Endian Firewa++ used in this do%ument is 2ersion 2.2.1.
ENDIAN is main+- a Firewa++ 5;oth dire%tions96 ;ut a+so a BVirtua# $ri%ate Networ&
'V$N( )atewa* with O+enV$N or I)se%B.
Other features are4 DHCP-Server, Hotspot/Wireless Security, We Antivirus, We
Antispa!, "-Mail Antivirus, "-Mail Antispa!, Transparent HTTP-Pro#y, Content
Filter, S$P %o$P Support, &etwor' A((ress Translation, Multi $P a((ress )aliases*,
HTTPS we inter+ace, Connection statistics, ,o- o+ networ'in- tra++ic, Forwar(in- o+
lo-s to an e#ternal server, &TP-Server, $ntrusion Detection Syste!, ADS,-Mo(e!
Support
What is END!N for eWON"
As eWON7V)N are ;ased on O#enV)N too6 it is eas- to ;ui+d a V)N networ" with an
ENDIAN as O#enV)N Ser2er and eWONs as O#enV)N '+ients.
ENDIAN with eWON 5@ettin& started9 )a&e !>2!
Fi-ure ./ Open%P& networ' e#a!ple
Networ" Setu# 'ha#ter 3.
,. Networ& Setu+
END!N configuration
ENDIAN Connection
<- defau+t6 -ou %an a%%ess ENDIAN a##+ian%e ;- its /AN Ethernet %onne%tor.
:he defau+t I) /AN address ran&e is the 1*2.1(,.0.0>2! and the ENDIAN firewa++ is at
1*2.1(,.0.1$.
:he s-stem wi++ redire%t -ou to the
htt#s4>>1*2.1(,.0.1$410!!3 and -ou wi++
a%%e#t the 'ertifi%ate to +o&in into the
ENDIAN.
:hen6 a #o#u# wi++ in2ite -ou to enter
the /o&in>)assword ot the ENDIAN.
Defau+t +o&in4 a(!in
Defau+t #wd4 en(ian
ENDIAN with eWON 5@ettin& started9 )a&e $>2!
Fi-ure 0/ "n(ian Ho!e pa-e
3. Networ" Setu#
Interfaces Configuration
ENDIAN are ;ui+t to mana&e four hardware interfa%es6 in this do%ument we on+- need
2 hardware interfa%es to ;ui+d our V)N networ".
In our sim#+e V)N networ"6 we need on+- a /AN and a WAN interfa%es.
/AN4 our #ri2ate networ"
/AN address ran&e 1*2.1(,.0.0>2!
ENDIAN7/AN4 1*2.1(,.0.1$
WAN4 the %or#orate networ" a++owin& us to a%%ess Internet
WAN address ran&e 10.0.0.0>1(
ENDIAN7WAN4 10.0.120.*
Ase the &etwor' con+i-uration menu and fo++ow the wi?ard to define and %onfi&ure the
networ" interfa%es.
ENDIAN with eWON 5@ettin& started9 )a&e (>2!
Fi-ure 1/ C2oose type o+ 3"D inter+ace
Fi-ure 4/ C2oose networ' 5ones
3. Networ" Setu#
ENDIAN with eWON 5@ettin& started9 )a&e C>2!
Fi-ure 6/ $nternet access pre+erences
Fi-ure 7/ Con+i-ure D&S resolver
3. Networ" Setu#
ENDIAN with eWON 5@ettin& started9 )a&e ,>2!
Fi-ure 8/ Apply con+i-uration
Fi-ure 9/ Wait +or reoot
3. Networ" Setu#
OpenVPN Configuration
)#o-a# settings
:o %onfi&ure the V)N of the ENDIAN6 use the %P& to# menu6 fo++owed ;- the
Open%P& server in the +eft menu.
:he on+- thin& to %onfi&ure is to ena;+e the O#enV)N ser2er and to fi= the D-nami% I)
#oo+ adresses used ;- V)N '+ients.
One #ra%ti%a+ feature of ENDIAN V)N is that a++ V)N7'+ients wi++ re%ei2e a V)N
address %om#ati;+e with the /AN networ".
In our e=am#+e6 as the /AN 5our @1EEN interfa%e9 is 1*2.1(,.0.0>2!6 a++ V)N %+ients
wi++ re%ei2ed an address ;etween 1*2.1(,.0.20 and 1*2.1(,.0.2$!.
ENDIAN with eWON 5@ettin& started9 )a&e *>2!
Fi-ure :/ Open%P& Server con+i-uration
NO.E
:hen6 from an- de2i%es #+a%ed on the /AN6 a++ the remote eWONs
%onne%ted ;- V)N wi++ ;e rea%ha;+e the same wa- as if the- were
#h-si%a++- on the same /AND
3. Networ" Setu#
!ccounts
Now6 for ea%h %+ient6 -ou need to %reate an a%%ount. For that6 se+e%t the Accounts ta;
and use the A(( Account ;utton.
For now6 Eust enter the Userna!e and Passwor( and sa2e -our a%%ount.
/ea2e a++ other #arameters ;+an"6 we wi++ dis%uss them +ater.
'reate as mu%h a%%ounts as -ou need.
ENDIAN with eWON 5@ettin& started9 )a&e 10>2!
Fi-ure .;/ A(( a %P& Account
3. Networ" Setu#
!d%anced +arameters
With the A(vance( ta;6 -ou wi++ set the Port and Protocol used for the V)N 5AD)
11*! ;- defau+t9 and se+e%t the Authenti%ation t-#e 5)SF9.
'he%" the <loc' DHCP responses co!in- +ro! tunnel #arameter to a2oid DH')
trafi% ;etween DH')7Ser2ers from different #+a%es.
An%he%" the Don=t loc' tra++ic etween clients to not a++ow %ommuni%ation ;etween
V)N '+ients.
Ase the Downloa( CA certi+icate +in" to retrie2e the %ertifi%ate of the Firewa++. Gou wi++
need it to %onfi&ure -our eWONs.
ENDIAN with eWON 5@ettin& started9 )a&e 11>2!
Fi-ure ../ A(vance( Settin-s
3. Networ" Setu#
ENDIAN with eWON 5@ettin& started9 )a&e 12>2!
/$O0.!N. Verif- that the )ort and )roto%o+ used 5i.e.4 AD) 11*!9 rea%hs the
ENDIAN firewa++.
Verif- that the AD) 11*! #a%"ets are not ;+o%"ed ;- the IS)
5usua++-6 on domesti% ADS/ offer6 in%omin& trafi% is firewa++ed9.
Verif- that the %or#orate router forwards a++ AD) 11*! #a%"ets
to the ENDIAN.
3. Networ" Setu#
eWON 1onfiguration
First+-6 %onfi&ure -our eWON to a%%ess the Internet.
And after6 &o to the Wi?ard menu.
'hoose the H'onfi&ure Endian For eWON %onne%ti2it-I ;utton .
Set the #arameters for the ENDIAN %onne%tion.
ENDIAN with eWON 5@ettin& started9 )a&e 13>2!
1onfiguration 2
3. Networ" Setu#
:he V)N Asername>)assword %omes from one of the A%%ounts %reated in the
ENDIAN.
'o#- the 'ertifi%ate down+oaded from the ENDIAN.
:he Ser2er Address is usua++- the Internet )u;+i% I) address ;ehind whi%h the
ENDIAN is #+a%ed.
'+i%" &e#t ;utton and the eWON wi++ do the V)N %onne%tion.
If su%%eed6 -ou wi++ ha2e the fo++owin& s%reen.
ENDIAN with eWON 5@ettin& started9 )a&e 1!>2!
3. Networ" Setu#
If -ou +oo" on the ENDIAN we;site6 -ou %an 2iew that the eWON*2 is we++ %onne%ted.
ENDIAN with eWON 5@ettin& started9 )a&e 1$>2!
Fi-ure .0/ "&D$A& wi5ar( success
3. Networ" Setu#
$1 configuration
ENDIAN Ser2ers are main+- desi&ned to ;ui+d networ" of )'. :o %onne%t a )' to -our
V)N networ"6 -ou need to insta++ a #ie%e of software on -our %om#uter.
From the ENDIAN we;site6 down+oad and insta++ the EndianV)N'+ient7setu#
software.
On%e insta++ed6 -ou ha2e -our "&D$A& %P& Dialer to %onne%t -our )' to the
O#enV)N networ".
:o Eoin a V)N Networ"6 %reate or edit a Pro+ile.
Gou need the same %ertifi%ate as the one used to %onfi&ure the eWON.
ENDIAN with eWON 5@ettin& started9 )a&e 1(>2!
Fi-ure .1/ "&D$A& %P& Dialer
Fi-ure .4/ %P& Pro+ile "(itor
3. Networ" Setu#
On%e %onne%ted6 -our )' ha2e a%%ess to the who+e %or#orate networ" 5%onne%ted to
the ENDIAN /AN interfa%e9.
ENDIAN with eWON 5@ettin& started9 )a&e 1C>2!
Fi-ure .6/ PC %P& Client connecte(
Networ" to#o+o&ies 'ha#ter !.
3. Networ& to+o#ogies
On#* eWONs
Now6 with the sim#+e %onfi&uration of ENDIAN and eWONs done in the #re2ious
%ha#ter 5on+- with defau+t settin&s96 we ha2e ;ui+d a networ" +i"e the one ;e+ow4
With this to#o+o&-4
A++ the de2i%es on the %or#orate /AN ha2e a%%ess to a++ eWONs
A++ eWONs ha2e a%%ess to a++ the de2i%es on the %or#orate /AN
none of the eWONs ha2e a%%ess to other eWONs
ENDIAN Settings
ENDIAN with eWON 5@ettin& started9 )a&e 1,>2!
Fi-ure .7/ &etwor'/ Only eWO&s
!. Networ" to#o+o&ies
On#* eWONs 4 eWONs see eWONs
Gou %an %onfi&ure the ENDIAN firewa++ to a++ow ea%h eWONs 5V)N '+ients9 to see
ea%h others.
With this to#o+o&-4
A++ the de2i%es on the %or#orate /AN ha2e a%%ess to a++ eWONs
A++ eWONs ha2e a%%ess to a++ the de2i%es on the %or#orate /AN
A++ eWONs ha2e a%%ess to other eWONs
ENDIANSettings
:o a%hie2e this @+o;a+ V)N inter7'+ients %ommuni%ations6 -ou need to a++ow it in the
A(vance( settin&s of the ENDIAN V)N Ser2er.
ENDIAN with eWON 5@ettin& started9 )a&e 1*>2!
Fi-ure .8/ &etwor'/ eWO&s see eac2 ot2ers
!. Networ" to#o+o&ies
eWONs 4 5oca# networ& of eWONs 4 eWONs see eWONs
If -ou ha2e +o%a+ networ" ;ehind eWONs6 -ou %an %onfi&ure the ENDIAN Ser2er to
hand+e automati%a++- the routes to these networ"s.
With this to#o+o&-4
A++ de2i%es on the %or#orate /AN ha2e a%%ess to a++ eWONs and to de2i%es
;ehind these eWONs
A++ de2i%es on the %or#orate /AN ha2e a%%ess to a++ de2i%es ;ehind eWONs
A++ eWONs ha2e a%%ess to a++ de2i%es on the %or#orate /AN
A++ de2i%es ;ehind eWONs ha2e a%%ess to a++ de2i%es on the %or#orate /AN
A++ eWONs and de2i%es ;ehind ha2e a%%ess to other eWONs and de2i%es
;ehind
ENDIAN Settings
In Ad2an%ed settin&s6
ENDIAN with eWON 5@ettin& started9 )a&e 20>2!
Fi-ure .9/ &etwor'/ local networ' o+ eWO&s
!. Networ" to#o+o&ies
And in ea%h A%%ounts6 -ou need to set the &etwor's e2in( client.
:his O#enV)N re;oot is required ;e%ause when -ou %han&e an a%%ount6 ma-;e -ou
ha2e %han&ed one of the '+ient 1outin& settin&s6 and then the ENDIAN Ser2er must
send to a++ V)N %+ients these new #arameters.
ENDIAN with eWON 5@ettin& started9 )a&e 21>2!
Fi-ure .:/ Account settin-s/ wit2 networ'
/$O0.!N. After %han&in& the networ"s settin&s6 the ENDIAN Ser2er wi++ in2ite
-ou to restart the O#enV)N ser2er.
:his restart wi++ dis%onne%t a++ V)N '+ients 5and the- wi++
automati%a++- re%onne%t to the O#enV)N9.
Se%urit- 'ha#ter $.
6. Securit*
:he #re2ious %ha#ter BNetwor" to#o+o&iesB a++ows -ou to desi&n &+o;a++- the sha#e of
-our networ". For e=am#+e6 if -ou want that the eWONJ1 has a%%ess to the %or#orate
/AN and on+- to another eWON6 -ou %annot a%hie2e that on+- with the ENDIAN V)N
%onfi&uration.
:o a++ow -ou to define a%%urate+- who ha2e a%%ess to who in -our V)N networ"6 -ou
need to use the Firewa++ fun%tiona+it- of the ENDIAN Ser2er and more s#e%ifi%a++- the
V)N Firewa++.
<- defau+t6 this V)N Firewa++ is disa;+ed6 then ena;+e it ;- %+i%"in& on the swit%h
;utton.
ENDIAN with eWON 5@ettin& started9 )a&e 22>2!
Fi-ure 0;/ %P& Firewall (isale(
Fi-ure 0./ %P& Firewall enale(
$. Se%urit-
Now6 the V)N Firewa++ is ena;+ed and ;+o%"s a++ the V)N traffi% ;e%ause there is no
ru+es defined. '+i%" on the +in" to %reate a ru+e.
:hen6 if -ou want to a++ow one user to a%%ess a++ the other V)N '+ients6 se+e%t the
Sour%e :-#e User and %hoose the name of the Aser in the +ist.
In Destination6 se+e%t the t-#e Aser and %hoose >A&?@ in the +ist.
:hin" to add a short des%ri#tion of -our ru+e in the 3e!ar' fie+d.
And #ush the ;utton.
Ase the A##+- ;utton to use immediate+- -our new ru+e.
'reate as man- ru+es as required to ;ui+d -our controlle( networ".
ENDIAN with eWON 5@ettin& started9 )a&e 23>2!
Fi-ure 00/ A(( a %P& Firewall rule
Fi-ure 01/ Don=t +or-et to apply new rules
1. 1e2isions
Revision Level Date Description
1.7 200*701722 First re+ease.
i 8i%rosoft6 Internet E=#+orer6 Windows and Windows K) are either re&istered trademar"s or trademar"s of
8i%rosoft 'or#oration
ii Firefo= is a trademar" of the 8o?i++a Foundation
Do%ument ;ui+d num;er4 17
Note concerning the warranty and the rights of ownership:
The information contained in this document is subject to modification without notice.
The vendor and the authors of this manual are not liable for the errors it may contain, nor for their
eventual consequences.
No liability or warranty, explicit or implicit, is made concerning quality, the accuracy
and the correctness of the information contained in this document. In no case the manufacturers
responsibility could be called for direct, indirect, accidental or other damage occurring from any
defect of the product or errors coming from this document.
The product names are mentioned in this manual for information purposes only. The
trade mar!s and the product names or mar!s contained in this document are the property of their
respective owners.
This document contains materials protected by the International "opyright #aws. $ll
reproduction rights are reserved. No part of this handboo! can be reproduced, transmitted or copied
in any way without written consent from the manufacturer and%or the authors of this handboo!
e&'N sa, (ember of $"T# )roup. *ubject to change without notice.
ENDIAN with eWON 5@ettin& started9 )a&e 2!>2!