La Segunda República: periodismo de combate
M ONARQUÍA HOY , R EPÚBLICA MAÑANA
Clientless web access supports only a small set of corporate business applications that already have a web interface or can be easily webified. To be a complete remote access VPN solution, SSL VPN–based solutions need to be able to support other types of applications. The port-forwarding client solves part of the problems.
The SSL VPN port-forwarding client is a client-side agent that intercepts specific application traffic and redirects the traffic to the SSL VPN gateway through the established SSL connection. The port-forwarding client is normally a thin client, that is, a small application or applet that is smaller than 100 KB.
SSL VPN vendors use different techniques to implement the port-forwarding function, for example, a Java applet, ActiveX control, Windows Layered Service Provider (LSP), or Windows Transport Data Interface (TDI). The most popular technique is the Java applet- based port-forwarding client. Compared to other Windows-based techniques, Java applet– based port forwarding supports both Windows and non-Windows systems, such as Linux and Mac OS, as long as the client system supports Java.
Figure 2-12 SSL VPN Port-Forwarding Operation
The following list describes the process illustrated in Figure 2-12:
1 The end user launches a web browser to connect to the SSL VPN gateway. After the user signs in, the user clicks to launch the port-forwarding client.
2 The client machine downloads and runs the Java applet–based port-forwarding client. The port forwarding can be configured in the following two ways:
— For each client application that connects to an internal application server, a local loopback IP address and port are predefined. For example, for a Telnet application to internal server 10.1.1.1, the port forwarding client maps it to loop back IP 127.0.0.10 and port 6500. Instead of running Telnet to 10.1.1.1, the end user enters telnet 127.0.0.10 6500 to telnet to 127.0.0.10 on port 6500. This sends the traffic to the port-forwarding client that is listening on this IP address and port. The port-forwarding client then encapsulates the client Telnet traffic and forwards it to the SSL VPN gateway using an established SSL connection. The SSL VPN gateway then unpacks the traffic and forwards the Telnet request to the internal server at 10.1.1.1.
— With the method described in the previous point, end users have to change the application setting every time to connect to the assigned loopback IP address and port—an operation they find inconvenient.
To solve the problem, a port-forwarding configuration can specify the host name of the internal application server. For example, the Cisco port-forwarding client first backs up the Hosts file on the client machine, and then adds an entry in the Hosts file
Port-Forwarding Client
Listening on 127.0.0.10 and port-forwards incoming traffic to SSL VPN gateway.
Client Hosts File
app_server 127.0.0.10 Web Browser Client Application Connects to app_server Client Machine DNS looks up app_server.
Send traffic to loopback address on which port-
forwarding listens.
Modifies client Hosts file to map internal
Server IP to local Loopback address. Downloads and installs port-forwarding client. SSL VPN Gateway Internal App Server
to map the internal server host name to the assigned loopback IP address. Use the previous example to see how this works. For the internal server 10.1.1.1 with host name router.company.com, the port-forwarding client first backs up the client machine’s Hosts file to Hosts.webvpn, and then adds the following entry to the Hosts file: 127.0.0.10 router.company.com. The end user in this case would just enter telnet router.company.com. To perform the DNS lookup, the client machine looks up the modified Hosts file and then sends the Telnet traffic to the loopback address on which the port-forwarding client is listening.
With this method, the end users do not have to change the client application setting every time. However, to modify the Hosts file, the end user would need certain user privileges. For example, Linux users would normally require root-level privilege to be able to change the Hosts file.
3 Users launch a client application in the previous steps. The port-forwarding client port-forwards the client application traffic to the SSL VPN gateway under the protection of the established SSL connection.
4 The SSL VPN gateway unwraps the traffic and forwards the client application traffic to the internal application server, and relays the subsequent communication between the client and the server.
5 The end user finishes the application and logs out. The port-forwarding client restores the client machine’s Hosts file. The port-forwarding client can either be uninstalled upon user logout or stay on the client machine.
As you can see from previous description, the Java applet–based port-forwarding technique has the following characteristics:
•
For each TCP flow, a port-forwarding entry needs to be specifically configured to map to a local loopback address and TCP port.•
The application needs to be initiated from the client side.Java applet–based port-forwarding clients normally support only simple client-server- based, single-channel TCP applications, such as Telnet, SMTP, POP3, and Windows remote desktop service. For applications that use multiple TCP ports or dynamic TCP ports, such as active FTP and Microsoft Exchange Protocol, Java applet–based port forwarding is not a good choice.
Some Windows-based port-forwarding clients support some multichannel TCP
applications and applications that use dynamic ports. They can only track and port-forward traffic from specific Windows processes or to specific destination addresses. Although this allows the port-forwarding clients to support more applications, they are limited to Windows-based client computers and can require end users to have administrative privileges. The Smart Tunnel Access from the Cisco ASA SSL VPN appliance is one example.
Compared to clientless web access, the port-forwarding technology supports more applications but with less granular access control. The level of access control is still much more specific than the traditional IPsec clients, which provide full network-layer access to end users by default. This access and control trade-off makes port-forwarding technology a good choice for business partner access scenarios, where partners can access only specific application resources on the corporate network.