Creating Server Publishing Rules - Dr. Tom Shinderamp;#039;s Configuring ISA Server 1002004 [Electronic resources] نسخه متنی

Creating Server Publishing Rules

Creating Server Publishing Rules is simple compared to Web Publishing Rules. The only things you need to know when creating a Server Publishing Rule are:

The protocol or protocols you want to publish

The IP address where the ISA firewall accepts the incoming connections

The IP address of the Protected Network server you want to publish

A Server Publishing Rule uses protocols with the primary connection set as Inbound, Receive or Receive/Send. For example, if you want to publish an SMTP server, the Protocol Definition for that protocol must be for SMTP, TCP port 25 Inbound. Outbound Protocol Definitions are used for Access Rules.

The ISA firewall comes with a number of built-in Server Publishing Protocol Definitions. Table 8.2 lists these built-in Protocol Definitions.

Any of the protocols in Table 8.2 can be used right out of the box for a Server Publishing Rule.

In the following example, we'll create a Server Publishing Rule for a RDP site on the default Internal Network. The RDP site could be a Terminal Server or a Windows XP machine running Remote Desktop:

In the Microsoft Internet Security and Acceleration Server 2004 management console, expand the server name, and then click the Firewall Policy node. Click the Tasks tab in the Task pane, and click Create a New Server Publishing Rule.

On the Welcome to the New Server Publishing Rule Wizard page, enter a name for the rule in the Server Publishing Rule name text box. In the example, we'll name the rule SPR - Terminal Server. Click Next.

On the Select Server page, enter the IP address of the published server on the ISA firewall Protected Network in the Server IP address text box. In this example, we'll enter 10.0.0.2. You can also click Browse to find the server, but the ISA firewall will need to be able to resolve the name of that server correctly. Click Next.

On the Select Protocol page (Figure 8.42), click the down-arrow for the Selected protocol list, and click the RDP (Terminal Services) Server protocol. You can see the details of the selected protocol in the Properties dialog box. You can also change the ports used to accept the incoming connections and the ports used to forward the connection to the published Web server. Click Ports.

Figure 8.42: The Select Protocol Page

The following options are available to you in the Ports dialog box.

Publish using the default port defined in the Protocol Definition This option allows the ISA firewall to listen on the default port defined in the Protocol Definition for the selected protocol. In the current example, the RDP Protocol Definition listens on TCP port 3389. Using this option the ISA firewall listens on TCP port 3389 on the IP address you set for the listener for this Server Publishing Rule. This is the default setting.

Publish on this port instead of the default port You can change the port number used to listen for incoming requests. This allows you to override the port number in the Protocol Definition. For example, we might want the ISA firewall to listen for incoming RDP connections on TCP port 8989. We could select Publish on this port instead of the default port, and then enter the alternate port, 8989, in the text box next to this option.

Send requests to the default port on the published server This option configures the ISA firewall to forward the connection using the same port the ISA firewall received the request on. In this example, the RDP Server Publishing Rule accepts incoming RDP connections on TCP port 3389. The connection is then forwarded to port 3389 on the published server. This is the default setting.

Send requests to this port on the published server This option allows you to perform port redirection. For example, if the ISA firewall accepts incoming requests for RDP connections on TCP port 3389, you can redirect the connection to an alternate port on the published RDP server, such as TCP port 89.

Allow traffic from any allowed source port This allows the ISA firewall to accept incoming connections from clients that use any source port in their requests to the published server. This is the default setting, and most applications are designed to accept connections from any client source port.

Limit access to traffic from this range of source ports You can limit the source port that the application connecting to the published server uses by selecting this option. If your application allows you to configure the source port, you can improve the security of your Server Publishing Rule by limiting connections from hosts using a specific source port and entering that port in the text box associated with this option. You can also list a range of allowed source ports if you want to allow multiple hosts to connect to the server.

Click OK after making any changes. In this example, we will not change the listener or forwarded port number.

On the IP Addresses page, you can select the Network(s) where you want the ISA firewall to listen for incoming connections to the published Web site. The IP Addresses page for Server Publishing Rules works the same way as that used by Web Publishing Rules. For more information on how to use the options on this page, review the discussion about the IP Address page in the non-SSL Web Publishing Rules section of this chapter. In this example, we'll select External by putting a checkmark in the External checkbox. Click Next.

Click Finish on the Completing the New Server Publishing Rule Wizard page.

Click Apply to save the changes and update the firewall policy.

Click OK in the Apply New Configuration dialog box.

The Server Publishing Rule Properties Dialog Box

You can fine-tune the Server Publishing Rule by opening the Server Publishing Rules Properties dialog box. Double-click the Server Publishing Rule to open the Properties dialog box. The first tab you'll encounter is the General tab. Here you can change the name of the Server Publishing Rule and provide a description for the rule. You can also enable or disable the rule by changing the status of the Enable checkbox. The General tab is shown in Figure 8.43.

Figure 8.43: The General Tab

On the Action tab, set the rule for whether or not to log connections that apply to this rule. We recommend that you always log connections made via a Server Publishing Rule. However, if you have a reason why you do not want to log these connections (for example, privacy laws in your country do not allow logging this information), you can disable logging by removing the checkmark from the Log requests matching this rule checkbox shown in Figure 8.44.

Figure 8.44: The Action Tab

On the Traffic tab you can change the protocol used for the Server Publishing Rule by clicking the down arrow in the Allow network traffic using the following protocol drop-down list. You can create a new Protocol Definition for a Server Publishing Rule by clicking New, and you can view the details of the Protocol Definition used in the Server Publishing Rule by clicking Properties. You can also customize the source and destination ports allowed by the Server Publishing Rule using the Ports button. See options for the Traffic tab in Figure 8.45.

Figure 8.45: The Traffic Tab

You can control what hosts can connect to the published server using settings on the From tab. The default location allows hosts from Anywhere to connect to the published server via this rule. However, connections will only be allowed from hosts that can connect via Networks configured on the Networks tab. So, while hosts from Anywhere can connect to the published server, connections are still limited to those hosts who can connect via the interface(s) responsible for the Networks listed on the Networks tab.

You can get more granular access control over who can connect to the published server by removing the Anywhere option and allowing a more limited group of machines access to the published server. Click Anywhere, and then click Remove. Then click Add, and select a Network Object defining the group of machines you want to allow access to the published server.

You can further fine-tune access control by setting exceptions to the list of allowed hosts and adding them to the Exceptions list. Click Add in the Exceptions section. See Figure 8.46 for options on the From tab.

Figure 8.46: The From Tab

On the To tab, configure the IP address of the server published via this Server Publishing Rule. You can also control what client IP address is seen by the published server by your selection in the Request for the published server frame. You have two options:

Requests appear to come from the ISA Server computer

Requests appear to come from the original client

Requests appear to come from the ISA Server computer allows the published server to see the source IP address of the incoming connection to the IP address on the network interface on the ISA firewall that is on the same Network as the published server. For example, if the published server is on the Internal network, and the ISA firewall's interface on the Internal Network is 10.0.0.1, then the published server will see the source IP address of the incoming connection as 10.0.0.1.

This option is useful when you do not want to make the published server a SecureNAT client. The SecureNAT client is one where the machine is configured with a default gateway address that routes all Internet-bound connections through the ISA firewall. If you do not want to change the default gateway address on the published server, then use Requests appear to come from the ISA Server computer. The only requirement is, if the published server is on a different subnet from the ISA firewall, the published server needs to be able route to the IP address that the ISA firewall uses when it forwards the connection to the published server.

If you want the published server to see the actual client IP address, select Requests appear to come from the original client. This option requires that the published server be configured as a SecureNAT client. The reason why the machine must be configured as a SecureNAT client is that since the client IP address is from a non-local network, the published server must have a default gateway that routes Internet-bound communications through the ISA firewall. Figure 8.47 illustrates the options on the To tab.

Figure 8.47: The To Tab

On the Networks tab, you can configure which Networks the ISA firewall can listen on to accept incoming connections to the published server. In this example, we set the Server Publishing Rule to accept incoming connections from hosts on the External Network (the default External Network includes all addresses that aren't defined in any other Network on the ISA firewall).

You can configure the ISA firewall to listen on any Network. For example, you can configure the Server Publishing Rule to listen for connections on the VPN Clients Network. VPN clients can then connect to the published server via this Server Publishing Rule. The Networks tab is shown in Figure 8.48.

Figure 8.48: The Networks Tab

On the Schedule tab, you can set when connections can be made to the published server. There are three default schedules:

Always Users can always connect to the published server.

Weekends Users can connect to the published server from 12:00

A.M. to 12:00

A.M. Saturday and Sunday.

Work hours Users can connect to the published server from 9:00

A.M. to 5:00

P.M. Monday through Friday.

You can also create your own schedule using the New button. We'll talk more about creating schedules in Chapter 10. Note that schedules control when users can connect to the published server, but they do not drop existing connections. The reason for this is that users who connected to the published server connected when connections are allowed, and they may have ongoing work that would be disturbed if the connection where arbitrarily halted by the schedule. You can script a disconnect by stopping the Microsoft Firewall service and restarting it if you must stop all connections. The Schedule tab is shown in Figure 8.49.

Figure 8.49: The Schedule Tab

Server Publishing HTTP Sites

You might have noticed when going over the list of Protocol Definitions used for Server Publishing Rules that there wasn't a Protocol Definition for HTTP Server. There is a Protocol Definition for HTTPS servers but not for HTTP. If you want to create a Server Publishing Rule for HTTP server publishing then you will need to create your own HTTP server Protocol Definition.

We recommend that you always use Web Publishing Rules to publish Web sites, but there may be times when you want to publish a Web site that isn't compliant with Web Proxy servers. In this case you will need to use a Server Publishing Rule instead of a Web Publishing Rule.

Perform the following steps to create the Protocol Definition for HTTP Server publishing:

In the Microsoft Internet Security and Acceleration Server 2004 management console, expand the server name and click the Firewall Policy node. Click the Toolbox tab in the Task Pane and click the Protocols header.

Click the New menu and click Protocol.

On the Welcome to the New Protocol Definition Wizard page, enter HTTP Server in the Protocol Definition name text box and click Next.

On the Primary Connection Information page, click the New button.

On the New/Edit Protocol Connection page, set the Protocol type to TCP and the Direction to Inbound. In the Port range frame, set the From and To values to 80. Click OK.

Figure 8.50: The New/Edit Protocol Connection dialog box

Click Next on the Primary Connection Information page.

On the Secondary Connections page, select the No option and click Next.

Click Finish on the Completing the New Protocol Definition Wizard page.

Click Apply to save the changes and update the firewall policy.

Click OK in the Apply New Configuration dialog box.

The new HTTP Server Protocol Definition appears in the list of User-Defined Protocol Definitions.