How do I configure IPTables to harden the Content Gateway host system?

Content Gateway FAQs | Forcepoint Web Security | v8.4.x | 31-July-2017

When Content Gateway is deployed on a stand-alone Linux server (not an appliance), it is strongly recommended that an IPTables firewall be configured to provide maximum security and efficiency with Content Gateway.


	Warning Only qualified system administrators should modify the IPTables firewall.

Content Gateway now utilizes iptables, configured during product installation or upgrade, to facilitate interception and redirection of traffic.

IPTables rules configured outside of Content Gateway Manager must

Be inserted after Forcepoint rules.

Never be added to Forcepoint chains.

Forcepoint chains and rules should never be edited.

If customized chains or rules impact the Forcepoint configuration, navigate to /opt/wcg/bin and execute the following to re-establish the Forcepoint IPTables chains and rules:

netcontrol.sh -r

While hardening the system is allowed, caution should be taken to avoid interfering with general Content Gateway functionality.

Configuration

The following list of rules is organized into groups that address different deployments. Be sure the /etc/sysconfig/iptables file contains all the rules that apply to your network from each section.

If the proxy is configured to use multiple NICs, for each rule that applies to an interface specify the appropriate NIC with the "-i" option ("-i" means match only if the incoming packet is on the specified interface). Typically, multiple interfaces are divided into these roles:

Management interface (MGMT_NIC) – The physical interface used by the system administrator to manage the computer.

Internet-facing interface (WAN_NIC) – The physical interface used to request pages from the Internet (usually the most secure interface).

Client-facing interface (CLIENT_NIC) – The physical interface used by the clients to request data from the proxy.

Cluster interface (CLUSTER_NIC) – The physical interface used by the proxy to communicate with members of the cluster.


	Note If you customized any ports that Forcepoint Web Security uses for communication, replace the default port shown in the following rules with the custom port you implemented.

All deployments

The following rules are optional and can be used to enhance the security of your Content Gateway deployment.

iptables --policy INPUT DROP

iptables --policy OUTPUT ACCEPT

iptables --policy FORWARD DROP

iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

In addition to the above rules, it is a best practice to increase the size of nf_conntrack_max to 100000 to improve performance. Set the size after iptables is started.

To check the setting, use: /sbin/sysctl -p

To set the value, use:

/sbin/sysctl net.nf_conntrack_max=100000

If you get the error "net.nf_conntrack_max" is an unknown key, you need to add the ip_conntrack module to the kernel. Use the command:

modprobe ip_conntrack

The nf_conntrack_max value is not be preserved after reboot unless you configure your system to set the value at startup. To do so, add the following line to /etc/sysctl.conf:

net.nf_conntrack_max=100000

The next group of rules are important for general system security and should be entered immediately after the above rules:

iptables -I INPUT -i lo -j ACCEPT

iptables -I INPUT -i internal -j ACCEPT

iptables -i <MGMT_NIC> -I INPUT -p tcp --dport 22 -j ACCEPT

iptables -i <MGMT_NIC> -I INPUT -p ICMP -j ACCEPT

Policy Server

All ports needed for communication with a Policy Server are handled internally by the software.

Filtering Service

All ports needed for communication with a Filtering Server machine are handled internally by the software.

Forcepoint Web Security

All ports needed for communication with Forcepoint Web Security are handled internally by the software.