The Content Gateway ARM

The ARM inspects incoming packets before a routing decision is made and redirects the packets to Content Gateway for processing.

The ARM uses iptables, policy routing, and transparent sockets configured during product installation. The installation process also creates redirection rules to intercept packets. The ARM is always active.

To ensure that the proxy can serve HTTP, HTTPS, FTP, and DNS requests transparently, verify the redirection rules in the ipnat.conf file and edit them if necessary.

If you are using WCCP for transparent interception, there must be a redirection rule for every port in every active service group.

Rules for standard ports are included by default.

To review and edit the ARM redirection rules:

Log on to the Content Gateway manager and go to the Configure > Networking > ARM > General tab.

Verify the Redirection Rules (taken from the ipnat.conf file) and make any needed changes. To change a redirection rule:

Click Edit File to open the configuration file editor for the ipnat.conf file.

Select the rule you want to edit and modify the appropriate fields.

Click Set and then click Apply to apply your changes.

Click Close to exit the configuration file editor.

All fields are described in ARM.

If you have made any changes, go to the Configure > My Proxy > Basic > General tab and click Restart.

Configuring a firewall with ARM

The ARM module uses a firewall. To facilitate traffic interception and redirection:

IPTables rules are configured during Content Gateway installation and upgrade.

Forcepoint IPTables chains are inserted.

Forcepoint IPTables rules are inserted into existing chains.

Forcepoint chains and rules use "NC_" as a prefix for identification purposes.

IPTables rules configured outside of the Content Gateway manager must:

Be inserted after most Forcepoint rules.

Customized rules should, however, be added before the NC_RESERVED_FWD_DEF rule. This Forcepoint rule was added to the forward chain so that traffic that is not specifically handled by the proxy is dropped and not forwarded. This rule should always be the last rule in the forward chain

Never be added to Forcepoint chains.

Never be modified on Appliance platforms.

Forcepoint chains and rules should never be edited.

If customized chains or rules impact the Forcepoint configuration, navigate to the Content Gateway bin directory (/opt/WCG/bin) and run the following command:

netcontrol.sh -r

This re-establishes the Forcepoint IPTables chains and rules.