Bild1.gif

Cybersecurity: Device selective connectivity using DNAT and MASQUERADE

MauroRiboniMX
Contributor
The Motivation

Production machines are really different one from the other but any machine has a controller (or more) that can be a target during a cyber attack. So how to protect our production? Just take outside some service that we need using a Port forwarding and then filter all the others. This solution is simple but usable with most of the devices.

MasqueradingMasquerading

Overview of the used setup

The idea is to access devices that are locally accessible by the ctrlX CORE. For this tutorial we want to access an IndraControl XM22, as shown in the picture below.

Test LayoutTest Layout

Equipment used
  • ctrlX CORE installed system apps release 2.02
    • XF10 set to 192.168.1.1, XF51 set to: 192.168.2.1
    • ctrlX AUTOMATION - Firewall app 2.02 (not working for 1.20)
  • IndraControl XM22 as target device in the network
Transfer data packets
Step 1: Forward data packets

In order to forward data packets it is necessary to allow IP forwarding between XF10 and XF51 interfaces:

ctrlX CORE Web UI - Ethernet port XF10 settingsctrlX CORE Web UI - Ethernet port XF10 settings

From firewall point of view it is also necessary to allow the packet forwarding (by default it is allowed). Then we will restrict it in order to select which package has to run. 

Step 2: DNAT  and MASQUERADING Settings

Now we have to setup the ctrlX CORE so that once we're interacting with the port 8082 of it we're in fact getting in contact with port 80 of the XM22. To achieve that we need to first access the firewall app and add a chain in the DNAT section if not present.

DNAT chainDNAT chain

Once we have created the chain we have to edit it and add a rule: any TCP request on port 8082 will be "DNATted" to port 80 of 192.168.1.25 so we have to match any packet over TCP protocol with destination port 8082.

DNAT settingDNAT setting

Now we have to fix the packets that are coming back using a masquerade directive. To achieve that we add a chain on the SNAT section and a rule containing the MASQUERADE directive.

SNAT sectionSNAT section

Masquerade directiveMasquerade directive

Step 4: XM22 access

Now it is all set up! When entering http://192.168.2.1:8082  to the browser the XM22 WebAssistant page should be reachable!

XM web InterfaceXM web Interface

Step 4: PROTECT the controller blocking all the ports and then allow just what we need to use 

Please refer to: Cybersecurity: use ctrlX CORE as a powerful net-filter for any controller! 

MauroRiboniMX
MauroRiboniMX
Hello, I am Mauro a ctrlX DEVELOPR at night and an Application Engineer during the day 😎 . Ask me anything about ctrlX AUTOMATION but my best topics are IoT, AI, SDK and Communication!
Must Read
Icon--AD-black-48x48Icon--address-consumer-data-black-48x48Icon--appointment-black-48x48Icon--back-left-black-48x48Icon--calendar-black-48x48Icon--center-alignedIcon--Checkbox-checkIcon--clock-black-48x48Icon--close-black-48x48Icon--compare-black-48x48Icon--confirmation-black-48x48Icon--dealer-details-black-48x48Icon--delete-black-48x48Icon--delivery-black-48x48Icon--down-black-48x48Icon--download-black-48x48Ic-OverlayAlertIcon--externallink-black-48x48Icon-Filledforward-right_adjustedIcon--grid-view-black-48x48IC_gd_Check-Circle170821_Icons_Community170823_Bosch_Icons170823_Bosch_Icons170821_Icons_CommunityIC-logout170821_Icons_Community170825_Bosch_Icons170821_Icons_CommunityIC-shopping-cart2170821_Icons_CommunityIC-upIC_UserIcon--imageIcon--info-i-black-48x48Icon--left-alignedIcon--Less-minimize-black-48x48Icon-FilledIcon--List-Check-grennIcon--List-Check-blackIcon--List-Cross-blackIcon--list-view-mobile-black-48x48Icon--list-view-black-48x48Icon--More-Maximize-black-48x48Icon--my-product-black-48x48Icon--newsletter-black-48x48Icon--payment-black-48x48Icon--print-black-48x48Icon--promotion-black-48x48Icon--registration-black-48x48Icon--Reset-black-48x48Icon--right-alignedshare-circle1Icon--share-black-48x48Icon--shopping-bag-black-48x48Icon-shopping-cartIcon--start-play-black-48x48Icon--store-locator-black-48x48Ic-OverlayAlertIcon--summary-black-48x48tumblrIcon-FilledvineIc-OverlayAlertwhishlist