{"id":4745,"date":"2013-04-01T17:08:58","date_gmt":"2013-04-01T07:08:58","guid":{"rendered":"http:\/\/nsrd.info\/blog\/?p=4745"},"modified":"2013-04-01T17:08:58","modified_gmt":"2013-04-01T07:08:58","slug":"networker-tunnels","status":"publish","type":"post","link":"https:\/\/nsrd.info\/blog\/2013\/04\/01\/networker-tunnels\/","title":{"rendered":"NetWorker Tunnels"},"content":{"rendered":"<p><a href=\"https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2013\/04\/car-tunnel.jpg\"><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full wp-image-4746\" alt=\"Tunnel\" src=\"https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2013\/04\/car-tunnel.jpg\" width=\"500\" height=\"333\" srcset=\"https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2013\/04\/car-tunnel.jpg 500w, https:\/\/nsrd.info\/blog\/wp-content\/uploads\/2013\/04\/car-tunnel-300x199.jpg 300w\" sizes=\"auto, (max-width: 500px) 100vw, 500px\" \/><\/a><\/p>\n<p>NetWorker and firewalls has always been a bit of a challenging combination. It&#8217;s become increasingly simplified over time \u2013 to the point where even a network luddite such as myself can readily configure ports access across a firewall \u2013 so long as the firewall administrators or interface are cooperative.<\/p>\n<p>But the rub has always been the need for multiple ports. Many firewall administrators would like to only have to open one port across a DMZ. This is a feature some competing products have cited as an advantage in secure environments over NetWorker and to be honest, in situations where port minimisation is a key required feature, it&#8217;s been difficult to argue against that.<\/p>\n<p>A new feature in NetWorker 8 that I hadn&#8217;t noticed before however is a new option \u2013 tunnelling. As per typical network tunnels, the scenario available to NetWorker now is specifying a single IP address and port number on either side of the DMZ to pass\u00a0<em>all<\/em> traffic through.<\/p>\n<p>This functionality designates a communications proxy on either side of the firewall \u2013 a new NetWorker daemon,\u00a0<em>nsrtund<\/em>, comes into play, and access is configured via aliases and the\u00a0<em>server network interface<\/em> option within clients. Currently this looks to be restricted in operating systems &#8230; the tunnel proxy\u00a0<em>and<\/em> the NetWorker server need to be any of the following:<\/p>\n<ul>\n<li><span style=\"line-height: 13px;\">Solaris\/Sparc (10 or 11)<\/span><\/li>\n<li>Solaris\/AMD (10 or 11)<\/li>\n<li>RHEL on x86\/x64;<\/li>\n<li>SLES on x86\/x64.<\/li>\n<\/ul>\n<p>I&#8217;m hoping Windows gets added to that mix soon &#8211; we know Windows represents a <a title=\"NetWorker Usage Survey, December 2012\" href=\"https:\/\/nsrd.info\/reports\/NW_Usage_Survey_December_2012.pdf\" target=\"_blank\">substantial aspect of NetWorker server deployments<\/a> these days.<\/p>\n<p>I&#8217;ve not yet had a chance to run up a configuration to test tunnelling, but the documentation looks comprehensive, and if you&#8217;re interested in using it yourself, you&#8217;ll find it in the <a title=\"Simplifying firewall port requirements in NetWorker\" href=\"https:\/\/support.emc.com\/docu43525_Simplifying_firewall_port_requirements_with_NSR_tunnel.pdf?language=en_US\" target=\"_blank\">Technical Notes section on the support.emc.com website<\/a>.<\/p>\n<p>(Oh, and while I&#8217;m at it \u2013 kudos to EMC for renaming their documentation files to sensible names reflective of the title and content, rather than the old standard of part numbers. It&#8217;s great to see technology companies adjusting things to suit customers better.)<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>NetWorker and firewalls has always been a bit of a challenging combination. It&#8217;s become increasingly simplified over time \u2013 to&hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[16,21],"tags":[386,1254,1143,1144],"class_list":["post-4745","post","type-post","status-publish","format-standard","hentry","category-networker","category-security","tag-firewall","tag-security","tag-tunnel","tag-tunnelling"],"aioseo_notices":[],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/pKpIN-1ex","jetpack_sharing_enabled":true,"jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/posts\/4745","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/comments?post=4745"}],"version-history":[{"count":4,"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/posts\/4745\/revisions"}],"predecessor-version":[{"id":4750,"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/posts\/4745\/revisions\/4750"}],"wp:attachment":[{"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/media?parent=4745"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/categories?post=4745"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nsrd.info\/blog\/wp-json\/wp\/v2\/tags?post=4745"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}