On Tue, Jul 17, 2018 at 10:51:07PM -0600, C. Petro wrote:
I have a client who is setting up a logging infrastructure involving a couple of DMZs forwarding logs into central logging points.
They have to pass compliance audits (SOX, PCI at least) and have some rather specific desires in regards to how they want the log traffic to move, and which servers *initiate* the connections.
Which is to say they want the internal servers to set up tunnels to the DMZ servers and then the forwarders use that tunnel to deliver logs back.
Lemme see if I can ascii art this:
central1----------------------------------dmz1 ____________________ / _____________________\ _/ / \ central2----------------------------------dmz2
Something like that.
Central1=10.10.1.2 Central2=10.9.1.2
DMZ1=172.18.0.5 DMZ2=172.20.0.5
Firewalls are in effect.
I have gotten it set up so that I can initiate a connection FROM Central1 to DMZ2.
[Tunnel_to_DMZ2] client = yes accept = 3002 connect = 172.20.0.5:5000
And
[Tunnel_from_Central1] accept = 5000 connect = 3000
Like I said, I can open a tunnel from Central1 to DMZ2, but can't get traffic to pass backwards--I get a message in the log saying the session is closed.
So you are saying that the connection is established successfully? (you can check that in the logs of both stunnel instances and also using e.g. netstat or ss or similar tools on the hosts that should be talking to each other through the tunnel) ...but then, some indeterminate time later, one of the hosts tries to send some data through this connection and gets a connection reset or something like that?
If so, this sounds like something I've seen *a lot* with firewalls and other devices that try to keep track of connections passing through them (e.g. for NAT and such) - the firewall/NAT/whatever decides that there has been no traffic on that particular connection for, say, the last 15 minutes, so it drops it from its internal state - *obviously* those hosts do not need to talk to each other any more, who would ever have a 15-minute pause in a TCP connection, why would anybody want that? So the next time one of the hosts tries to send some data, the firewall/NAT/whatever says "hm, well, I don't know anything about this connection that you think you have, so, yeah, no".
TL;DR: maybe you should check the settings on some of the firewall devices and see if you can somehow raise the timeouts for inactive connections or something like that.
Is it possible to set stunnel up in a "reverse tunnel" mode--one where the connect is initiated from one end, but the other does most of the message passing?
What I am missing?
Hope the above helps.
G'luck, Peter