HOWTO: Configure your Juniper Firewall

This page will guide you through the configuration of a Juniper firewall to get the best performances out of reemo and allowing you and your users to get a direct/udp connection with Reemo.

Get started

To get started, connect on the web administrator console

Zone Address Book

Under Security\Policy Elements, open the Zone Address Book item

Add a new Address for Turn1 Reemo Server

  • Zone : Internet

  • Address Name: Reemo_TURN1

  • Domain Name : turn1.reemo.io

../_images/juniper_turn1.png

Add a new Address for Turn2 Reemo Server

  • Zone : Internet

  • Address Name: Reemo_TURN1

  • Domain Name : turn1.reemo.io

../_images/juniper_turn2.png

Add a new Address for Signal Reemo Server

  • Zone : Internet

  • Address Name: Reemo_Signal

  • Domain Name : signal.reemo.io

../_images/juniper_signal.png

Address Overview

../_images/juniper_addressoverview.png

Applications

Under Security\Policy Elements, open Applications menu

Add Custom-Applications for Reemo TURN

  • Application Name : Reemo_TURN_UDP443

  • Match IP protocol: udp

  • Destination Port : 443

../_images/juniper_app_turn.png

Add Custom-Applications for Reemo Protocol OUT

  • Application Name : Reemo_Protocol_out

  • Match IP protocol: udp

  • Source Port : 58200-58400

../_images/juniper_app_reemo_out.png

Add Custom-Applications for Reemo Protocol IN

  • Application Name : Reemo_Protocol_in

  • Match IP protocol: udp

  • Destination Port : 58200-58400

../_images/juniper_app_reemo_in.png

Applications Overview

../_images/juniper_app_overview.png

Security Policy

Under Security\Security Policy, Add Policy for TURN Servers

  • Policy Name : Reemo_TURN

  • Policy Action : permit

  • From Zone : internal

  • To zone : Internet

  • Source Address : LAN

  • Destination Address : Reemo_TURN1 , Reemo_TURN2

  • Applications : Reemo_TURN_UDP443 , junos-https

../_images/juniper_policy_turn.png

Add Policy for Signal Server

  • Policy Name : Reemo_Signal

  • Policy Action : permit

  • From Zone : internal

  • To zone : Internet

  • Source Address : LAN

  • Destination Address : Reemo_Signal

  • Applications : junos-https

../_images/juniper_policy_signal.png

Add Policy for ReemoAgent in

  • Policy Name : ReemoAgent_in

  • Policy Action : permit

  • From Zone : internal

  • To zone : Internet

  • Source Address : LAN

  • Destination Address : any

  • Applications : Reemo_Protocol_in

../_images/juniper_policy_in.png

Add Policy for ReemoAgent out

  • Policy Name : ReemoAgent_out

  • Policy Action : permit

  • From Zone : internal

  • To zone : Internet

  • Source Address : LAN

  • Destination Address : any

  • Applications : Reemo_Protocol_out

../_images/juniper_policy_out.png

Policies Overview

../_images/juniper_policy_overview.png

NAT Policy

Under NAT\Source click on the Global Settings

../_images/juniper_nat.png

In Interface Port-Overloading section, click Off and click OK to validate

../_images/juniper_nat_global.png

Add rules in your main Source Rule Set

../_images/juniper_nat_rule.png

Add rule for Reemo testpage

  • Rule Name : Reemo_NAT_TestPage_rule

  • Source Address : Local Network range (ex: 192.168.1.0/24)

  • IP Protocol : udp

  • Destination address : 0.0.0.0/0

  • Port : 443

  • Action Section :

    • Select Do Source NAT With Egress Interface Address

    • Select Persistent

      • Permit : any-remote-host

../_images/juniper_nat_rule_testpage.png

Add rule for ReemoAgent out

  • Rule Name : ReemoAgent_out

  • Source Address : Local Network range (ex: 192.168.1.0/24)

  • Ports : 58200-58400

  • IP Protocol : udp

  • Action Section :

    • Select Do Source NAT With Egress Interface Address

    • Select Persistent

      • Permit : any-remote-host

../_images/juniper_nat_rule_out.png

Add rule for ReemoAgent in

  • Rule Name : ReemoAgent_in

  • Source Address : Local Network range (ex: 192.168.1.0/24)

  • IP Protocol : udp

  • Port Range : 58200-58400

  • Action Section :

    • Select Do Source NAT With Egress Interface Address

    • Select Persistent

      • Permit : any-remote-host

../_images/juniper_nat_rule_in.png

NAT Overview

../_images/juniper_nat_overview.png