122
edits
Changes
mLine 28:
Line 28: − + Line 74:
Line 74: − <br>Let’s imagine that we would like to restrict traffic for this LAN network (192.168.1.0/24) and only one host needs to have access to the web server (185.xxx.xxx.xxx) on the internet. To achieve this, traffic rules could be configured.+ + + Line 83:
Line 85: − + − <br>+ − [[File:Firewall_traffic_rules_topology.png||border|class=tlt-border|800x800px]] − − [[File:Firewall traffic rules topology v3.png||border|class=tlt-border|800x800px]] − − Line 100:
Line 97: − + − − [[File:Traffic rule new size.png|border|class=tlt-border|828 × 159px]] − − [[File:Networking_rutos_configuration_example_firewall_traffic_rules_1-1_v2.png|border|class=tlt-border|750 × 170px]] Line 118:
Line 111: + + Line 124:
Line 119: − + Line 138:
Line 133: − Line 144:
Line 138: − + − − [[File:Networking_rutos_configuration_example_firewall_traffic_rules_2-3_v2.png|alt=Firewall two traffic rules to allow only a single host to access web server enabled|border|class=tlt-border|693x126px]] + − + Line 162:
Line 155: + − <br>A new window will pop-out where you will be able to specify additional settings. For the purpose of just opening a port, no additional settings are required. Scroll down and press '''‘Save & Apply’'''.+ − − − <br> Line 176:
Line 167: − + − First rule:+ + Line 191:
Line 183: − + − − + − + + + Line 206:
Line 199: − + Line 214:
Line 207: − − Line 257:
Line 248: − + Line 266:
Line 257: − + − − + Line 276:
Line 266: − + − [[File:Networking_rutos_configuration_example_firewall_traffic_rules_7-2_v1.png|alt=Firewall traffic rule to block a range of ports|border|class=tlt-border|471x521px]] + − <br>+ − − + − + + + Line 296:
Line 287: − + Line 305:
Line 296: − + + − <br>You can specify additional settings as you wish.<br>Scroll down and press '''‘Save & Apply’'''.<br>The new rule is created and enabled. To verify, go to the last page in '''‘Traffic rules’''' and verify that the rule is configured correctly and is enabled.<br>+ − − [[File:Networking_rutos_configuration_example_firewall_traffic_rules_8-3_v1.png|alt=Firewall traffic rule to block host MAC on certain times enabled|border|class=tlt-border|683x59px]] + − <br>
no edit summary
It is important to be mindful of the order of traffic rules. The rules can always be rearranged by simply clicking on the symbol on the left side of the rule and dragging the rule where it is needed. You can also change the configuration of each rule by finding your rule in the traffic rules and pressing a '''‘pencil’''' button to edit settings.<br>
It is important to be mindful of the order of traffic rules. The rules can always be rearranged by simply clicking on the symbol on the left side of the rule and dragging the rule where it is needed. You can also change the configuration of each rule by finding your rule in the traffic rules and pressing a '''‘pencil’''' button to edit settings.<br>
[[File:Networking_rutos_configuration_example_firewall_traffic_rules_rules_order.png|alt=firewall traffic rules rule order|border|class=tlt-border|800x800px]]
[[File:Networking_rutos_configuration_example_firewall_traffic_rule_order_v3.png|alt=firewall traffic rules rule order|border|class=tlt-border|715x123px]]
====Defining specific IP addresses and networks====
====Defining specific IP addresses and networks====
=== Allow a single host to access a web server in WAN network. ===
=== Allow a single host to access a web server in WAN network. ===
----
----
Let’s imagine that we would like to restrict traffic for this LAN network (192.168.1.0/24) and only one host needs to have access to the web server (185.xxx.xxx.xxx) on the internet.
[[File:Firewall traffic rules topology v3.png||border|class=tlt-border|800x800px]]
Two traffic rules would be required for this scenario:
Two traffic rules would be required for this scenario:
All network traffic coming from the specified host (192.168.1.11) will match the first rule and will be allowed. All other traffic coming from other hosts on the local Network will not match the first rule, but will match the second rule and will be dropped.
All network traffic coming from the specified host (192.168.1.11) will match the first rule and will be allowed. All other traffic coming from other hosts on the local Network will not match the first rule, but will match the second rule and will be dropped.
In this scenario only the host named ‘PC2’ on the '''LAN''' will be able to reach a web server in '''WAN'''.
In this scenario, only the host named ‘PC2’ on the '''LAN''' will be able to reach a web server in '''WAN'''.
====Traffic rule to block all traffic to WAN====
==== Traffic rules configuration to allow only a single host in LAN to access the webserver ====
----
----
Create and configure the first rule to block all local traffic to WAN network.
Create and configure the first rule to block all local traffic to WAN network.
*Click '''‘Add’'''.<br>
*Click '''‘Add’'''.<br>
[[File:Networking_rutos_configuration_example_firewall_traffic_rules_1-1_v1.png|alt=Firewall traffic rule to block LAN network.|border|class=tlt-border|800x800px]]
[[File:Networking_rutos_configuration_example_firewall_traffic_rules_1-1_v2.png|alt=Firewall traffic rule to block LAN network.|border|class=tlt-border|750 × 170px]]
A new window will pop-out where you will be able to specify additional settings.
A new window will pop-out where you will be able to specify additional settings.
[[File:Networking_rutos_configuration_example_firewall_traffic_rules_1-3_v1.png||border|class=tlt-border|679x61px]]
[[File:Networking_rutos_configuration_example_firewall_traffic_rules_1-3_v1.png||border|class=tlt-border|679x61px]]
====Traffic rule to allow the host access====
----
Create and configure the second rule to allow the host to access the web server:
Create and configure the second rule to allow the host to access the web server:
*Choose '''LAN''' as source zone.
*Choose '''LAN''' as source zone.
*Choose '''WAN''' as destination zone.
*Choose '''WAN''' as destination zone.
*Click '''‘Add’'''.<br>
*Click '''‘Add’'''.
[[File:Networking_rutos_configuration_example_firewall_traffic_rules_2-1_v1.png|alt=Firewall traffic rule to allow single host to web server|border|class=tlt-border|694x152px]]
[[File:Networking_rutos_configuration_example_firewall_traffic_rules_2-1_v1.png|alt=Firewall traffic rule to allow single host to web server|border|class=tlt-border|694x152px]]
[[File:Networking_rutos_configuration_example_firewall_traffic_rules_2-2_v3.png|alt=Firewall traffic rule to allow a single host to web server configuration|border|class=tlt-border|521x576px]]
[[File:Networking_rutos_configuration_example_firewall_traffic_rules_2-2_v3.png|alt=Firewall traffic rule to allow a single host to web server configuration|border|class=tlt-border|521x576px]]
You can specify additional settings as you wish. For example, you can set times when this rule should apply. This way, the host will be able to access the web server only at certain times.
You can specify additional settings as you wish. For example, you can set times when this rule should apply. This way, the host will be able to access the web server only at certain times.
Scroll down and press '''‘Save & Apply’'''.
Scroll down and press '''‘Save & Apply’'''.
The new rule is created and enabled. To verify, go to the last page in '''‘Traffic rules’''' and verify that the rule is configured correctly and is enabled. In addition, we need to move the second rule and ensure that the second rule is above the first rule.<br>
<br>The new rule is created and enabled. To verify, go to the last page in '''‘Traffic rules’''' and verify that the rule is configured correctly and is enabled. In addition, we need to move the second rule and ensure that the second rule is above the first rule.<br>
[[File:Networking_rutos_configuration_example_firewall_traffic_rules_2-3_v3.png|alt=Firewall two traffic rules to allow only a single host to access web server enabled|border|class=tlt-border|880x153px]]
These rules indicate that traffic from the host '''192.168.1.11''' in '''LAN''' destined to the IP address of 84.xxx.xxx.xxx on ports '''80''' and '''443''' in '''WAN''' must be accepted. The '''‘Accept forward’''' indicates the action (accept). The slider on the right side shows that the rule is enabled. The rule is above the Deny-LAN-WAN rule, so that traffic from host 192.168.1.11 (PC2) matches the first rule and is accepted. Traffic from other hosts in LAN will match the second rule and will be dropped.
These rules indicate that traffic from the host '''192.168.1.11''' in '''LAN''' destined to the IP address of '''185.xxx.xxx.xxx''' on ports '''80''' and '''443''' in '''WAN''' must be accepted. The '''‘Accept forward’''' indicates the action (accept). The slider on the right side shows that the rule is enabled. The rule is above the Deny-LAN-WAN rule, so that traffic from host 192.168.1.11 (PC2) matches the first rule and is accepted. Traffic from other hosts in LAN will match the second rule and will be dropped.
===Opening a port on the device. ===
===Opening a port on the device. ===
[[File:Networking_rutos_configuration_example_firewall_traffic_rules_3-1_v1.png|alt=Firewall traffic rule to open a port of a device||border|class=tlt-border|708x155px]]
[[File:Networking_rutos_configuration_example_firewall_traffic_rules_3-1_v1.png|alt=Firewall traffic rule to open a port of a device||border|class=tlt-border|708x155px]]
A new window will pop-out where you will be able to specify additional settings. For the purpose of just opening a port, no additional settings are required. Scroll down and press '''‘Save & Apply’'''.
<br>The new rule is created and enabled. To verify, go to the last page in '''‘Traffic rules’''' and verify that the rule is configured correctly and is enabled.
<br>The new rule is created and enabled. To verify, go to the last page in '''‘Traffic rules’''' and verify that the rule is configured correctly and is enabled.<br>
[[File:Networking_rutos_configuration_example_firewall_traffic_rules_3-2_v1.png|alt=Firewall traffic rule to open a port on a device enabled||border|class=tlt-border|677x56px]]
[[File:Networking_rutos_configuration_example_firewall_traffic_rules_3-2_v1.png|alt=Firewall traffic rule to open a port on a device enabled||border|class=tlt-border|677x56px]]
Here we can see that a new rule was created. It accepts '''TCP, UDP''' traffic from any host in '''WAN''' coming to the router on port '''8080'''. The slider on the right side is set to '''‘on’''' indicating that the rule is enabled.
Here we can see that a new rule was created. It accepts '''TCP, UDP''' traffic from any host in '''WAN''' coming to the router on port '''8080'''. The slider on the right side is set to '''‘on’''' indicating that the rule is enabled.
To open a port for only one host on LAN you would need to create 2 traffic rules. One rule to block LAN traffic from accessing the port on device, and the second rule to allow only a single host to access that port. Both rules have similarities. The steps below describe how to create and configure both rules with differences mentioned.
To open a port for only one host on LAN you would need to create 2 traffic rules. One rule to block LAN traffic from accessing the port on device, and the second rule to allow only a single host to access that port. Both rules have similarities. The steps below describe how to create and configure both rules with differences mentioned.
====Block traffic on a specific port from LAN====
----
A traffic rule to block packets on a specific port from LAN:
*In the '''‘Add type’''' field choose '''‘open ports on router’'''.
*In the '''‘Add type’''' field choose '''‘open ports on router’'''.
*Enter a name of your choice for this rule.
*Enter a name of your choice for this rule.
*Choose '''LAN''' as the source zone.
*Choose '''LAN''' as the source zone.
*Leave the source IP field '''‘any’''' or specify a LAN network to block.
*Leave the source IP field '''‘any’''' or specify a LAN network to block.
*In the action field choose '''‘Drop’'''.<br>
*In the action field choose '''‘Drop’'''.
[[File:Networking_rutos_configuration_example_firewall_traffic_rules_4-2_v1.png|alt=Firewall traffic rule to deny single port for LAN network configuration|border|class=tlt-border|470x516px]]
[[File:Networking_rutos_configuration_example_firewall_traffic_rules_4-2_v1.png|alt=Firewall traffic rule to deny single port for LAN network configuration|border|class=tlt-border|470x516px]]
Scroll down and press '''‘Save & Apply’'''.
Scroll down and press '''‘Save & Apply’'''.
The rule should not be created and enabled. The traffic coming from LAN to port 5000 on the device will now be dropped.
The second rule:
====Allow traffic on a specific port from a single host in LAN====
----
The second traffic rule to allow traffic on a specific port from a single host in LAN:
*In the '''‘Add type’''' field choose '''‘open ports on router’'''.
*In the '''‘Add type’''' field choose '''‘open ports on router’'''.
*Select '''<nowiki/>'TCP+UDP'''' as protocols.
*Select '''<nowiki/>'TCP+UDP'''' as protocols.
*Enter an external port to allow.
*Enter an external port to allow.
*Click '''‘Add’.''' <br>
*Click '''‘Add’.'''
[[File:Networking_rutos_configuration_example_firewall_traffic_rules_5-1_v1.png|alt=Firewall traffic rule to allow a single host on one port|border|class=tlt-border|696x156px]]
[[File:Networking_rutos_configuration_example_firewall_traffic_rules_5-1_v1.png|alt=Firewall traffic rule to allow a single host on one port|border|class=tlt-border|696x156px]]
[[File:Networking_rutos_configuration_example_firewall_traffic_rules_5-2_v1.png|alt=Firewall traffic rule to allow a single host on one port configuration|border|class=tlt-border|470x515px]]
[[File:Networking_rutos_configuration_example_firewall_traffic_rules_5-2_v1.png|alt=Firewall traffic rule to allow a single host on one port configuration|border|class=tlt-border|470x515px]]
Scroll down and press '''‘Save & Apply’'''.
Scroll down and press '''‘Save & Apply’'''.
The rule indicates that TCP traffic coming from the host '''84.xxx.xxx.xxx''' in the '''WAN''' to the device (router) on ports '''80''' and '''443''' will be accepted. The '''‘Accept input’''' indicates the action (accept). The slider on the right side shows that the rule is enabled.
The rule indicates that TCP traffic coming from the host '''84.xxx.xxx.xxx''' in the '''WAN''' to the device (router) on ports '''80''' and '''443''' will be accepted. The '''‘Accept input’''' indicates the action (accept). The slider on the right side shows that the rule is enabled.
In this scenario, only the host 138.199.19.170 will be able to access the WebUI of the router via it’s public IP. Similarly, if the port is set to 22 instead of 80 and 443, the remote host would be able to connect to the device via SSH, but not WebUI.
In this scenario, only the host '''84.xxx.xxx.xxx''' will be able to access the WebUI of the router via it’s public IP. Similarly, if the port is set to 22 instead of 80 and 443, the remote host would be able to connect to the device via SSH, but not WebUI.
===Block LAN network from accessing WAN on selected ports.===
===Block LAN network from accessing WAN on selected ports.===
*Choose '''LAN''' as the source zone.
*Choose '''LAN''' as the source zone.
*Choose '''WAN''' as the destination zone.
*Choose '''WAN''' as the destination zone.
*Click '''‘Add’'''.<br>
*Click '''‘Add’'''.
[[File:Networking_rutos_configuration_example_firewall_traffic_rules_7-1_v1.png|border|class=tlt-border|699x153px]]
[[File:Networking_rutos_configuration_example_firewall_traffic_rules_7-1_v2.png|border|class=tlt-border|699x156px]]
<br>
<br>
*Select '''<nowiki/>'TCP+UDP'''' as protocol.
*Select '''<nowiki/>'TCP+UDP'''' as protocol.
*In the destination port field enter the range of ports you wish to deny (For example, '''‘1500-1700’'''), or list specific ports by leaving spaces in-between port numbers (For example, '''‘80 443'''’).
*In the destination port field enter the range of ports you wish to deny (For example, '''‘1500-1700’'''), or list specific ports by leaving spaces in-between port numbers (For example, '''‘80 443'''’).
*In the action field choose '''‘Drop’'''.<br>
*In the action field choose '''‘Drop’'''.
[[File:Networking_rutos_configuration_example_firewall_traffic_rules_7-2_v2.png|alt=Firewall traffic rule to block a range of ports|border|class=tlt-border|473x521px]]
You can specify additional settings as you wish.
You can specify additional settings as you wish.<br>
Scroll down and press '''‘Save & Apply’'''.<br>
Scroll down and press '''‘Save & Apply’'''.<br>
The new rule is created and enabled. To verify, go to the last page in '''‘Traffic rules’''' and verify that the rule is configured correctly and is enabled.<br>
[[File:Networking_rutos_configuration_example_firewall_traffic_rules_7-3_v1.png|alt=Firewall traffic rule to block a range of ports enabled|border|class=tlt-border|677x59px]]
The new rule is created and enabled. To verify, go to the last page in '''‘Traffic rules’''' and verify that the rule is configured correctly and is enabled.
[[File:Networking_rutos_configuration_example_firewall_traffic_rules_7-3_v2.png|alt=Firewall traffic rule to block a range of ports enabled|border|class=tlt-border|677x58px]]
<br>
<br>
* Choose '''WAN''' as destination zone.
* Choose '''WAN''' as destination zone.
*Click '''‘Add’'''.<br>
*Click '''‘Add’'''.<br>
[[File:Networking_rutos_configuration_example_firewall_traffic_rules_8-1_v1.png|alt=Firewall traffic rule to block host MAC on certain times|border|class=tlt-border|697x150px]]
[[File:Networking_rutos_configuration_example_firewall_traffic_rules_8-1_v2.png|alt=Firewall traffic rule to block host MAC on certain times|border|class=tlt-border|696x152px]]
<br>
<br>
*On weekdays you can choose on which days the rule will apply (The device will not be able to communicate). You can choose days of the month, start and stop times, and other time settings.<br>
*On weekdays you can choose on which days the rule will apply (The device will not be able to communicate). You can choose days of the month, start and stop times, and other time settings.<br>
[[File:Networking_rutos_configuration_example_firewall_traffic_rules_8-2_v1.png|alt=Firewall traffic rule to block host MAC on certain times configuration|border|class=tlt-border|418x605px]]
[[File:Networking_rutos_configuration_example_firewall_traffic_rules_8-2_v2.png|alt=Firewall traffic rule to block host MAC on certain times configuration|border|class=tlt-border|419x606px]]
You can specify additional settings as you wish.<br>Scroll down and press '''‘Save & Apply’'''.
<br>The new rule is created and enabled. To verify, go to the last page in '''‘Traffic rules’''' and verify that the rule is configured correctly and is enabled.<br>
[[File:Networking_rutos_configuration_example_firewall_traffic_rules_8-3_v2.png|alt=Firewall traffic rule to block host MAC on certain times enabled|border|class=tlt-border|679x60px]]
This rule indicates that the PC with mac address of '''00:00:5e:xx:xx:xx''' will not be able to send traffic to '''WAN'''. The '''‘Discard forward’''' indicates the action (drop). The rule does not show the times at which this rule is applied, but the times can be found on the settings page ('''‘Pencil’''' button). This rule will be applied for the first time on the 12th of February, 2023. Then, every Monday, Tuesday, Wednesday, Thursday, and Friday, from 8 AM to 4 PM this PC will not be able to send traffic to '''WAN'''.
This rule indicates that the PC with mac address of '''00:00:5e:xx:xx:xx''' will not be able to send traffic to '''WAN'''. The '''‘Discard forward’''' indicates the action (drop). The rule does not show the times at which this rule is applied, but the times can be found on the settings page ('''‘Pencil’''' button). This rule will be applied for the first time on the 12th of February, 2023. Then, every Monday, Tuesday, Wednesday, Thursday, and Friday, from 8 AM to 4 PM this PC will not be able to send traffic to '''WAN'''.