Difference between revisions of "RUTX12 Traffic control with Firewall WANzone Splitting"
From Teltonika Networks Wiki
| (56 intermediate revisions by 2 users not shown) | |||
| Line 1: | Line 1: | ||
| − | + | ||
==Introduction== | ==Introduction== | ||
This article contains instructions on how to configure mobile SIM traffic effectively, The configuration ensures that when SIM1 is active, it provides internet connectivity to all end devices. However, when SIM2 is being used, the configuration should impose restrictions on the traffic flow from PC2 and only traffic from. | This article contains instructions on how to configure mobile SIM traffic effectively, The configuration ensures that when SIM1 is active, it provides internet connectivity to all end devices. However, when SIM2 is being used, the configuration should impose restrictions on the traffic flow from PC2 and only traffic from. | ||
| − | [[File: | + | [[File:Image Traffic Control..png|center|700x700px|Image Traffic Control|alt=]] |
==Prerequisites== | ==Prerequisites== | ||
For this configuration you will need: | For this configuration you will need: | ||
| − | * Teltonika Networks router with dual sim card support ( | + | * Teltonika Networks router with dual sim card support (RUTX11 is being used in the example); |
* 2 SIM cards; | * 2 SIM cards; | ||
* 2 end devices connected to the router (PC's are being used in the example); | * 2 end devices connected to the router (PC's are being used in the example); | ||
| Line 12: | Line 12: | ||
==Preparation== | ==Preparation== | ||
| − | * Prepare RUTX12, power up the device, insert two sim cards, check that both are active and working. SIM1, SIM2, PWR | + | * Prepare RUTX12, power up the device, insert two sim cards, check that both are active and working. SIM1, SIM2, PWR and signal strength indicators should light up. |
| − | * Access the router through WEBUI, go to | + | * Access the router through WEBUI, go to Network -> Interfaces, make sure that one or the other mobile interference is running MOB1S1A1 or MOB2S1A1 (Status = Running). You should be able to see their Ip addresses. |
* Make sure that you have ADVANCED mode enabled. This will allow you to choose from a larger variety of settings. | * Make sure that you have ADVANCED mode enabled. This will allow you to choose from a larger variety of settings. | ||
| + | |||
| + | == Firewall == | ||
| + | A '''Firewall''' is a network security software that is designed to monitor, filter, and control incoming and outgoing network traffic based on predetermined security rules. Its primary purpose is to establish a barrier between a trusted internal network and untrusted external networks, such as the internet. Firewalls play a crucial role in enhancing the security of computer networks by regulating the flow of data and protecting against unauthorized access, cyberattacks, and data breaches. | ||
== Configuration == | == Configuration == | ||
| − | + | ||
| − | |||
| − | |||
=== Firewall General Settings === | === Firewall General Settings === | ||
| − | The '''General Settings''' section is utilized for configuring the core policies of the device's firewall. To access this configuration, proceed to: '''Network –> Firewall -> General Setting''' While maintaining the default settings for other options, click on the Edit symbol corresponding to the zones | + | The '''General Settings''' section is utilized for configuring the core policies of the device's firewall. The visual representation depicted below presents an illustrative model of the General Settings section. The ensuing table provides comprehensive information about the fields that are intended to be configured within this section. To access this configuration, proceed to: '''Network –> Firewall -> General Setting''' While maintaining the default settings for other options, click on the Edit symbol corresponding to the zones. |
| − | |||
| − | = | + | [[File:Firewall_General_setting.png|alt=|700x700px]] |
| − | |||
| − | |||
| − | |||
| − | + | The '''Zones''' section is employed to oversee the default traffic forwarding policies among distinct zones within the device. Both "'''mob1s1a1'''" and "'''mob2s1a1'''" will be situated within the same Firewall zone, signifying that identical rules are pertinent to both SIM cards. Consequently, any traffic rule established will simultaneously influence on both SIM cards. As a result, it becomes necessary to generate two distinct zones for each SIM individually. | |
| − | |||
| − | [[File: | + | [[File:Zone.png|alt=|600x600px]] |
| − | |||
| − | |||
| − | + | === Create a new Zone: === | |
| − | + | [[File:Zone_Settings.png|alt=|600x600px]]<br /> | |
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | [[File: | ||
| − | <br /> | ||
| − | |||
| − | + | By clicking on '''Add''' button as shown: | |
| − | |||
| − | |||
| − | * In the ''' | + | * Choose a '''Name''' for this rule as per your preference. |
| − | * Assign a Name of your choosing to this rule. | + | * Set the input to be in the "'''Reject'''" zone. |
| + | * Configure the forward action to be directed to the "'''Reject'''" zone. | ||
| + | * Designate the output to be in the "'''Accept'''" zone. | ||
| + | * Activate both '''Masquerading''' and '''MSS clamping''' options. | ||
| + | * In the "'''Covered'''" zone, select the SIM Interface individually. In the provided example, it will be "SIM2" identified as "mob2s1a1". | ||
| + | |||
| + | [[File:New Zone.png|700x700px]] | ||
| + | |||
| + | === Establish the traffic rule === | ||
| + | To establish the traffic rule according to the zones you've set up, follow these steps '''Navigate to Network –> Firewall -> Traffic Rule''' to begin creating the rule. Create and set up the rule to enable the host's access to the web server. | ||
| + | |||
| + | * In the '''<nowiki/>'Add type'''' field, select 'Add new forward rule'. | ||
| + | * Assign a '''Name''' of your choosing to this rule. | ||
* Choose "'''LAN'''" as the source zone. | * Choose "'''LAN'''" as the source zone. | ||
| − | * Select "''' | + | * Select "'''WAN'''" as the destination zone. |
| − | * Click the | + | * Click the 'Add' button to confirm and add the rule. |
| − | [[File: | + | |
| + | [[File:Add New Instance.png]] | ||
=== Specify the source zone === | === Specify the source zone === | ||
Upon clicking '''<nowiki/>'Add'''' in the previous step, a new window will appear, enabling you to define additional configurations. | Upon clicking '''<nowiki/>'Add'''' in the previous step, a new window will appear, enabling you to define additional configurations. | ||
| − | + | * Specify the source zone for which the SIM Interface is intended. In the provided instance, this would be '''SIM2''' labelled as "'''mob2s1a1'''". | |
| − | + | * Choose the '''MAC address''' associated with the host to which the rule is to be applied in the source MAC address section. If needed, you can input a custom MAC address. | |
| − | + | * Input the '''IP address''' of the host in the source IP address field. | |
| − | + | * Within the action field, opt for '''<nowiki/>'Accept''''. | |
* Click on '''<nowiki/>'Save and Apply''''. | * Click on '''<nowiki/>'Save and Apply''''. | ||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | + | [[File:Traffic Rules.png]] | |
| − | |||
| − | |||
| − | |||
| − | |||
You can specify additional settings as you wish. For example, you can set times when this rule should apply. This way, the host will be able to access the web server only at certain times. | You can specify additional settings as you wish. For example, you can set times when this rule should apply. This way, the host will be able to access the web server only at certain times. | ||
Revision as of 08:41, 12 September 2023
Introduction
This article contains instructions on how to configure mobile SIM traffic effectively, The configuration ensures that when SIM1 is active, it provides internet connectivity to all end devices. However, when SIM2 is being used, the configuration should impose restrictions on the traffic flow from PC2 and only traffic from.
Prerequisites
For this configuration you will need:
- Teltonika Networks router with dual sim card support (RUTX11 is being used in the example);
- 2 SIM cards;
- 2 end devices connected to the router (PC's are being used in the example);
Preparation
- Prepare RUTX12, power up the device, insert two sim cards, check that both are active and working. SIM1, SIM2, PWR and signal strength indicators should light up.
- Access the router through WEBUI, go to Network -> Interfaces, make sure that one or the other mobile interference is running MOB1S1A1 or MOB2S1A1 (Status = Running). You should be able to see their Ip addresses.
- Make sure that you have ADVANCED mode enabled. This will allow you to choose from a larger variety of settings.
Firewall
A Firewall is a network security software that is designed to monitor, filter, and control incoming and outgoing network traffic based on predetermined security rules. Its primary purpose is to establish a barrier between a trusted internal network and untrusted external networks, such as the internet. Firewalls play a crucial role in enhancing the security of computer networks by regulating the flow of data and protecting against unauthorized access, cyberattacks, and data breaches.
Configuration
Firewall General Settings
The General Settings section is utilized for configuring the core policies of the device's firewall. The visual representation depicted below presents an illustrative model of the General Settings section. The ensuing table provides comprehensive information about the fields that are intended to be configured within this section. To access this configuration, proceed to: Network –> Firewall -> General Setting While maintaining the default settings for other options, click on the Edit symbol corresponding to the zones.
The Zones section is employed to oversee the default traffic forwarding policies among distinct zones within the device. Both "mob1s1a1" and "mob2s1a1" will be situated within the same Firewall zone, signifying that identical rules are pertinent to both SIM cards. Consequently, any traffic rule established will simultaneously influence on both SIM cards. As a result, it becomes necessary to generate two distinct zones for each SIM individually.
Create a new Zone:
By clicking on Add button as shown:
- Choose a Name for this rule as per your preference.
- Set the input to be in the "Reject" zone.
- Configure the forward action to be directed to the "Reject" zone.
- Designate the output to be in the "Accept" zone.
- Activate both Masquerading and MSS clamping options.
- In the "Covered" zone, select the SIM Interface individually. In the provided example, it will be "SIM2" identified as "mob2s1a1".
Establish the traffic rule
To establish the traffic rule according to the zones you've set up, follow these steps Navigate to Network –> Firewall -> Traffic Rule to begin creating the rule. Create and set up the rule to enable the host's access to the web server.
- In the 'Add type' field, select 'Add new forward rule'.
- Assign a Name of your choosing to this rule.
- Choose "LAN" as the source zone.
- Select "WAN" as the destination zone.
- Click the 'Add' button to confirm and add the rule.
Specify the source zone
Upon clicking 'Add' in the previous step, a new window will appear, enabling you to define additional configurations.
- Specify the source zone for which the SIM Interface is intended. In the provided instance, this would be SIM2 labelled as "mob2s1a1".
- Choose the MAC address associated with the host to which the rule is to be applied in the source MAC address section. If needed, you can input a custom MAC address.
- Input the IP address of the host in the source IP address field.
- Within the action field, opt for 'Accept'.
- Click on 'Save and Apply'.
You can specify additional settings as you wish. For example, you can set times when this rule should apply. This way, the host will be able to access the web server only at certain times.
