Changes

586 bytes added , 3 September

Line 421: Line 421:

<td>Source port</td>

<td>integer [0..65535] | range of integers [0..65534] - [1..65535] | port inversion [!0..!65535]; default: none</td>

−

<td>Port number(s) used by the connecting host. The rule will match the source port used by the connecting host with the port number(s) specified in this field. Leave empty to make the rule skip source port matching. Port negation using is also available, for ex. !1.<td>

+

<td>Port number(s) used by the connecting host. The rule will match the source port used by the connecting host with the port number(s) specified in this field. Leave empty to make the rule skip source port matching. Port negation using is also available, for ex. !1.</td>

</tr>

<tr>

Line 440: Line 440:

<tr>

<td>Action</td>

−

+

<td>Action that is to be taken when a packet matches the conditions of the rule.

<ul>

Line 448: Line 448:

<li>Don't track – packet is no longer tracked as it moves forward.</li>

<li>DSCP – packet is marked with specified DiffServ Code Point value.</li>

−

<li>Mark – packet is marked with specified firewall mark..</li>

+

<li>Mark – packet is marked with specified firewall mark.</li>

+

<li>Change TTL – packet's TTL value is adjusted based on the selected action</li>

</ul>

</td>

</tr>

−

</table>

+

<tr>

+

<td>TTL action</td>

+

<td>Set | Increment | Decrement; default: Set</td>

+

<td>TTL action to apply to packets.</td>

+

</tr>

+

<tr>

+

<td>TTL value</td>

+

<td>integer [1..255]; default: none</td>

+

<td>TTL value to use for actions.</td>

+

</tr>

+

</table>

====Advanced settings====

Line 476: Line 487:

<td>Mark: Set Target value</td>

<td>hex; default: none</td>

−

<td>If specified, target traffic against the given firewall mark, e.g. ~~0xFF~~ to target mark 255 ~~or 0x0/0x1 to target any even mark value~~.</td>

+

<td>If specified, target traffic against the given firewall mark, e.g. FF or ff to target mark 255.</td>

</tr>

<tr>

Line 491: Line 502:

<td>Mark: Set Match value</td>

<td>hex; default: none</td>

−

<td>If specified, match traffic against the given firewall mark, e.g. ~~0xFF~~ to match mark 255 ~~or 0x0/0x1 to match any even mark value~~.</td>

+

<td>If specified, match traffic against the given firewall mark, e.g. FF or ff to match mark 255.</td>

</tr>

<tr>

Line 537: Line 548:

<td>off | on; default: no</td>

−

<td>Specifies whether the device should use UTC time. If this is disabled, the time zone specified in the ~~Services~~ → [[{{{name}}} NTP|NTP]] page will be used.</td>

+

<td>Specifies whether the device should use UTC time. If this is disabled, the time zone specified in the System → Administration → [[{{{name}}}_Administration#NTP|NTP]] page will be used.</td>

</tr>

</table>

Line 614: Line 625:

The Source NAT section displays currently existing SNAT rules.

−

[[File:~~Networking_rutos_manual_firewall_nat_rules_source_nat~~.png|border|class=tlt-border]]

+

[[File:Networking_rutos_manual_firewall_nat_rules_source_nat_v2.png|border|class=tlt-border]]

===Add New Source NAT===

Line 620: Line 631:

The Add New Source NAT section is used to create new source NAT rules.

−

[[File:~~Networking_rutos_manual_firewall_nat_rules_add_new_source_nat~~.png|border|class=tlt-border]]

+

[[File:Networking_rutos_manual_firewall_nat_rules_add_new_source_nat_v4.png|border|class=tlt-border]]

Line 639: Line 650:

</tr>

<tr>

−

<td>~~Destination Zone</td>~~

+

<td>Rewrite IP</td>

−

~~<td>firewall zone; default: wan~~</td>

+

<td>IP | do not rewrite; default: none</td>

−

<td>~~Matches traffic destined for the specified zone.</td>~~

−

~~</tr>~~

−

~~<tr>~~

−

~~<td>To source~~ IP~~</td>~~

−

~~<td>ip~~ | do not rewrite; default: none</td>

<td>Changes the source IP address in the packet header to the value specified in this field.</td>

</tr>

<tr>

−

<td>~~To Source~~ Port</td>

+

<td>Rewrite Port</td>

<td>integer [0..65335] | port inversion [!0..!65535] | do not rewrite; default: none</td>

<td>Changes the source port in the packet header to the value specified in this field.</td>

Line 662: Line 668:

===Source NAT Configuration===

----

−

In order to begin editing a traffic rule, click the button ~~that looks like a pencil~~ [[File:~~Networking_rutx_trb14x_manual_edit_button_v1~~.png|20px]] next to it:

+

In order to begin editing a traffic rule, click the edit button [[File:Networking_rutx_trb14x_manual_edit_button_v2.png|20px]] next to it:

−

~~{{#ifeq: {{{series}}} | TRB1~~

+

[[File:Networking_rutos_manual_firewall_nat_rules_source_nat_edit_button_v3.png|border|class=tlt-border]]

−

~~| [[File:Networking_trb1_manual_firewall_nat_rules_source_nat_edit_button.png|border|class=tlt-border]]~~

−

| [[File:~~Networking_rutos_manual_firewall_nat_rules_source_nat_edit_button~~.png|border|class=tlt-border]]

−

}}

You will be redirected to that rule's configuration page:

−

[[File:~~Networking_rutos_manual_firewall_nat_rules_configuration_mobile_{{{~~mobile~~}}}_dualsim_{{{dualsim}}}_wired_{{{wired}}}~~.png|border|class=tlt-border]]

+

[[File:Networking rutos manual firewall nat rules configuration mobile general_v2.png|border|class=tlt-border]]

Line 688: Line 691:

<td>string; default none</td>

<td>Name of the rule. This is used for easier management purposes.</td>

+

</tr>

+

<tr>

+

<td>Target</td>

+

<td>SNAT | MASQUERADE | ACCEPT; default SNAT</td>

+

<td>NAT target to use when generating the rule.</td>

</tr>

<tr>

Line 707: Line 715:

<td>Source port</td>

<td>integer [0..65535] | range of integers [0..65534] - [1..65535] | port inversion [!0..!65535]; default: none</td>

−

<td>Mathes traffic originated from specified port number~~.<td>~~

+

<td>Mathes traffic originated from specified port number.</td>

−

~~</tr>~~

+

</tr>

−

~~<tr>~~

−

~~<td>Destination zone</td>~~

−

~~<td>firewall zone; default: wan</td>~~

−

~~<td>Matches traffic destined for the specified zone~~.</td>

−

</tr>

<tr>

<td>Destination IP address</td>

Line 725: Line 728:

</tr>

<tr>

−

<td>~~SNAT address~~</td>

+

<td>Rewrite port</td>

−

<td>ip; default: ~~none~~</td>

+

<td>integer [0..65535] | range of integers [0..65534] - [1..65535] | port inversion [!0..!65535]; default: No rewrite</td>

−

<td>~~Changes~~ matched traffic ~~packet source IP address~~ to the ~~value specified in this field~~.</td>

+

<td>Rewrite matched traffic to the given source port.</td>

</tr>

+

</table>

+

[[File:Networking rutos manual firewall nat rules configuration mobile advanced.png|border|class=tlt-border]]

+

<tr>

−

+

<th>Field</th>

−

<~~td>integer [0..65535] | range of integers [0..65534] - [1..65535]; default: none</b~~></td>

+

<th>Value</th>

−

<td>~~Changes matched traffic packet source port number to the value specified in this field.~~</td>

+

<th>Description</th>

</tr>

<tr>

Line 738: Line 746:

<td>string; default: none</td>

<td>Adds extra .iptables options to the rule.</td>

+

</tr>

+

</table>

+

[[File:Networking rutos manual firewall nat rules configuration mobile time restriction.png|border|class=tlt-border]]

+

+

<tr>

+

<th>Field</th>

+

<th>Value</th>

+

<th>Description</th>

</tr>

<tr>

Line 772: Line 790:

<td>off | on; default: no</td>

−

<td>Specifies whether the device should use UTC time. If this is disabled, the time zone specified in the ~~Services~~ → [[{{{name}}} NTP|NTP]] page will be used.</td>

+

<td>Specifies whether the device should use UTC time. If this is disabled, the time zone specified in the System → Administration → [[{{{name}}}_Administration#NTP|NTP]] page will be used.</td>

</tr>

</table>

Line 784: Line 802:

SYN Flood Protection allows you to protect yourself from attacks that exploit part of the normal TCP three-way handshake to consume resources on the targeted server and render it unresponsive. Essentially, with SYN flood DDOS, the offender sends TCP connection requests faster than the targeted machine can process them, causing network over-saturation.

−

[[File:~~Networking_rutos_manual_firewall_attack_prevention_syn_flood_protection~~.png|border|class=tlt-border]]

+

[[File:Networking_rutos_manual_firewall_attack_prevention_syn_flood_protection_v2.png|border|class=tlt-border]]

Line 800: Line 818:

<td>SYN flood rate</td>

<td>integer; default: 5</td>

−

<td>Set rate limit (packets per second) for SYN packets above which the traffic is considered ~~floodedb~~</td>

+

<td>Set rate limit (packets per second) for SYN packets above which the traffic is considered flooded</td>

</tr>

<tr>

<td>SYN flood burst</td>

<td>integer; default: 10</td>

−

<td>Sets burst limit for SYN packets above which the traffic is considered flooded if it exceeds the allowed ~~ratbe~~</td>

+

<td>Sets burst limit for SYN packets above which the traffic is considered flooded if it exceeds the allowed rate</td>

</tr>

<tr>

<td>TCP SYN cookies</td>

−

<td>off | on; default: ~~off~~</td>

+

<td>off | on; default: on</td>

−

<td>Enables the use of SYN cookies (particular choices of initial TCP sequence numbers by TCP servers)b</td>

+

<td>Enables the use of SYN cookies (particular choices of initial TCP sequence numbers by TCP servers)</td>

</tr>

</table>

Line 818: Line 836:

Some attackers use ICMP echo request packets directed to IP broadcast addresses from remote locations to generate denial-of-service attacks. You can set up some custom restrictions to help protect your router from ICMP bursts.

−

[[File:~~Networking_rutos_manual_firewall_attack_prevention_remote_icmp_requests~~.png|border|class=tlt-border]]

+

[[File:Networking_rutos_manual_firewall_attack_prevention_remote_icmp_requests_v2.png|border|class=tlt-border]]

Line 857: Line 875:

This protection prevent SSH attacks by limiting connections in a defined period.

−

[[File:~~Networking_rutos_manual_firewall_attack_prevention_ssh_attack_prevention~~.png|border|class=tlt-border]]

+

[[File:Networking_rutos_manual_firewall_attack_prevention_ssh_attack_prevention_v2.png|border|class=tlt-border]]

Line 877: Line 895:

<tr>

<td>Limit</td>

−

<td>integer; default: 5</td>

+

<td>integer [1..10000]; default: none</td>

<td>Maximum SSH connections during the set period</td>

</tr>

<tr>

<td>Limit burst</td>

−

<td>integer; default: 10</td>

+

<td>integer [1..10000]; default: none</td>

<td>Indicates the maximum burst before the above limit kicks in.</td>

</tr>

Line 891: Line 909:

An HTTP attack sends a complete, legitimate HTTP header, which includes a 'Content-Length' field to specify the size of the message body to follow. However, the attacker then proceeds to send the actual message body at an extremely slow rate (e.g. 1 byte/100 seconds.) Due to the entire message being correct and complete, the target server will attempt to obey the 'Content-Length' field in the header, and wait for the entire body of the message to be transmitted, hence slowing it down.

−

[[File:~~Networking_rutos_manual_firewall_attack_prevention_http_attack_prevention~~.png|border|class=tlt-border]]

+

[[File:Networking_rutos_manual_firewall_attack_prevention_http_attack_prevention_v2.png|border|class=tlt-border]]

Line 911: Line 929:

<tr>

<td>Limit</td>

−

<td>integer; default: 5</td>

+

<td>integer [1..10000]; default: none</td>

−

<td>Maximum HTTP connections during the set period<./td>

+

<td>Maximum HTTP connections during the set period.</td>

</tr>

<tr>

<td>Limit burst</td>

−

<td>integer; default: 10</td>

+

<td>integer [1..10000]; default: none</td>

<td>Indicates the maximum burst before the above limit kicks in.</td>

</tr>

Line 927: Line 945:

In cryptography and computer security, a man-in-the-middle attack (MITM) is an attack where the perpetrator secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other. One example of man-in-the-middle attacks is active eavesdropping, in which the attacker makes independent connections with the victims and relays messages between them to make them believe they are talking directly to each other over a private connection, when in fact the entire conversation is controlled by the attacker.

−

[[File:~~Networking_rutos_manual_firewall_attack_prevention_https_attack_prevention~~.png|border|class=tlt-border]]

+

[[File:Networking_rutos_manual_firewall_attack_prevention_https_attack_prevention_v2.png|border|class=tlt-border]]

Line 947: Line 965:

<tr>

<td>Limit</td>

−

<td>integer; default: 5</td>

+

<td>integer [1..10000]; default: none</td>

<td>Maximum HTTPS connections during the set period.</td>

</tr>

<tr>

<td>Limit burst</td>

−

<td>integer; default: 10</td>

+

<td>integer [1..10000]; default: none</td>

<td>Indicates the maximum burst number before the above limit kicks in.</td>

</tr>

Line 962: Line 980:

Port scanning is usually done in the initial phase of a penetration test in order to discover all network entry points into the target system. The Port Scan section provides you with the possibility to enable protection against port scanning software. The Defending Type section provides the possibility for the user to enable protections from certain types of online attacks. These include SYN-FIN, SYN-RST, X-Mas, FIN scan and NULLflags attacks.

−

[[File:~~Networking_rutos_manual_firewall_attack_prevention_port_scan~~.png|border|class=tlt-border]]

+

[[File:Networking_rutos_manual_firewall_attack_prevention_port_scan_v2.png|border|class=tlt-border]]

Line 977: Line 995:

<tr>

<td>Scan count</td>

−

<td>integer [5..~~65534~~]; default: 5</td>

+

<td>integer [5..10000]; default: none</td>

<td>How many port scans before blocked.</td>

</tr>

<tr>

<td>Interval</td>

−

<td>integer [10..60]; default: 10</td>

+

<td>integer [10..4096]; default: none</td>

<td>Time interval in seconds in which port scans are counted.</td>

</tr>

Line 1,032: Line 1,050:

The DMZ is a security concept. It comprises the separation of the LAN-side network into at least two networks: the user LAN and the DMZ. Generally the DMZ is imprisoned: only access to certain ports from the Internet are allowed into the DMZ, while the DMZ is not allowed to establish new connections to the WAN-side or LAN-side networks. That way, if a server inside of the DMZ is hacked the potential damage that can be done remains restricted! The whole point of the DMZ is to cleanly create a unique firewall rule set that dramatically restricts access in to, and out of the, DMZ.

−

[[File:Networking rutos manual network firewall ~~dmz~~.png|border|class=tlt-border]]

+

[[File:Networking rutos manual network firewall dmz_v2.png|border|class=tlt-border]]

TomasG

Administrators

1,433

edits

Changes

Template:Networking rutos manual firewall (view source)

Revision as of 15:43, 3 September 2024