Difference between revisions of "Template:Networking rutos manual firewall"
(Created page with "{{Template:Networking_rutos_manual_fw_disclosure | fw_version = {{{series}}}_R_00.02.03 | series = {{{series}}} }} ==Summary== {{{name}}} devices use a standard Linux iptable...") |
|||
(114 intermediate revisions by 7 users not shown) | |||
Line 1: | Line 1: | ||
− | {{Template: | + | {{Template:Networking_rutos_manual_fw_disclosure |
+ | | fw_version = {{{series}}}_R_00.02.03 | ||
| series = {{{series}}} | | series = {{{series}}} | ||
− | |||
− | |||
− | |||
− | |||
− | |||
}} | }} | ||
− | |||
− | |||
==Summary== | ==Summary== | ||
− | {{{name}}} devices use a standard Linux iptables package as its <b>firewall</b>, which uses routing chains and policies to facilitate control over inbound and outbound traffic. | + | {{{name}}} devices use a standard Linux iptables package as its <b>firewall</b>, which uses routing chains and policies to facilitate control over inbound and outbound traffic. This chapter is an overview of the Firewall section for {{{name}}} devices. |
− | + | {{Template:Networking_rutos_manual_basic_advanced_webui_disclaimer}} | |
− | + | ==General settings== | |
− | |||
− | |||
− | |||
− | ==General | ||
The <b>General Settings</b> section is used to configure the main policies of the device's firewall. The figure below is an example of the General Settings section and the table below provides information on the fields contained in that section: | The <b>General Settings</b> section is used to configure the main policies of the device's firewall. The figure below is an example of the General Settings section and the table below provides information on the fields contained in that section: | ||
− | [[File: | + | [[File:Networking_rutx_manual_firewall_general_settings_general_settings_v1.png]] |
<table class="nd-mantable"> | <table class="nd-mantable"> | ||
Line 30: | Line 20: | ||
<th>Value</th> | <th>Value</th> | ||
<th>Description</th> | <th>Description</th> | ||
+ | </tr> | ||
+ | <tr> | ||
+ | <td>Enable SYN flood protection</td> | ||
+ | <td>off | on; Default: <b>on</b></td> | ||
+ | <td>Enables protection from SYN flood type attacks. A SYN flood is a type of denial-of-service (DOS) attack where an attacker sends bursts of SYN requests in an attempt to make the target host machine consume enough resources and become unresponsive.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>Drop invalid packets</td> | <td>Drop invalid packets</td> | ||
− | <td>off | on; | + | <td>off | on; Default: <b>off</b></td> |
<td>If enabled, a "Drop" action will be performed on packets that are determined to be invalid.</td> | <td>If enabled, a "Drop" action will be performed on packets that are determined to be invalid.</td> | ||
− | |||
− | |||
− | |||
− | |||
− | |||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>Input</td> | <td>Input</td> | ||
− | <td>Reject | Drop | Accept; | + | <td>Reject | Drop | Accept; Default: <b>Accept</b></td> |
<td>Default action<span class="asterisk">*</span> of the INPUT chain if a packet does not match any existing rule on that chain.</td> | <td>Default action<span class="asterisk">*</span> of the INPUT chain if a packet does not match any existing rule on that chain.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>Output</td> | <td>Output</td> | ||
− | <td>Reject | Drop | Accept; | + | <td>Reject | Drop | Accept; Default: <b>Accept</b></td> |
<td>Default action<span class="asterisk">*</span> of the OUTPUT chain if a packet does not match any existing rule on that chain.</td> | <td>Default action<span class="asterisk">*</span> of the OUTPUT chain if a packet does not match any existing rule on that chain.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>Forward</td> | <td>Forward</td> | ||
− | <td>Reject | Drop | Accept; | + | <td>Reject | Drop | Accept; Default: <b>Reject</b></td> |
<td>Default action<span class="asterisk">*</span> of the FORWARD chain if a packet does not match any existing rule on that chain.</td> | <td>Default action<span class="asterisk">*</span> of the FORWARD chain if a packet does not match any existing rule on that chain.</td> | ||
</tr> | </tr> | ||
Line 64: | Line 54: | ||
<li><b>Reject</b> – packet is stopped, deleted and, differently from Drop, a message of rejection is sent to the source from which the packet came.</li> | <li><b>Reject</b> – packet is stopped, deleted and, differently from Drop, a message of rejection is sent to the source from which the packet came.</li> | ||
</ul> | </ul> | ||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
===Zones=== | ===Zones=== | ||
Line 97: | Line 59: | ||
The <b>Zones</b> section is used to manage default traffic forwarding policies between different device zones. The figure below is an example of the Zones section and the table below provides information on the fields contained in that section: | The <b>Zones</b> section is used to manage default traffic forwarding policies between different device zones. The figure below is an example of the Zones section and the table below provides information on the fields contained in that section: | ||
− | [[File: | + | [[File::Networking_rutx_manual_firewall_general_settings_zones_v1.png]] |
---- | ---- | ||
− | You can change a zone's settings from this page by interacting with entries in the zones table. For a more in-depth configuration click the | + | You can change a zone's settings from this page by interacting with entries in the zones table. For a more in-depth configuration click the button that looks like a pencil [[File:Networking_rutx_trb14x_manual_edit_button_v1.png|20px]] next to a zone: |
− | [[File: | + | [[File:Networking_rutx_manual_firewall_general_settings_zones_edit_v1.png]] |
− | ====Zones: | + | ====Zones: general settings==== |
---- | ---- | ||
− | [[File: | + | |
+ | [[File:Networking_rutx_manual_firewall_general_settings_zones_general_settings_v1.png]] | ||
<table class="nd-mantable"> | <table class="nd-mantable"> | ||
Line 120: | Line 83: | ||
<tr> | <tr> | ||
<td>Input</td> | <td>Input</td> | ||
− | <td>Reject | Drop | Accept; | + | <td>Reject | Drop | Accept; Default: <b>Accept</b></td> |
<td>Default policy for traffic entering the zone.</td> | <td>Default policy for traffic entering the zone.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>Output</td> | <td>Output</td> | ||
− | <td>Reject | Drop | Accept; | + | <td>Reject | Drop | Accept; Default: <b>Accept</b></td> |
<td>Default policy for traffic originating from and leaving the zone.</td> | <td>Default policy for traffic originating from and leaving the zone.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>Forward</td> | <td>Forward</td> | ||
− | <td>Reject | Drop | Accept; | + | <td>Reject | Drop | Accept; Default: <b>Reject</b></td> |
<td>Default policy for traffic forwarded between the networks belonging to the zone.</td> | <td>Default policy for traffic forwarded between the networks belonging to the zone.</td> | ||
</tr> | </tr> | ||
Line 145: | Line 108: | ||
<tr> | <tr> | ||
<td>Covered networks</td> | <td>Covered networks</td> | ||
− | <td> | + | <td>name of interface; default: <b>none</b></td> |
<td>Network or networks that belong to the zone.</td> | <td>Network or networks that belong to the zone.</td> | ||
</tr> | </tr> | ||
</table> | </table> | ||
− | ====Zones: | + | ====Zones: advanced settings==== |
---- | ---- | ||
− | [[File: | + | |
+ | [[File:Networking_rutx_manual_firewall_general_settings_zones_advanced_settings_v1.png]] | ||
<table class="nd-mantable"> | <table class="nd-mantable"> | ||
Line 182: | Line 146: | ||
<tr> | <tr> | ||
<td>Enable logging on this zone</td> | <td>Enable logging on this zone</td> | ||
− | <td>off | | + | <td>off | on; default: <b>off</b></td> |
<td>Logs packets that hit this rule.</td> | <td>Logs packets that hit this rule.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
− | <td | + | <td>Limit log messages</td> |
<td>integer/minute; default: <b>none</b></td> | <td>integer/minute; default: <b>none</b></td> | ||
<td>Limit how many messages can be logged in the span of 1 minute. For example, to log 50 packets per minute use: <i>50/minute</i>.</td> | <td>Limit how many messages can be logged in the span of 1 minute. For example, to log 50 packets per minute use: <i>50/minute</i>.</td> | ||
− | |||
− | |||
− | |||
− | |||
− | |||
</tr> | </tr> | ||
</table> | </table> | ||
− | ====Zones: | + | ====Zones: inter-zone forwarding==== |
---- | ---- | ||
The <b>Inter-zone forwarding</b> options control the forwarding policies between the currently edited zone and other zones. | The <b>Inter-zone forwarding</b> options control the forwarding policies between the currently edited zone and other zones. | ||
− | [[File: | + | [[File:Networking_rutx09_rutx11_manual_firewall_general_settings_zones_inter-zone_forwarding_v1.png]] |
<table class="nd-mantable"> | <table class="nd-mantable"> | ||
Line 221: | Line 180: | ||
</table> | </table> | ||
− | ==Port | + | ==Port forwards== |
<b>Port forwarding</b> is a way of redirecting an incoming connection to another IP address, port or the combination of both: | <b>Port forwarding</b> is a way of redirecting an incoming connection to another IP address, port or the combination of both: | ||
− | [[File:Networking_rutx_manual_firewall_port_forwards_scheme_v1.png | + | [[File:File:Networking_rutx_manual_firewall_port_forwards_scheme_v1.png]] |
---- | ---- | ||
The Port forwards table displays configured port forwarding rules currently configured on the device. | The Port forwards table displays configured port forwarding rules currently configured on the device. | ||
− | [[File: | + | [[File:Networking_rutx_manual_firewall_port_forwards_port_forwards_v1.png]] |
− | === | + | ===New port forward=== |
---- | ---- | ||
− | The <b> | + | The <b>New port forward</b> section is used to quickly add additional port forwarding rules. The figure below is an example of the New port forward section and the table below provides information on the fields contained in that section: |
− | [[File: | + | [[File:Networking_rutx_manual_firewall_port_forwards_new_port_forward_v1.png]] |
<table class="nd-mantable"> | <table class="nd-mantable"> | ||
Line 247: | Line 206: | ||
<td>string; default: <b>none</b></td> | <td>string; default: <b>none</b></td> | ||
<td>Name of the rule. This is used for easier management purposes.</td> | <td>Name of the rule. This is used for easier management purposes.</td> | ||
+ | </tr> | ||
+ | <tr> | ||
+ | <td>Protocol</td> | ||
+ | <td>TCP+UDP | TCP | UDP | Other; default: <b>TCP+UDP</b></td> | ||
+ | <td>Specifies to which protocols the rule should apply.</td> | ||
+ | </tr> | ||
+ | <tr> | ||
+ | <td>External zone</td> | ||
+ | <td>firewall zone name; default: '''wan'''</td> | ||
+ | <td>The zone to which hosts will be connecting.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>External port</td> | <td>External port</td> | ||
− | <td>integer [0..65535] | range of integers [0..65534] - [1.. | + | <td>integer [0..65535] | range of integers [0..65534] - [1..65535]; default: <b>none</b></td> |
− | <td>The port number to which hosts will be connecting.</td> | + | <td>The port number to which hosts will be connecting.<td> |
+ | </tr> | ||
+ | <tr> | ||
+ | <td>Internal zone</td> | ||
+ | <td>firewall zone name; default: '''lan'''</td> | ||
+ | <td>The zone to which the incoming connection will be redirected.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
Line 260: | Line 234: | ||
<tr> | <tr> | ||
<td>Internal port</td> | <td>Internal port</td> | ||
− | <td>integer [0..65535] | range of integers [0..65534] - [1.. | + | <td>integer [0..65535] | range of integers [0..65534] - [1..65535]; default: <b>none</b></td> |
<td>The port number to which the incoming connection will be redirected.</td> | <td>The port number to which the incoming connection will be redirected.</td> | ||
</tr> | </tr> | ||
</table> | </table> | ||
− | ===Port | + | ===Port forwards configuration=== |
---- | ---- | ||
− | While the New port forward section provides the possibility to add port forwarding rules fast, it does not contain all possible configuration options to customize a rule. In order to create a more complicated rule, add one using the New port forward section and click the | + | While the New port forward section provides the possibility to add port forwarding rules fast, it does not contain all possible configuration options to customize a rule. In order to create a more complicated rule, add one using the New port forward section and click the button that looks like a pencil [[File:Networking_rutx_trb14x_manual_edit_button_v1.png|20px]] next to it: |
− | [[File: | + | [[File:Networking_rutx_manual_firewall_port_forwards_edit_v1.png]] |
− | You will be redirected to that rule's configuration | + | You will be redirected to that rule's configuration page: |
− | [[File: | + | [[File:Networking_rutx_manual_firewall_port_forwards_configuration_v1.png]] |
<table class="nd-mantable"> | <table class="nd-mantable"> | ||
Line 293: | Line 267: | ||
<tr> | <tr> | ||
<td>Protocol</td> | <td>Protocol</td> | ||
− | <td>TCP | + | <td>TCP+UDP | TCP | UDP | Other; default: <b>TCP+UDP</b></td> |
<td>Specifies to which protocols the rule should apply.</td> | <td>Specifies to which protocols the rule should apply.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>Source zone</td> | <td>Source zone</td> | ||
− | <td>firewall zone name; default: | + | <td>firewall zone name; default: '''wan'''</td> |
<td>The zone to which the third party will be connecting. (Same thing as "External zone" in the New port forward section.)</td> | <td>The zone to which the third party will be connecting. (Same thing as "External zone" in the New port forward section.)</td> | ||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>Source MAC address</td> | <td>Source MAC address</td> | ||
<td>mac; default: <b>none</b></td> | <td>mac; default: <b>none</b></td> | ||
− | <td>MAC address of connecting hosts.<br>The rule will apply only to hosts that match MAC addresses specified in this field. Leave empty to make the rule skip MAC address matching.</td> | + | <td>MAC address(es) of connecting hosts.<br>The rule will apply only to hosts that match MAC addresses specified in this field. Leave empty to make the rule skip MAC address matching.</td> |
</tr> | </tr> | ||
<tr> | <tr> | ||
Line 345: | Line 287: | ||
<tr> | <tr> | ||
<td>Source port</td> | <td>Source port</td> | ||
− | <td>integer [0..65535] | range of integers [0..65534] - [1.. | + | <td>integer [0..65535] | range of integers [0..65534] - [1..65535]; default: <b>none</b></td> |
− | <td>Port number(s) used by the connecting host.<br>The rule will match the source port used by the connecting host with the port number(s) specified in this field. Leave empty to make the rule skip source port matching.< | + | <td>Port number(s) used by the connecting host.<br>The rule will match the source port used by the connecting host with the port number(s) specified in this field. Leave empty to make the rule skip source port matching.<td> |
</tr> | </tr> | ||
<tr> | <tr> | ||
Line 352: | Line 294: | ||
<td>ip | ip/netmask; default: <b>any</b></td> | <td>ip | ip/netmask; default: <b>any</b></td> | ||
<td>IP address or network segment to which hosts will be connecting.<br>The rule will apply only to hosts that connect to IP addresses specified in this field.<br>To specify a subnet instead of one IP, add a forward slash followed by the netmask length after the network indication (for example, <i>10.0.0.0/8</i>).</td> | <td>IP address or network segment to which hosts will be connecting.<br>The rule will apply only to hosts that connect to IP addresses specified in this field.<br>To specify a subnet instead of one IP, add a forward slash followed by the netmask length after the network indication (for example, <i>10.0.0.0/8</i>).</td> | ||
+ | </tr> | ||
+ | <tr> | ||
+ | <td>External port</td> | ||
+ | <td>integer [0..65535] | range of integers [0..65534] - [1..65535]; default: <b>none</b></td> | ||
+ | <td>Port number(s) to which hosts will be connecting.<br>The rule will apply only to hosts that connect to the port number(s) specified in this field. Leave empty to make the rule skip external port matching.<td> | ||
+ | </tr> | ||
+ | <tr> | ||
+ | <td>Internal zone</td> | ||
+ | <td>firewall zone name; default: '''lan'''</td> | ||
+ | <td>The zone to which the incoming connection will be redirected.</td> | ||
+ | </tr> | ||
+ | <tr> | ||
+ | <td>Internal IP address</td> | ||
+ | <td>ip; default: <b>none</b></td> | ||
+ | <td>The IP address to which the incoming connection will be redirected.</td> | ||
+ | </tr> | ||
+ | <tr> | ||
+ | <td>Internal port</td> | ||
+ | <td>integer [0..65535] | range of integers [0..65534] - [1..65535]; default: <b>none</b></td> | ||
+ | <td>The port number to which the incoming connection will be redirected.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
Line 365: | Line 327: | ||
</table> | </table> | ||
− | ==Traffic | + | ==Traffic rules== |
The <b>Traffic rules</b> tab is used to set firewall rules that filter traffic moving through the device. The figure below is an example of the Traffic rules table: | The <b>Traffic rules</b> tab is used to set firewall rules that filter traffic moving through the device. The figure below is an example of the Traffic rules table: | ||
− | [[File: | + | [[File:Networking_rutx_manual_firewall_traffic_rules_v1.png]] |
− | ===Traffic | + | ===Traffic rules configuration=== |
---- | ---- | ||
− | In order to begin editing a traffic rule, click the | + | In order to begin editing a traffic rule, click the button that looks like a pencil [[File:Networking_rutx_trb14x_manual_edit_button_v1.png|20px]] next to it: |
− | [[File: | + | [[File:Networking_rutx_manual_firewall_traffic_rules_edit_v1.png]] |
You will be redirected to that rule's configuration page: | You will be redirected to that rule's configuration page: | ||
− | + | [[File:Networking_rutx09_rutx11_manual_firewall_traffic_rules_configuration_v1.png]] | |
− | + | ||
− | [[File: | ||
<table class="nd-mantable"> | <table class="nd-mantable"> | ||
<tr> | <tr> | ||
Line 390: | Line 351: | ||
<tr> | <tr> | ||
<td>Enable</td> | <td>Enable</td> | ||
− | <td>off | on; | + | <td>off | on; Default <b>on</b></td> |
<td>Turns the rule on or off.</td> | <td>Turns the rule on or off.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>Name</td> | <td>Name</td> | ||
− | <td>string; | + | <td>string; Default <b>none</b></td> |
<td>Name of the rule. This is used for easier management purposes.</td> | <td>Name of the rule. This is used for easier management purposes.</td> | ||
+ | </tr> | ||
+ | <tr> | ||
+ | <td>Restrict to address family</td> | ||
+ | <td>IPv4 and IPv6 | IPv4 only | IPv6 only; Default: <b>IPv4 and IPv6</b></td> | ||
+ | <td>IP address family to which the rule will apply to.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>Protocol</td> | <td>Protocol</td> | ||
− | <td>TCP | + | <td>TCP+UDP | TCP | UDP | ICMP | -- custom --; Default: <b>TCP+UDP</b></td> |
<td>Specifies to which protocols the rule should apply.</td> | <td>Specifies to which protocols the rule should apply.</td> | ||
− | |||
− | |||
− | |||
− | |||
− | |||
</tr> | </tr> | ||
<tr> | <tr> | ||
Line 414: | Line 375: | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
− | <td>Source | + | <td>Source MAC address</td> |
+ | <td>mac; default: <b>none</b></td> | ||
+ | <td>MAC address(es) of connecting hosts.<br>The rule will apply only to hosts that match MAC addresses specified in this field. Leave empty to make the rule skip MAC address matching.</td> | ||
+ | </tr> | ||
+ | <tr> | ||
+ | <td>Source address</td> | ||
<td>ip | ip/netmask; default: <b>any</b></td> | <td>ip | ip/netmask; default: <b>any</b></td> | ||
<td>IP address or network segment used by connecting hosts.<br>The rule will apply only to hosts that connect from IP addresses specified in this field.<br>To specify a network segment instead of one IP address, add a forward slash followed by the netmask length after the network indication (for example, <i>10.0.0.0/8</i>).</td> | <td>IP address or network segment used by connecting hosts.<br>The rule will apply only to hosts that connect from IP addresses specified in this field.<br>To specify a network segment instead of one IP address, add a forward slash followed by the netmask length after the network indication (for example, <i>10.0.0.0/8</i>).</td> | ||
Line 420: | Line 386: | ||
<tr> | <tr> | ||
<td>Source port</td> | <td>Source port</td> | ||
− | <td>integer [0..65535] | range of integers [0..65534] - [1.. | + | <td>integer [0..65535] | range of integers [0..65534] - [1..65535]; default: <b>none</b></td> |
− | <td>Port number(s) used by the connecting host.<br>The rule will match the source port used by the connecting host with the port number(s) specified in this field. Leave empty to make the rule skip source port matching | + | <td>Port number(s) used by the connecting host.<br>The rule will match the source port used by the connecting host with the port number(s) specified in this field. Leave empty to make the rule skip source port matching.<td> |
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>Destination zone</td> | <td>Destination zone</td> | ||
− | <td>firewall zone; | + | <td>firewall zone; Default: <b>Device (input)</b></td> |
<td>Target zone of the incoming connection.</td> | <td>Target zone of the incoming connection.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>Destination address</td> | <td>Destination address</td> | ||
− | <td>ip | ip/netmask; | + | <td>ip | ip/netmask; Default: <b>any</b></td> |
<td>Tagert IP address or network segment of the incoming connection.</td> | <td>Tagert IP address or network segment of the incoming connection.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>Destination port</td> | <td>Destination port</td> | ||
− | <td>integer [0..65535] | range of integers [0..65534] - [1.. | + | <td>integer [0..65535] | range of integers [0..65534] - [1..65535]; Default: <b>none</b></td> |
− | <td>Tagert port or range of ports of the incoming connection | + | <td>Tagert port or range of ports of the incoming connection.</td> |
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>Action</td> | <td>Action</td> | ||
− | <td> | + | <td>DROP | ACCEPT | REJECT; Default: <b>ACCEPT</b></td> |
− | <td>Action that is to be taken when a packet | + | <td>Action that is to be taken when a packet meets the MATCH conditions. |
<ul> | <ul> | ||
− | <li><b> | + | <li><b>ACCEPT</b> – packet gets to continue to the next chain.</li> |
− | <li><b> | + | <li><b>DROP</b> – packet is stopped and deleted.</li> |
− | <li><b> | + | <li><b>REJECT</b> – packet is stopped, deleted and, differently from Drop, an ICMP packet containing a message of rejection is sent to the source from which the dropped packet came.</li> |
− | |||
− | |||
− | |||
</ul> | </ul> | ||
</td> | </td> | ||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>Extra arguments</td> | <td>Extra arguments</td> | ||
− | <td>string; | + | <td>string; Default: <b>none</b></td> |
<td>Adds extra .iptables options to the rule.</td> | <td>Adds extra .iptables options to the rule.</td> | ||
</tr> | </tr> | ||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
<tr> | <tr> | ||
<td>Week days</td> | <td>Week days</td> | ||
− | <td>days of the week [ | + | <td>days of the week [Sunday..Saturday]; Default: <b>none</b></td> |
<td>Specifies on which days of the week the rule is valid.</td> | <td>Specifies on which days of the week the rule is valid.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>Month days</td> | <td>Month days</td> | ||
− | <td>days of the month [1..31]; | + | <td>days of the month [1..31]; Default: <b>none</b></td> |
<td>Specifies on which days of the month the rule is valid.</td> | <td>Specifies on which days of the month the rule is valid.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>Start Time (hh:mm:ss)</td> | <td>Start Time (hh:mm:ss)</td> | ||
− | <td>time [0..23:0..59:0..59]; | + | <td>time [0..23:0..59:0..59]; Default: <b>none</b></td> |
<td>Indicates the beginning of the time period during which the rule is valid.</td> | <td>Indicates the beginning of the time period during which the rule is valid.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>Stop Time (hh:mm:ss)</td> | <td>Stop Time (hh:mm:ss)</td> | ||
− | <td>time [0..23:0..59:0..59]; | + | <td>time [0..23:0..59:0..59]; Default: <b>none</b></td> |
<td>Indicates the end of the time period during which the rule is valid.</td> | <td>Indicates the end of the time period during which the rule is valid.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>Start Date (yyyy-mm-dd)</td> | <td>Start Date (yyyy-mm-dd)</td> | ||
− | <td>date [0000..9999:1..12:1..31]; | + | <td>date [0000..9999:1..12:1..31]; Default: <b>none</b></td> |
<td>Indicates the first day of the date of the period during which the rule is valid.</td> | <td>Indicates the first day of the date of the period during which the rule is valid.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>Stop Date (yyyy-mm-dd)</td> | <td>Stop Date (yyyy-mm-dd)</td> | ||
− | <td>date [0000..9999:1..12:1..31]; | + | <td>date [0000..9999:1..12:1..31]; Default: <b>none</b></td> |
<td>Indicates the last day of the date of the period during which the rule is valid.</td> | <td>Indicates the last day of the date of the period during which the rule is valid.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>Time in UTC</td> | <td>Time in UTC</td> | ||
− | <td> | + | <td>yes | no; Default: <b>no</b></td> |
− | <td>Specifies whether the device should use UTC time. If this is disabled, the time zone specified in the | + | <td>Specifies whether the device should use UTC time. If this is disabled, the time zone specified in the <b>[[{{{name}}}<nowiki> NTP|NTP]]</nowiki></b> section will be used.</td> |
</tr> | </tr> | ||
</table> | </table> | ||
− | ===Open | + | |
+ | ===Open ports on device=== | ||
---- | ---- | ||
− | + | The <b>Open ports on device</b> section provides a quick way to set simple rules that allow traffic on specified ports of the device. The figure below is an example of the Open ports on device section and the table below provides information on the fields contained in that section: | |
− | [[File: | + | [[File:{{{file_open_ports_on_device}}}]] |
<table class="nd-mantable"> | <table class="nd-mantable"> | ||
Line 555: | Line 472: | ||
<tr> | <tr> | ||
<td>Name</td> | <td>Name</td> | ||
− | <td>string; | + | <td>string; Default: <b>none</b></td> |
<td>The name of the rule. This is used for easier management purposes.<br>The name field is filled automatically when port numbers are specified, unless the name was specified beforehand by the user.</td> | <td>The name of the rule. This is used for easier management purposes.<br>The name field is filled automatically when port numbers are specified, unless the name was specified beforehand by the user.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>Protocol</td> | <td>Protocol</td> | ||
− | <td>TCP | + | <td>TCP+UDP | TCP | UDP | Other; Default: <b>TCP+UDP</b></td> |
<td>Specifies to which protocols the rule should apply.</td> | <td>Specifies to which protocols the rule should apply.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>External port</td> | <td>External port</td> | ||
− | <td>integer [0..65535] | range of integers [0..65534] - [1.. | + | <td>integer [0..65535] | range of integers [0..65534] - [1..65535]; Default: <b>none</b></td> |
<td>Specifies which port(s) should be opened.</td> | <td>Specifies which port(s) should be opened.</td> | ||
</tr> | </tr> | ||
</table> | </table> | ||
− | === | + | ===New forward rule=== |
---- | ---- | ||
− | + | The <b>New forward rule</b> section is used to create firewall rules that control traffic on the FORWARD chain. The figure below is an example of the New forward rule section and the table below provides information on the fields contained in that section: | |
− | [[File: | + | [[File:Networking_rutx_manual_firewall_traffic_rules_new_forward_rule_v1.png]] |
<table class="nd-mantable"> | <table class="nd-mantable"> | ||
Line 584: | Line 501: | ||
<tr> | <tr> | ||
<td>Name</td> | <td>Name</td> | ||
− | <td>string; | + | <td>string; Default: <b>none</b></td> |
<td>The name of the rule. This is used for easier management purposes.</td> | <td>The name of the rule. This is used for easier management purposes.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>Source zone</td> | <td>Source zone</td> | ||
− | <td>firewall zone; | + | <td>firewall zone; Default: <b>WAN</b></td> |
<td>The zone from which traffic has originated.</td> | <td>The zone from which traffic has originated.</td> | ||
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>Destination zone</td> | <td>Destination zone</td> | ||
− | <td>firewall zone; | + | <td>firewall zone; Default: <b>LAN</b></td> |
<td>The zone to which traffic will be forwarded to.</td> | <td>The zone to which traffic will be forwarded to.</td> | ||
</tr> | </tr> | ||
Line 603: | Line 520: | ||
</tr> | </tr> | ||
</table> | </table> | ||
− | |||
− | |||
− | |||
− | |||
===Source NAT=== | ===Source NAT=== | ||
---- | ---- | ||
− | <b>Source NAT</b> | + | <b>Source NAT</b> is a specific form of masquerading which allows fine grained control over the source IP used for outgoing traffic. For example, to map multiple WAN addresses to internal subnets. |
− | |||
− | |||
− | + | ====New source NAT==== | |
− | |||
− | === | ||
---- | ---- | ||
− | The <b> | + | The <b>New Source NAT</b> section is used to add custom source NAT rules. The figure below is an example of the New source NAT section and the table below provides information on the fields contained in that section: |
− | [[File: | + | [[File:Networking_rutx_manual_firewall_traffic_rules_source_nat_new_source_nat_v1.png| border | class=tlt-border| 1102x1102px]] |
<table class="nd-mantable"> | <table class="nd-mantable"> | ||
Line 630: | Line 539: | ||
<tr> | <tr> | ||
<td>Name</td> | <td>Name</td> | ||
− | <td>string; | + | <td>string; Default: <b>none</b></td> |
− | <td>The name of the rule. | + | <td>The name of the rule. This is used for easier management purposes.</td> |
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>Source zone</td> | <td>Source zone</td> | ||
− | <td>firewall zone; | + | <td>firewall zone; Default: <b>LAN</b></td> |
− | <td> | + | <td>The zone from which traffic has originated.</td> |
</tr> | </tr> | ||
<tr> | <tr> | ||
− | <td>Destination | + | <td>Destination zone</td> |
− | <td>firewall zone; | + | <td>firewall zone; Default: <b>WAN</b></td> |
− | <td> | + | <td>The zone to which traffic will be forwarded to.</td> |
</tr> | </tr> | ||
<tr> | <tr> | ||
<td>To source IP</td> | <td>To source IP</td> | ||
− | <td>ip | do not rewrite; | + | <td>ip | do not rewrite; Default: <b>Do not rewrite</b></td> |
− | <td>Changes the source IP | + | <td>Changes the source IP in the packet header to the value specified in this field.</td> |
</tr> | </tr> | ||
<tr> | <tr> | ||
− | <td>To | + | <td>To source port</td> |
− | <td>integer [0..65335 | + | <td>integer [0..65335] | do not rewrite; Default: <b>Do not rewrite</b></td> |
<td>Changes the source port in the packet header to the value specified in this field.</td> | <td>Changes the source port in the packet header to the value specified in this field.</td> | ||
</tr> | </tr> | ||
Line 656: | Line 565: | ||
<td>Add</td> | <td>Add</td> | ||
<td>- (interactive button)</td> | <td>- (interactive button)</td> | ||
− | <td>Creates the rule | + | <td>Creates the rule and redirects you to the rule's configuration page.</td> |
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
</tr> | </tr> | ||
</table> | </table> | ||
− | + | ==Custom rules== | |
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | ==Custom | ||
The <b>Custom rules</b> tab provides you with the possibility to execute <b>iptables</b> commands which are not otherwise covered by the device's firewall framework. The commands are executed after each firewall restart, right after the default rule set has been loaded. | The <b>Custom rules</b> tab provides you with the possibility to execute <b>iptables</b> commands which are not otherwise covered by the device's firewall framework. The commands are executed after each firewall restart, right after the default rule set has been loaded. | ||
− | |||
− | |||
The figure below is an example of the Custom rules tab: | The figure below is an example of the Custom rules tab: | ||
− | [[File: | + | [[File:Networking_rutx_manual_firewall_custom_rules_v1.png]] |
The rules added here are saved in the <b>/etc/firewall.user</b> file. Feel free to edit that file instead for the same effect in case you don't have access to the device's WebUI. | The rules added here are saved in the <b>/etc/firewall.user</b> file. Feel free to edit that file instead for the same effect in case you don't have access to the device's WebUI. | ||
Line 1,040: | Line 583: | ||
The <b>Reset</b> button resets the custom rules field to its default state. | The <b>Reset</b> button resets the custom rules field to its default state. | ||
− | == | + | ==NAT helpers== |
+ | |||
+ | The <b>NAT Helpers</b> section provides you with the possibility to add firewall exceptions for some VoIP protocols, namely SIP and H.323. In other words, these functions provide a pass-through for VoIP communications between the device's LAN and WAN. | ||
− | + | <b>Technical explanation:</b> | |
− | [[File: | + | FTP, SIP and H.323 protocols are harder to filter by firewalls since they violate layering by introducing OSI layer 3/4 parameters in the OSI layer 7. NAT helpers are modules that are able to assist the firewall in tracking these protocols. These helpers create the so-called expectations that can be used to open necessary ports for RELATED connections. For example, FTP, GRE and PPTP helpers are enabled by default. |
+ | |||
+ | [[File:Networking_rutx_manual_firewall_nat_helpers_v1.png]] | ||
<table class="nd-mantable"> | <table class="nd-mantable"> | ||
<tr> | <tr> | ||
<th>Field</th> | <th>Field</th> | ||
− | + | <th>Value</th> | |
− | + | <th>Description</th> | |
</tr> | </tr> | ||
<tr> | <tr> | ||
− | + | <td>H323</td> | |
− | + | <td>off | on; Default: <b>off</b></td> | |
− | + | <td>Turns H323 filtering on or off.</td> | |
</tr> | </tr> | ||
<tr> | <tr> | ||
− | + | <td>SIP</td> | |
− | + | <td>off | on; Default: <b>off</b></td> | |
− | + | <td>Turns SIP filtering on or off.</td> | |
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
</tr> | </tr> | ||
</table> | </table> | ||
− | + | overview | |
[[Category:{{{name}}} Network section]] | [[Category:{{{name}}} Network section]] |
Revision as of 09:39, 12 May 2020
Template:Networking rutos manual fw disclosure
Summary
{{{name}}} devices use a standard Linux iptables package as its firewall, which uses routing chains and policies to facilitate control over inbound and outbound traffic. This chapter is an overview of the Firewall section for {{{name}}} devices.
If you're having trouble finding this page or some of the parameters described here on your device's WebUI, you should turn on "Advanced WebUI" mode. You can do that by clicking the "Advanced" button, located at the top of the WebUI.
General settings
The General Settings section is used to configure the main policies of the device's firewall. The figure below is an example of the General Settings section and the table below provides information on the fields contained in that section:
File:Networking rutx manual firewall general settings general settings v1.png
Field | Value | Description |
---|---|---|
Enable SYN flood protection | off | on; Default: on | Enables protection from SYN flood type attacks. A SYN flood is a type of denial-of-service (DOS) attack where an attacker sends bursts of SYN requests in an attempt to make the target host machine consume enough resources and become unresponsive. |
Drop invalid packets | off | on; Default: off | If enabled, a "Drop" action will be performed on packets that are determined to be invalid. |
Input | Reject | Drop | Accept; Default: Accept | Default action* of the INPUT chain if a packet does not match any existing rule on that chain. |
Output | Reject | Drop | Accept; Default: Accept | Default action* of the OUTPUT chain if a packet does not match any existing rule on that chain. |
Forward | Reject | Drop | Accept; Default: Reject | Default action* of the FORWARD chain if a packet does not match any existing rule on that chain. |
* When a packet goes through a firewall chain it is matched against all the rules of that specific chain. If no rule matches said packet, an according Action (Drop, Reject or Accept) is performed:
- Accept – packet gets to continue to the next chain.
- Drop – packet is stopped and deleted.
- Reject – packet is stopped, deleted and, differently from Drop, a message of rejection is sent to the source from which the packet came.
Zones
The Zones section is used to manage default traffic forwarding policies between different device zones. The figure below is an example of the Zones section and the table below provides information on the fields contained in that section:
[[File::Networking_rutx_manual_firewall_general_settings_zones_v1.png]]
You can change a zone's settings from this page by interacting with entries in the zones table. For a more in-depth configuration click the button that looks like a pencil next to a zone:
File:Networking rutx manual firewall general settings zones edit v1.png
Zones: general settings
File:Networking rutx manual firewall general settings zones general settings v1.png
Field | Value | Description |
---|---|---|
Name | string; default: newzone | A custom name for the zone. Used for easier management purposes. |
Input | Reject | Drop | Accept; Default: Accept | Default policy for traffic entering the zone. |
Output | Reject | Drop | Accept; Default: Accept | Default policy for traffic originating from and leaving the zone. |
Forward | Reject | Drop | Accept; Default: Reject | Default policy for traffic forwarded between the networks belonging to the zone. |
Masquerading | off | on; default: off | Turns Masquerading off or on. MASQUERADE is an iptables target that can be used instead of the SNAT (source NAT) target when the external IP of the network interface is not known at the moment of writing the rule (when the interface gets the external IP dynamically). |
MSS clamping | off | on; default: off | Turns MSS clamping off or on. MSS clamping is a workaround used to change the maximum segment size (MSS) of all TCP connections passing through links with an MTU lower than the Ethernet default of 1500. |
Covered networks | name of interface; default: none | Network or networks that belong to the zone. |
Zones: advanced settings
File:Networking rutx manual firewall general settings zones advanced settings v1.png
Field | Value | Description |
---|---|---|
Restrict to address family | IPv4 and IPv6 | IPv4 only | IPv6 only; default: IPv4 and IPv6 | IP address family to which to rule will apply. |
Restrict Masquerading to given source subnets | network/subnet; default: none | Applies Masquerading only to the specified source network/subnet. |
Restrict Masquerading to given destinations subnets | network/subnet; default: none | Applies Masquerading only to the specified destination network/subnet. |
Force connection tracking | off | on; default: off | Always maintains connection state (NEW, ESTABLISHED, RELATED) information. |
Enable logging on this zone | off | on; default: off | Logs packets that hit this rule. |
Limit log messages | integer/minute; default: none | Limit how many messages can be logged in the span of 1 minute. For example, to log 50 packets per minute use: 50/minute. |
Zones: inter-zone forwarding
The Inter-zone forwarding options control the forwarding policies between the currently edited zone and other zones.
File:Networking rutx09 rutx11 manual firewall general settings zones inter-zone forwarding v1.png
Field | Value | Description |
---|---|---|
Allow forward to destination zones | zone(s); default: none | Allows forward traffic to specified destination zones. Destination zones cover forwarded traffic originating from this source zone. |
Allow forward from source zones | zone(s); default: none | Allows forward traffic to specified source zones. Source zones match forwarded traffic originating from other zones that is targeted at this zone. |
Port forwards
Port forwarding is a way of redirecting an incoming connection to another IP address, port or the combination of both:
File:File:Networking rutx manual firewall port forwards scheme v1.png
The Port forwards table displays configured port forwarding rules currently configured on the device.
File:Networking rutx manual firewall port forwards port forwards v1.png
New port forward
The New port forward section is used to quickly add additional port forwarding rules. The figure below is an example of the New port forward section and the table below provides information on the fields contained in that section:
File:Networking rutx manual firewall port forwards new port forward v1.png
Field | Value | Description | |
---|---|---|---|
Name | string; default: none | Name of the rule. This is used for easier management purposes. | |
Protocol | TCP+UDP | TCP | UDP | Other; default: TCP+UDP | Specifies to which protocols the rule should apply. | |
External zone | firewall zone name; default: wan | The zone to which hosts will be connecting. | |
External port | integer [0..65535] | range of integers [0..65534] - [1..65535]; default: none | The port number to which hosts will be connecting. | |
Internal zone | firewall zone name; default: lan | The zone to which the incoming connection will be redirected. | |
Internal IP address | ip; default: none | The IP address to which the incoming connection will be redirected. | |
Internal port | integer [0..65535] | range of integers [0..65534] - [1..65535]; default: none | The port number to which the incoming connection will be redirected. |
Port forwards configuration
While the New port forward section provides the possibility to add port forwarding rules fast, it does not contain all possible configuration options to customize a rule. In order to create a more complicated rule, add one using the New port forward section and click the button that looks like a pencil next to it:
File:Networking rutx manual firewall port forwards edit v1.png
You will be redirected to that rule's configuration page:
File:Networking rutx manual firewall port forwards configuration v1.png
Field | Value | Description | |
---|---|---|---|
Enable | off | on ; default: on | Turns the rule on or off | |
Name | string; default: none | Name of the rule. This is used for easier management purposes. | |
Protocol | TCP+UDP | TCP | UDP | Other; default: TCP+UDP | Specifies to which protocols the rule should apply. | |
Source zone | firewall zone name; default: wan | The zone to which the third party will be connecting. (Same thing as "External zone" in the New port forward section.) | |
Source MAC address | mac; default: none | MAC address(es) of connecting hosts. The rule will apply only to hosts that match MAC addresses specified in this field. Leave empty to make the rule skip MAC address matching. |
|
Source IP address | ip | ip/netmask; default: any | IP address or network segment used by connecting hosts. The rule will apply only to hosts that connect from IP addresses specified in this field. To specify a network segment instead of one IP address, add a forward slash followed by the netmask length after the network indication (for example, 10.0.0.0/8). |
|
Source port | integer [0..65535] | range of integers [0..65534] - [1..65535]; default: none | Port number(s) used by the connecting host. The rule will match the source port used by the connecting host with the port number(s) specified in this field. Leave empty to make the rule skip source port matching. | |
External IP address | ip | ip/netmask; default: any | IP address or network segment to which hosts will be connecting. The rule will apply only to hosts that connect to IP addresses specified in this field. To specify a subnet instead of one IP, add a forward slash followed by the netmask length after the network indication (for example, 10.0.0.0/8). |
|
External port | integer [0..65535] | range of integers [0..65534] - [1..65535]; default: none | Port number(s) to which hosts will be connecting. The rule will apply only to hosts that connect to the port number(s) specified in this field. Leave empty to make the rule skip external port matching. | |
Internal zone | firewall zone name; default: lan | The zone to which the incoming connection will be redirected. | |
Internal IP address | ip; default: none | The IP address to which the incoming connection will be redirected. | |
Internal port | integer [0..65535] | range of integers [0..65534] - [1..65535]; default: none | The port number to which the incoming connection will be redirected. | |
Enable NAT loopback | off | on ; default: on | NAT loopback a.k.a. NAT reflection a.k.a. NAT hairpinning is a method of accessing an internal server using a public IP. NAT loopback enables your local network (i.e., behind your NAT device) to connect to a forward-facing IP address of a machine that it also on your local network. | |
Extra arguments | string; default: none | Adds extra iptables options to the rule. |
Traffic rules
The Traffic rules tab is used to set firewall rules that filter traffic moving through the device. The figure below is an example of the Traffic rules table:
File:Networking rutx manual firewall traffic rules v1.png
Traffic rules configuration
In order to begin editing a traffic rule, click the button that looks like a pencil next to it:
File:Networking rutx manual firewall traffic rules edit v1.png
You will be redirected to that rule's configuration page:
File:Networking rutx09 rutx11 manual firewall traffic rules configuration v1.png
Field | Value | Description | |
---|---|---|---|
Enable | off | on; Default on | Turns the rule on or off. | |
Name | string; Default none | Name of the rule. This is used for easier management purposes. | |
Restrict to address family | IPv4 and IPv6 | IPv4 only | IPv6 only; Default: IPv4 and IPv6 | IP address family to which the rule will apply to. | |
Protocol | TCP+UDP | TCP | UDP | ICMP | -- custom --; Default: TCP+UDP | Specifies to which protocols the rule should apply. | |
Source zone | firewall zone name; default: wan | The zone to which the third party will be connecting. | |
Source MAC address | mac; default: none | MAC address(es) of connecting hosts. The rule will apply only to hosts that match MAC addresses specified in this field. Leave empty to make the rule skip MAC address matching. |
|
Source address | ip | ip/netmask; default: any | IP address or network segment used by connecting hosts. The rule will apply only to hosts that connect from IP addresses specified in this field. To specify a network segment instead of one IP address, add a forward slash followed by the netmask length after the network indication (for example, 10.0.0.0/8). |
|
Source port | integer [0..65535] | range of integers [0..65534] - [1..65535]; default: none | Port number(s) used by the connecting host. The rule will match the source port used by the connecting host with the port number(s) specified in this field. Leave empty to make the rule skip source port matching. | |
Destination zone | firewall zone; Default: Device (input) | Target zone of the incoming connection. | |
Destination address | ip | ip/netmask; Default: any | Tagert IP address or network segment of the incoming connection. | |
Destination port | integer [0..65535] | range of integers [0..65534] - [1..65535]; Default: none | Tagert port or range of ports of the incoming connection. | |
Action | DROP | ACCEPT | REJECT; Default: ACCEPT | Action that is to be taken when a packet meets the MATCH conditions.
|
|
Extra arguments | string; Default: none | Adds extra .iptables options to the rule. | |
Week days | days of the week [Sunday..Saturday]; Default: none | Specifies on which days of the week the rule is valid. | |
Month days | days of the month [1..31]; Default: none | Specifies on which days of the month the rule is valid. | |
Start Time (hh:mm:ss) | time [0..23:0..59:0..59]; Default: none | Indicates the beginning of the time period during which the rule is valid. | |
Stop Time (hh:mm:ss) | time [0..23:0..59:0..59]; Default: none | Indicates the end of the time period during which the rule is valid. | |
Start Date (yyyy-mm-dd) | date [0000..9999:1..12:1..31]; Default: none | Indicates the first day of the date of the period during which the rule is valid. | |
Stop Date (yyyy-mm-dd) | date [0000..9999:1..12:1..31]; Default: none | Indicates the last day of the date of the period during which the rule is valid. | |
Time in UTC | yes | no; Default: no | Specifies whether the device should use UTC time. If this is disabled, the time zone specified in the [[{{{name}}} NTP|NTP]] section will be used. |
Open ports on device
The Open ports on device section provides a quick way to set simple rules that allow traffic on specified ports of the device. The figure below is an example of the Open ports on device section and the table below provides information on the fields contained in that section:
[[File:{{{file_open_ports_on_device}}}]]
Field | Value | Description |
---|---|---|
Name | string; Default: none | The name of the rule. This is used for easier management purposes. The name field is filled automatically when port numbers are specified, unless the name was specified beforehand by the user. |
Protocol | TCP+UDP | TCP | UDP | Other; Default: TCP+UDP | Specifies to which protocols the rule should apply. |
External port | integer [0..65535] | range of integers [0..65534] - [1..65535]; Default: none | Specifies which port(s) should be opened. |
New forward rule
The New forward rule section is used to create firewall rules that control traffic on the FORWARD chain. The figure below is an example of the New forward rule section and the table below provides information on the fields contained in that section:
Field | Value | Description |
---|---|---|
Name | string; Default: none | The name of the rule. This is used for easier management purposes. |
Source zone | firewall zone; Default: WAN | The zone from which traffic has originated. |
Destination zone | firewall zone; Default: LAN | The zone to which traffic will be forwarded to. |
Add | - (interactive button) | Creates the rule and redirects you to the rule's configuration page |
Source NAT
Source NAT is a specific form of masquerading which allows fine grained control over the source IP used for outgoing traffic. For example, to map multiple WAN addresses to internal subnets.
New source NAT
The New Source NAT section is used to add custom source NAT rules. The figure below is an example of the New source NAT section and the table below provides information on the fields contained in that section:
Field | Value | Description |
---|---|---|
Name | string; Default: none | The name of the rule. This is used for easier management purposes. |
Source zone | firewall zone; Default: LAN | The zone from which traffic has originated. |
Destination zone | firewall zone; Default: WAN | The zone to which traffic will be forwarded to. |
To source IP | ip | do not rewrite; Default: Do not rewrite | Changes the source IP in the packet header to the value specified in this field. |
To source port | integer [0..65335] | do not rewrite; Default: Do not rewrite | Changes the source port in the packet header to the value specified in this field. |
Add | - (interactive button) | Creates the rule and redirects you to the rule's configuration page. |
Custom rules
The Custom rules tab provides you with the possibility to execute iptables commands which are not otherwise covered by the device's firewall framework. The commands are executed after each firewall restart, right after the default rule set has been loaded.
The figure below is an example of the Custom rules tab:
File:Networking rutx manual firewall custom rules v1.png
The rules added here are saved in the /etc/firewall.user file. Feel free to edit that file instead for the same effect in case you don't have access to the device's WebUI.
The Save button restarts the firewall service. Thus, adding the custom rules specified in this section to the device's list of firewall rules.
The Reset button resets the custom rules field to its default state.
NAT helpers
The NAT Helpers section provides you with the possibility to add firewall exceptions for some VoIP protocols, namely SIP and H.323. In other words, these functions provide a pass-through for VoIP communications between the device's LAN and WAN.
Technical explanation:
FTP, SIP and H.323 protocols are harder to filter by firewalls since they violate layering by introducing OSI layer 3/4 parameters in the OSI layer 7. NAT helpers are modules that are able to assist the firewall in tracking these protocols. These helpers create the so-called expectations that can be used to open necessary ports for RELATED connections. For example, FTP, GRE and PPTP helpers are enabled by default.
File:Networking rutx manual firewall nat helpers v1.png
Field | Value | Description |
---|---|---|
H323 | off | on; Default: off | Turns H323 filtering on or off. |
SIP | off | on; Default: off | Turns SIP filtering on or off. |
overview [[Category:{{{name}}} Network section]]