Teltonika Networks Wiki

Changes

RUTX12 Traffic control with Firewall WANzone Splitting (view source)

Revision as of 12:09, 15 September 2023

2,068 bytes added ,  12:09, 15 September 2023
no edit summary
Line 2: Line 2:  
==Introduction==
 
==Introduction==
 
This article contains instructions on how to configure mobile SIM traffic effectively, The configuration ensures that when SIM1 is active, it provides internet connectivity to all end devices. However, when SIM2 is being used, the configuration should impose restrictions on the traffic flow from PC2 and only traffic from.
 
This article contains instructions on how to configure mobile SIM traffic effectively, The configuration ensures that when SIM1 is active, it provides internet connectivity to all end devices. However, when SIM2 is being used, the configuration should impose restrictions on the traffic flow from PC2 and only traffic from.
−
[[File:Image Traffic Control..png|center|700x700px|Image Traffic Control|alt=]]
+
[[File:Topology..png|border|center|class=tlt-border]]
 
==Prerequisites==
 
==Prerequisites==
 
For this configuration you will need:
 
For this configuration you will need:
Line 21: Line 21:  
}}
 
}}
 
=== Firewall General Settings ===
 
=== Firewall General Settings ===
−
The '''General Settings''' section is utilized for configuring the core policies of the device's firewall. The visual representation depicted below presents an illustrative model of the General Settings section. The ensuing table provides comprehensive information about the fields that are intended to be configured within this section.  To access this configuration, proceed to: '''Network –> Firewall -> General Setting''' While maintaining the default settings for other options, click on the Edit symbol corresponding to the zones.   
+
The '''General Settings''' section is utilized for configuring the core policies of the device's firewall. To access this configuration, proceed to: '''Network –> Firewall -> General Setting''' While maintaining the default settings for other options, click on the Edit symbol corresponding to the zones.<br>
 +
The '''Zones''' section is employed to oversee the default traffic forwarding policies among distinct zones within the device.  Both "'''mob1s1a1'''" and "'''mob2s1a1'''" by default are situated within the same Firewall zone, signifying that identical rules are applied to both mobile interfaces/SIM cards. Consequently, any traffic restriction in this zone will simultaneously influence both SIM cards. As a result, it becomes necessary to create two distinct zones for each SIM individually.
   −
[[File:Zoon setting.png]]
+
==== Editing existing firewall zone ====
    +
# Go to '''Network→ Firewall→ General→ Zones'''
 +
# Locate the WAN zone and click on the '''edit button''' (pencil sign)
    +
[[File:Firewall_wan_zone_split_1.png|border|center|class=tlt-border]]
    +
# Remove the '''mob1s2a1''' interface from the Default Firewall zone configuration
 +
# Save the settings by clicking '''Save & Apply''' button at the bottom right hand side
   −
The '''Zones''' section is employed to oversee the default traffic forwarding policies among distinct zones within the device.  Both "'''mob1s1a1'''" and "'''mob2s1a1'''" will be situated within the same Firewall zone, signifying that identical rules are pertinent to both SIM cards. Consequently, any traffic rule established will simultaneously influence on both SIM cards. As a result, it becomes necessary to generate two distinct zones for each SIM individually.
+
[[File:Firewall_wan_zone_split_2.png|border|center|class=tlt-border]]
 +
==== Create a new Zone: ====
 +
----To create a new zone, simply click on the "Add" button located in the bottom right corner.
   −
[[File:Zone WAN Setting.png]]
+
[[File:Firewall_wan_zone_split_3.png|border|center|class=tlt-border]]
 +
By clicking on '''Add''' button as shown:
 +
# Choose a '''Name''' for this rule as per your preference.
 +
# Set the input to be in the "'''Reject'''" zone.
 +
# Designate the output to be in the "'''Accept'''" zone.
 +
# Configure the forward action to be directed to the "'''Reject'''" zone.
 +
# Activate both '''Masquerading''' and '''MSS clamping''' options.
 +
# In the "'''Covered'''" zone, select the SIM Interface individually. In the provided example, it will be "SIM2" identified as "mob1s2a1".
 +
# In the inter-zone section keep Allow forward from source zones as "'''lan'''"
 +
# Click on '''"Save & Apply"''' in the bottom right corner.
 +
[[File:Firewall_wan_zone_split_4.png|border|center|class=tlt-border]]
 +
<br />Once you have created the new zone, it should resemble the following:
 +
[[File:NewZone.png|border|center|class=tlt-border]]
   −
=== Create a new Zone: ===
+
=== Traffic rule creation ===
−
[[File:New Zones Creation.png]]<br />
+
----
−
 
  −
By clicking on '''Add''' button as shown:
  −
 
  −
* Choose a '''Name''' for this rule as per your preference.
  −
* Set the input to be in the "'''Reject'''" zone. 
  −
* Configure the forward action to be directed to the "'''Reject'''" zone. 
  −
* Designate the output to be in the "'''Accept'''" zone. 
  −
* Activate both '''Masquerading''' and '''MSS clamping''' options. 
  −
* In the "'''Covered'''" zone, select the SIM Interface individually. In the provided example, it will be "SIM2" identified as "mob2s1a1".
  −
 
  −
[[File:New Zone.png|700x700px]]
  −
 
  −
=== Establish the traffic rule ===
   
To establish the traffic rule according to the zones you've set up, follow these steps  '''Navigate to Network –> Firewall -> Traffic Rule''' to begin creating the rule.  Create and set up the rule to enable the host's access to the web server.   
 
To establish the traffic rule according to the zones you've set up, follow these steps  '''Navigate to Network –> Firewall -> Traffic Rule''' to begin creating the rule.  Create and set up the rule to enable the host's access to the web server.   
   −
* In the '''<nowiki/>'Add type'''' field, select 'Add new forward rule'.
+
* In the '''<nowiki/>'''Add type field, select '''<nowiki/>'Add new forward rule''''.
−
* Assign a '''Name''' of your choosing to this rule.
+
* Assign a Name of your choosing to this rule.
 
* Choose "'''LAN'''" as the source zone.   
 
* Choose "'''LAN'''" as the source zone.   
−
* Select "'''WAN'''" as the destination zone.
+
* Select "'''WAN2'''" as the destination zone.
−
* Click the 'Add' button to confirm and add the rule.
+
* Click the ''''Add'''<nowiki/>' button to confirm and add the rule.
−
 
+
[[File:Add new Instance.png|border|center|class=tlt-border]]
−
[[File:Add New Instances.png]]
      
=== Specify the source zone ===
 
=== Specify the source zone ===
 
Upon clicking '''<nowiki/>'Add'''' in the previous step, a new window will appear, enabling you to define additional configurations.   
 
Upon clicking '''<nowiki/>'Add'''' in the previous step, a new window will appear, enabling you to define additional configurations.   
   −
* Specify the source zone for which the SIM Interface is intended. In the provided instance, this would be '''SIM2''' labelled as "'''mob2s1a1'''".
+
* Source zone change to "'''WAN2:mob1s2a1"'''
 +
* Specify the source zone for which the SIM Interface is intended. In the provided instance, this would be '''SIM2''' labelled as "'''mob1s2a1'''".
 
* Choose the '''MAC address''' associated with the host to which the rule is to be applied in the source MAC address section. If needed, you can input a custom MAC address.   
 
* Choose the '''MAC address''' associated with the host to which the rule is to be applied in the source MAC address section. If needed, you can input a custom MAC address.   
 
* Input the '''IP address''' of the host in the source IP address field.   
 
* Input the '''IP address''' of the host in the source IP address field.   
−
* Within the action field, opt for '''<nowiki/>'Accept''''.  
+
* Within the action field, opt for '''<nowiki/>'Reject''''.
 
* Click on '''<nowiki/>'Save and Apply''''.
 
* Click on '''<nowiki/>'Save and Apply''''.
−
[[File:Traffic Rules accept.png]]
+
[[File:FirewallTraffic Rule.png|border|center|class=tlt-border]]
 +
 
 +
== Testing the configuration ==
 +
If you have followed all the provided steps to test the firewall traffic rules and verify the configuration, here is the revised description:
 +
 
 +
# Initially, ensure that your router's WAN is connected to SIM1.
 +
# From PC1, access the web UI and navigate to "Service" -> "CLI."
 +
# Log in using the username "root" and the router's admin password.
 +
# In the CLI, ping the IP address 8.8.8.8. If you receive a response, it confirms that internet connectivity is established through SIM1 mobile connectivity on PC1.
 +
# Perform the same procedure on PC2 by logging into the CLI and pinging the IP address 8.8.8.8. If you receive a response, it also confirms that internet connectivity is established via SIM1 on PC2.
 +
 
 +
Next, switch the router's WAN connection to SIM2 and conduct the following tests:
 +
 
 +
# Ping 8.8.8.8 from PC1. After logging into the CLI and pinging the IP address 8.8.8.8 If you receive a response, it indicates that SIM2 has internet connectivity.
 +
# Ping 8.8.8.8 from PC2. when pinging the IP address 8.8.8.8 from PC2 and If you experience 100% packet loss, it means that PC2 does not have internet connectivity via SIM2.
   −
Yo'''<nowiki/>'''u can specify additional settings as you wish. For example, you can set times when this rule should apply. This way, the host will be able to access the web server only at certain times.
+
These tests serve to validate the functionality of the firewall rules and the connectivity of the router's WAN connections.
 +
[[File:Testing Traffic rules.png|border|center|class=tlt-border]]
 +
You can specify additional settings as you wish. For example, you can set times when this rule should apply. This way, the host will be able to access the web server only at certain times.
Retrieved from "https://wiki.teltonika-networks.com/view/Special:MobileDiff/111431...111716"