Changes

5,845 bytes added , 5 January

no edit summary

Line 1: Line 1: −

{{Template:~~Networking_rutos_manual_fw_disclosure~~

+

{{Template: Networking_device_manual_fw_disclosure

−

| ~~fw_version~~ = {{{series}}}~~_R_00.02.05.1~~

+

| series = {{{series}}}

−

| series = {{{series}}}

+

| name = {{{name}}}

+

| fw_version ={{Template: Networking_device_manual_latest_fw

+

| series = {{{series}}}

+

| name = {{{name}}}

+

}}

+

{{#ifeq: {{{series}}} | RUT9 | Note: [[{{{name}}} Firewall (legacy WebUI)|click here]] for the old style WebUI (FW version {{Template: Networking_device_manual_latest_fw | series = RUT9XX}} and earlier) user manual page.|}}

+

{{#ifeq: {{{series}}} | RUT2 | Note: [[{{{name}}} Firewall (legacy WebUI)|click here]] for the old style WebUI (FW version {{Template: Networking_device_manual_latest_fw | series = RUT2XX}} and earlier) user manual page.|}}

==Summary==

{{{name}}} devices use a standard Linux iptables package as its firewall, which uses routing chains and policies to facilitate control over inbound and outbound traffic.

−

This chapter of the user manual is an overview of the Firewall ~~section~~ for {{{name}}} devices.

+

This chapter of the user manual provides an overview of the Firewall page for {{{name}}} devices.

{{Template:Networking_rutos_manual_basic_advanced_webui_disclaimer

Line 13: Line 19:

}}

−

==General ~~settings~~==

+

==General Settings==

The General Settings section is used to configure the main policies of the device's firewall. The figure below is an example of the General Settings section and the table below provides information on the fields contained in that section:

−

[[File:~~Networking_rutos_manual_firewall_general_settings_general_settings~~.png|border|class=tlt-border]]

+

[[File:Networking_rutos_manual_firewall_general_settings_general_settings_v3.png|border|class=tlt-border]]

Line 24: Line 30:

<th>Value</th>

<th>Description</th>

−

~~</tr>~~

−

~~<tr>~~

−

~~<td>Enable SYN flood protection</td>~~

−

~~<td>off | on; default: on</td>~~

−

<td>Enables protection from SYN flood type attacks. A SYN flood is a type of denial-of-service (DOS) attack where an attacker sends bursts of SYN requests in an attempt to make the target host machine consume enough resources and become unresponsive.</td>

</tr>

<tr>

Line 34: Line 35:

<td>off | on; default: off</td>

<td>If enabled, a "Drop" action will be performed on packets that are determined to be invalid.</td>

+

</tr>

+

<tr>

+

<td>Automatic helper assignment</td>

+

<td>off | on; default: on</td>

+

<td>Automatically assigns conntrack helpers based on traffic protocol and port. If turned off, conntrack helpers can be selected for each zone.</td>

</tr>

<tr>

<td>Input</td>

−

<td>Reject | Drop | Accept; default: ~~Accept~~</td>

+

<td>Reject | Drop | Accept; default: Reject</td>

<td>Default action* of the INPUT chain if a packet does not match any existing rule on that chain.</td>

</tr>

Line 58: Line 64:

<li>Reject – packet is stopped, deleted and, differently from Drop, a message of rejection is sent to the source from which the packet came.</li>

</ul>

+

{{#ifeq: {{{name}}} | TRB500 | | ===Routing/NAT Offloading===

+

----

+

The Routing/NAT Offloading is used to turns software flow offloading on or off.

+

The device checks whether the flow (sequence of related packets) is of a received a packed is known. Packets of unknown flow are forwarded to the networking stack. Meanwhile, if the flow is known, NAT is applied (if matched) and the packet is forwarded to the correct destination port. This process is called software flow offloading. {{#switch: {{{series}}} | RUTX | RUTM = Hardware flow offloading is used to execute functions of the router using the hardware directly, instead of a process of software functions. | #default =}}

+

{{#switch: {{{series}}}

+

| RUTX | RUTM = [[File:Networking_rutos_manual_firewall_general_settings_routing_nat_offloading_rutx_v2.png|border|class=tlt-border]]

+

| #default =[[File:Networking_rutos_manual_firewall_general_settings_routing_nat_offloading_v2.png|border|class=tlt-border]]}}

+

+

<tr>

+

<th>Field</th>

+

<th>Value</th>

+

<th>Description</th>

+

</tr>

+

<tr>

+

<td>Software flow offloading</td>

+

<td>off {{!}} on; default: on</td>

+

<td>Turns software flow offloading on or off.</td>

+

</tr>

+

{{#switch: {{{series}}} | RUTX | RUTM =

+

<tr>

+

<td>Hardware flow offloading</td>

+

<td>off {{!}} on; default: on</td>

+

<td>Turns hardware flow offloading on or off.</td>

+

</tr>| #default =}}

+

</table>}}

===Zones===

Line 63: Line 97:

The Zones section is used to manage default traffic forwarding policies between different device zones. The figure below is an example of the Zones section and the table below provides information on the fields contained in that section:

−

[[File:~~Networking_rutos_manual_firewall_general_settings_zones~~.png|border|class=tlt-border]]

+

[[File:Networking_rutos_manual_firewall_general_settings_zones_v2.png|border|class=tlt-border]]

----

−

You can change a zone's settings from this page by interacting with entries in the zones table. For a more in-depth configuration click the button ~~that looks like a pencil~~ [[File:~~Networking_rutx_trb14x_manual_edit_button_v1~~.png|20px]] next to a zone:

+

You can change a zone's settings from this page by interacting with entries in the zones table. For a more in-depth configuration click the edit button [[File:Networking_rutx_trb14x_manual_edit_button_v2.png|20px]] next to a zone:

−

[[File:~~Networking_rutos_manual_firewall_general_settings_zones_edit_button~~.png|border|class=tlt-border]]

+

[[File:Networking_rutos_manual_firewall_general_settings_zones_edit_button_v2.png|border|class=tlt-border]]

====Zones: General Settings====

----

−

[[File:~~Networking_rutos_manual_firewall_general_settings_zones_general_settings~~.png|border|class=tlt-border]]

+

[[File:Networking_rutos_manual_firewall_general_settings_zones_general_settings_v2.png|border|class=tlt-border]]

Line 118: Line 152:

====Zones: Advanced Settings====

----

−

[[File:~~Networking_rutos_manual_firewall_general_settings_zones_advanced_settings~~.png|border|class=tlt-border]]

+

[[File:Networking_rutos_manual_firewall_general_settings_zones_advanced_settings_v4.png|border|class=tlt-border]]

Line 148: Line 182:

<tr>

<td>Enable logging on this zone</td>

−

<td>off | on; default: off</td>

+

<td>off | on; default: off</td>

<td>Logs packets that hit this rule.</td>

</tr>

<tr>

−

<td>Limit log messages</td>

+

<td>Limit log messages</td>

<td>integer/minute; default: none</td>

<td>Limit how many messages can be logged in the span of 1 minute. For example, to log 50 packets per minute use: 50/minute.</td>

+

</tr>

+

<tr>

+

<td>Conntrack helpers</td>

+

+

<td>This option appears only when automatic helper assignment option in the firewall's general settings is disabled. Explicitly choses allowed connection tracking helpers for zone traffic.</td>

</tr>

</table>

Line 162: Line 201:

The Inter-zone forwarding options control the forwarding policies between the currently edited zone and other zones.

−

[[File:Networking_rutos_manual_firewall_general_settings_zones_inter-~~zone_forwarding_mobile_{{{mobile}}}_dualsim_{{{dualsim}}}_wired_{{{wired}}}~~.png|border|class=tlt-border]]

+

[[File:Networking_rutos_manual_firewall_general_settings_zones_inter-zone_forwarding_v1.png|border|class=tlt-border]]

Line 190: Line 229:

The Port forwards table displays configured port forwarding rules currently configured on the device.

−

[[File:~~Networking_rutos_manual_firewall_port_forwards_port_forwards~~.png|border|class=tlt-border]]

+

[[File:Networking_rutos_manual_firewall_port_forwards_port_forwards_v2.png|border|class=tlt-border]]

===Add New Port Forward===

Line 196: Line 235:

The Add New Port Forward section is used to quickly add additional port forwarding rules. The figure below is an example of the Add New Port Forward section and the table below provides information on the fields contained in that section:

−

[[File:~~Networking_rutos_manual_firewall_port_forwards_add_new_port_forward~~.png|border|class=tlt-border]]

+

[[File:Networking_rutos_manual_firewall_port_forwards_add_new_port_forward_v3.png|border|class=tlt-border]]

Line 208: Line 247:

<td>string; default: none</td>

<td>Name of the rule. This is used for easier management purposes.</td>

−

~~</tr>~~

−

~~<tr>~~

−

~~<td>Protocol</td>~~

−

~~<td>TCP+UDP | TCP | UDP | Other; default: TCP+UDP</td>~~

−

~~<td>Specifies to which protocols the rule should apply.</td>~~

−

~~</tr>~~

−

~~<tr>~~

−

~~<td>External zone</td>~~

−

~~<td>firewall zone name; default: '''wan'''</td>~~

−

~~<td>The zone to which hosts will be connecting.</td>~~

</tr>

<tr>

<td>External port</td>

−

<td>integer [0..65535] | range of integers [0..65534] - [1..65535]; default: none</td>

+

<td>integer [0..65535] | range of integers [0..65534] - [1..65535] | port inversion [!0..!65535]; default: none</td>

−

<td>The port number to which hosts will be connecting~~.<td>~~

+

<td>The port number to which hosts will be connecting.</td>

−

~~</tr>~~

−

~~<tr>~~

−

~~<td>Internal zone</td>~~

−

~~<td>firewall zone name; default: '''lan'''</td>~~

−

~~<td>The zone to which the incoming connection will be redirected~~.</td>

</tr>

<tr>

Line 236: Line 260:

<tr>

<td>Internal port</td>

−

<td>integer [0..65535] | range of integers [0..65534] - [1..65535]; default: none</td>

+

<td>integer [0..65535] | range of integers [0..65534] - [1..65535] | port inversion [!0..!65535]; default: none</td>

<td>The port number to which the incoming connection will be redirected.</td>

</tr>

Line 243: Line 267:

===Port Forwards Configuration===

----

−

While the New port forward section provides the possibility to add port forwarding rules fast, it does not contain all possible configuration options to customize a rule. In order to create a more complicated rule, add one using the New port forward section and click the button ~~that looks like a pencil~~ [[File:~~Networking_rutx_trb14x_manual_edit_button_v1~~.png|20px]] next to it:

+

While the New port forward section provides the possibility to add port forwarding rules fast, it does not contain all possible configuration options to customize a rule. In order to create a more complicated rule, add one using the New port forward section and click the edit button [[File:Networking_rutx_trb14x_manual_edit_button_v2.png|20px]] next to it:

−

[[File:~~Networking_rutos_manual_firewall_port_forwards_edit_button~~.png|border|class=tlt-border]]

+

[[File:Networking_rutos_manual_firewall_port_forwards_edit_button_v3.png|border|class=tlt-border]]

−

You will be redirected to that rule's configuration page:

+

You will be redirected to that rule's configuration general settings page:

−

[[File:~~Networking_rutos_manual_firewall_port_forwards_configuration_mobile_{{{mobile}}}_dualsim_{{{dualsim}}}_wired_{{{wired}}}~~.png|border|class=tlt-border]]

+

[[File:Networking_rutos_manual_firewall_port_forwards_configuration_v3.png|border|class=tlt-border]]

Line 269: Line 293:

<tr>

<td>Protocol</td>

−

<td>TCP+UDP | ~~TCP~~ | ~~UDP~~ | ~~Other~~; default: TCP+UDP</td>

+

<td>TCP | UDP | ICMP | All | +Add new; default: TCP+UDP</td>

<td>Specifies to which protocols the rule should apply.</td>

</tr>

Line 276: Line 300:

<td>firewall zone name; default: wan</td>

<td>The zone to which the third party will be connecting. (Same thing as "External zone" in the New port forward section.)</td>

+

</tr>

+

<tr>

+

<td>External port</td>

+

<td>integer [0..65535] | range of integers [0..65534] - [1..65535] | port inversion [!0..!65535]; default: none</td>

+

<td>Port number(s) to which hosts will be connecting. The rule will apply only to hosts that connect to the port number(s) specified in this field. Leave empty to make the rule skip external port matching.</td>

+

</tr>

+

<tr>

+

<td>Internal zone</td>

+

<td>firewall zone name; default: lan</td>

+

<td>The zone to which the incoming connection will be redirected.</td>

+

</tr>

+

<tr>

+

<td>Internal IP address</td>

+

<td>Device LAN IP; default: Device LAN IP</td>

+

<td>The IP address to which the incoming connection will be redirected.</td>

+

</tr>

+

<tr>

+

<td>Internal port</td>

+

<td>integer [0..65535] | range of integers [0..65534] - [1..65535] | port inversion [!0..!65535]; default: none</td>

+

<td>The port number to which the incoming connection will be redirected.</td>

+

</tr>

+

</table>

+

Advanced settings:

+

[[File:Networking rutos manual firewall port forwards configuration advanced_v2.png|border|class=tlt-border]]

+

+

<tr>

+

<th>Field</th>

+

<th>Value</th>

+

<th>Description</th>

</tr>

<tr>

<td>Source MAC address</td>

<td>mac; default: none</td>

−

<td>MAC address~~(es)~~ of connecting hosts. The rule will apply only to hosts that match MAC addresses specified in this field. Leave empty to make the rule skip MAC address matching.</td>

+

<td>MAC address of connecting hosts. The rule will apply only to hosts that match MAC addresses specified in this field. Leave empty to make the rule skip MAC address matching.</td>

</tr>

<tr>

Line 289: Line 345:

<tr>

<td>Source port</td>

−

<td>integer [0..65535] | range of integers [0..65534] - [1..65535]; default: none</td>

+

<td>integer [0..65535] | range of integers [0..65534] - [1..65535] | port inversion [!0..!65535]; default: none</td>

−

<td>Port number(s) used by the connecting host. The rule will match the source port used by the connecting host with the port number(s) specified in this field. Leave empty to make the rule skip source port matching.<td>

+

<td>Port number(s) used by the connecting host. The rule will match the source port used by the connecting host with the port number(s) specified in this field. Leave empty to make the rule skip source port matching.</td>

</tr>

<tr>

Line 296: Line 352:

<td>ip | ip/netmask; default: any</td>

<td>IP address or network segment to which hosts will be connecting. The rule will apply only to hosts that connect to IP addresses specified in this field. To specify a subnet instead of one IP, add a forward slash followed by the netmask length after the network indication (for example, 10.0.0.0/8).</td>

−

~~</tr>~~

−

~~<tr>~~

−

~~<td>External port</td>~~

−

~~<td>integer [0..65535] | range of integers [0..65534] - [1..65535]; default: none</td>~~

−

<td>Port number(s) to which hosts will be connecting. The rule will apply only to hosts that connect to the port number(s) specified in this field. Leave empty to make the rule skip external port matching.<td>

−

~~</tr>~~

−

~~<tr>~~

−

~~<td>Internal zone</td>~~

−

~~<td>firewall zone name; default: lan</td>~~

−

~~<td>The zone to which the incoming connection will be redirected.</td>~~

−

~~</tr>~~

−

~~<tr>~~

−

~~<td>Internal IP address</td>~~

−

~~<td>ip; default: none</td>~~

−

~~<td>The IP address to which the incoming connection will be redirected.</td>~~

−

~~</tr>~~

−

~~<tr>~~

−

~~<td>Internal port</td>~~

−

~~<td>integer [0..65535] | range of integers [0..65534] - [1..65535]; default: none</td>~~

−

~~<td>The port number to which the incoming connection will be redirected.</td>~~

</tr>

<tr>

Line 333: Line 369:

The Traffic rules tab is used to set firewall rules that filter traffic moving through the device. The figure below is an example of the Traffic rules table:

−

[[File:~~Networking_rutos_manual_firewall_traffic_rules~~.png|border|class=tlt-border]]

+

[[File:Networking_rutos_manual_firewall_traffic_rules_v2.png|border|class=tlt-border]]

===Traffic Rule Configuration===

----

−

In order to begin editing a traffic rule, click the button ~~that looks like a pencil~~ [[File:~~Networking_rutx_trb14x_manual_edit_button_v1~~.png|20px]] next to it:

+

In order to begin editing a traffic rule, click the edit button [[File:Networking rutx trb14x manual edit button v2.png|20px]] next to it:

−

[[File:~~Networking_rutos_manual_firewall_traffic_rules_edit_button~~.png|border|class=tlt-border]]

+

[[File:Networking_rutos_manual_firewall_traffic_rules_edit_button_v2.png|border|class=tlt-border]]

You will be redirected to that rule's configuration page:

−

[[File:~~Networking_rutos_manual_firewall_traffic_rules_configuration_mobile_{{{mobile}}}_dualsim_{{{dualsim}}}_wired_{{{wired}}}~~.png|border|class=tlt-border]]

+

====General settings====

−

+

----

+

[[File:Networking_rutos_manual_firewall_traffic_rules_configuration_general_settings_v2.png|border|class=tlt-border]]

<tr>

Line 362: Line 399:

</tr>

<tr>

−

<td>~~Restrict to address family~~</td>

+

<td>Protocol</td>

−

<td>~~IPv4 and IPv6~~ | ~~IPv4 only~~ | ~~IPv6 only~~; default: ~~IPv4 and IPv6~~</td>

+

<td>TCP | UDP | All | +Add new |ICMP; default: depends on the rule</td>

−

<td>~~IP address family~~ to which the rule ~~will~~ apply to.</td>

+

<td>Specifies to which protocols the rule should apply.</td>

</tr>

<tr>

−

<td>~~Protocol~~</td>

+

<td> Match ICMP type</td>

−

<td>~~TCP+UDP | TCP | UDP~~ | ICMP | ~~-- custom --~~; default: ~~TCP+UDP~~</td>

+

<td>Any | ICMP-type | + Add new; default: '''none'''</td>

−

<td>~~Specifies to which protocols the rule should apply~~.</td>

+

<td>Allows matching specific ICMP types.</td>

</tr>

<tr>

Line 377: Line 414:

</tr>

<tr>

−

<td>Source ~~MAC address</td>~~

+

<td>Source IP address</td>

−

~~<td>mac; default: none</td>~~

−

~~<td>MAC address(es) of connecting hosts. The rule will apply only to hosts that match MAC addresses specified in this field. Leave empty to make the rule skip MAC address matching.</td>~~

−

~~</tr>~~

−

~~<tr>~~

−

~~<td>Source~~ address</td>

<td>ip | ip/netmask; default: any</td>

<td>IP address or network segment used by connecting hosts. The rule will apply only to hosts that connect from IP addresses specified in this field. To specify a network segment instead of one IP address, add a forward slash followed by the netmask length after the network indication (for example, 10.0.0.0/8).</td>

Line 388: Line 420:

<tr>

<td>Source port</td>

−

<td>integer [0..65535] | range of integers [0..65534] - [1..65535]; default: none</td>

+

<td>integer [0..65535] | range of integers [0..65534] - [1..65535] | port inversion [!0..!65535]; default: none</td>

−

<td>Port number(s) used by the connecting host. The rule will match the source port used by the connecting host with the port number(s) specified in this field. Leave empty to make the rule skip source port matching.<td>

+

<td>Port number(s) used by the connecting host. The rule will match the source port used by the connecting host with the port number(s) specified in this field. Leave empty to make the rule skip source port matching. Port negation using is also available, for ex. !1.<td>

</tr>

<tr>

Line 403: Line 435:

<tr>

<td>Destination port</td>

−

<td>integer [0..65535] | range of integers [0..65534] - [1..65535]; default: none</td>

+

<td>integer [0..65535] | range of integers [0..65534] - [1..65535] | port inversion [!0..!65535]; default: none</td>

−

<td>Tagert port or range of ports of the incoming connection.</td>

+

<td>Tagert port or range of ports of the incoming connection. Port negation using is also available, for ex. !1.</td>

</tr>

<tr>

<td>Action</td>

−

<td>Drop | Accept | Reject | Don't track; default: Accept</td>

+

<td>Action that is to be taken when a packet matches the conditions of the rule.

<ul>

Line 415: Line 447:

<li>Reject – packet is stopped, deleted and, differently from Drop, an ICMP packet containing a message of rejection is sent to the source from which the dropped packet came.</li>

<li>Don't track – packet is no longer tracked as it moves forward.</li>

+

<li>DSCP – packet is marked with specified DiffServ Code Point value.</li>

+

<li>Mark – packet is marked with specified firewall mark..</li>

</ul>

</td>

+

</tr>

+

</table>

+

====Advanced settings====

+

----

+

[[File:Networking_rutos_manual_firewall_traffic_rules_configuration_advanced_settings_v2.png|border|class=tlt-border]]

+

+

<tr>

+

<td>Restrict to address family</td>

+

<td>IPv4 and IPv6 | IPv4 only | IPv6 only; default: IPv4 and IPv6</td>

+

<td>IP address family to which the rule will apply to.</td>

+

</tr>

+

<tr>

+

<td>Source MAC address</td>

+

<td>mac; default: none</td>

+

<td>MAC address(es) of connecting hosts. The rule will apply only to hosts that match MAC addresses specified in this field. Leave empty to make the rule skip MAC address matching.</td>

+

</tr>

+

<tr>

+

<td>DSCP: Set Target value</td>

+

<td>Default | DSCP values; default: Default</td>

+

<td>If specified, target traffic against the given firewall DSCP value.</td>

+

</tr>

+

<tr>

+

<td>Mark: Set Target value</td>

+

<td>hex; default: none</td>

+

<td>If specified, target traffic against the given firewall mark, e.g. FF or ff to target mark 255.</td>

+

</tr>

+

<tr>

+

<td>Match</td>

+

<td>DSCP | Mark; default: none</td>

+

<td>Match traffic against the given DSCP value or firewall mark</td>

+

</tr>

+

<tr>

+

<td>DSCP: Set Match value</td>

+

<td>Default | DSCP values; default: Default</td>

+

<td>Match traffic against the given firewall DSCP value.</td>

+

</tr>

+

<tr>

+

<td>Mark: Set Match value</td>

+

<td>hex; default: none</td>

+

<td>If specified, match traffic against the given firewall mark, e.g. FF or ff to match mark 255.</td>

</tr>

<tr>

Line 423: Line 498:

<td>Adds extra .iptables options to the rule.</td>

</tr>

+

</table>

+

====Time restrictions====

+

----

+

[[File:Networking_rutos_manual_firewall_traffic_rules_configuration_time_restrictions_v2.png|border|class=tlt-border]]

+

<tr>

−

<td>days of the week [~~Sunday~~..~~Saturday~~]; default: none</td>

+

<td>days of the week [Monday..Sunday]; default: none</td>

<td>Specifies on which days of the week the rule is valid.</td>

</tr>

Line 456: Line 537:

<td>off | on; default: no</td>

−

<td>Specifies whether the device should use UTC time. If this is disabled, the time zone specified in the ~~Services~~ → [[{{{name}}} NTP|NTP]] page will be used.</td>

+

<td>Specifies whether the device should use UTC time. If this is disabled, the time zone specified in the System → Administration → [[{{{name}}}_Administration#NTP|NTP]] page will be used.</td>

</tr>

</table>

Line 462: Line 543:

===Open Ports on Router===

----

−

~~The~~ Open ~~Ports~~ on ~~Router~~ ~~section~~ provides a quick way to set simple rules that allow traffic on specified ports of the device. The figure below is an example of the Open ports on device section and the table below provides information on the fields contained in that section:

+

In the Add new instance section, select Open ports on router. This provides a quick way to set simple rules that allow traffic on specified ports of the device. The figure below is an example of the Open ports on device section and the table below provides information on the fields contained in that section:

−

[[File:~~Networking_rutos_manual_firewall_traffic_rules_open_ports_on_router~~.png|border|class=tlt-border]]

+

[[File:Networking_rutos_manual_firewall_traffic_rules_open_ports_on_router_v2.png|border|class=tlt-border]]

Line 479: Line 560:

<tr>

<td>Protocol</td>

−

<td>TCP+UDP | ~~TCP~~ | ~~UDP~~ | ~~Other~~; default: ~~TCP+UDP~~</td>

+

<td>TCP | UDP | ICMP | All | +Add new; default: none</td>

<td>Specifies to which protocols the rule should apply.</td>

</tr>

<tr>

<td>External port</td>

−

<td>integer [0..65535] | range of integers [0..65534] - [1..65535]; default: none</td>

+

<td>integer [0..65535] | range of integers [0..65534] - [1..65535] | port inversion [!0..!65535]; default: none</td>

<td>Specifies which port(s) should be opened.</td>

</tr>

Line 491: Line 572:

===Add New Forward Rule===

----

−

~~The~~ Add ~~New Forward Rule~~ section is used to create firewall rules that control traffic on the FORWARD chain. The figure below is an example of the Add New Forward Rule section and the table below provides information on the fields contained in that section:

+

In the Add new instance section, select Add new forward rule. This is used to create firewall rules that control traffic on the FORWARD chain. The figure below is an example of the Add New Forward Rule section and the table below provides information on the fields contained in that section:

−

[[File:~~Networking_rutos_manual_firewall_traffic_rules_add_new_forward_rule~~.png|border|class=tlt-border]]

+

[[File:Networking_rutos_manual_firewall_traffic_rules_add_new_forward_rule_v2.png|border|class=tlt-border]]

Line 533: Line 614:

The Source NAT section displays currently existing SNAT rules.

−

[[File:~~Networking_rutos_manual_firewall_nat_rules_source_nat~~.png|border|class=tlt-border]]

+

[[File:Networking_rutos_manual_firewall_nat_rules_source_nat_v2.png|border|class=tlt-border]]

===Add New Source NAT===

Line 539: Line 620:

The Add New Source NAT section is used to create new source NAT rules.

−

[[File:~~Networking_rutos_manual_firewall_nat_rules_add_new_source_nat~~.png|border|class=tlt-border]]

+

[[File:Networking_rutos_manual_firewall_nat_rules_add_new_source_nat_v2.png|border|class=tlt-border]]

Line 569: Line 650:

<tr>

<td>To Source Port</td>

−

<td>integer [0..65335] | do not rewrite; default: none</td>

+

<td>integer [0..65335] | port inversion [!0..!65535] | do not rewrite; default: none</td>

<td>Changes the source port in the packet header to the value specified in this field.</td>

</tr>

Line 581: Line 662:

===Source NAT Configuration===

----

−

In order to begin editing a traffic rule, click the button ~~that looks like a pencil~~ [[File:~~Networking_rutx_trb14x_manual_edit_button_v1~~.png|20px]] next to it:

+

In order to begin editing a traffic rule, click the edit button [[File:Networking_rutx_trb14x_manual_edit_button_v2.png|20px]] next to it:

−

~~{{#ifeq: {{{series}}} | TRB1~~

+

[[File:Networking_rutos_manual_firewall_nat_rules_source_nat_edit_button_v2.png|border|class=tlt-border]]

−

~~| [[File:Networking_trb1_manual_firewall_nat_rules_source_nat_edit_button.png|border|class=tlt-border]]~~

−

| [[File:~~Networking_rutos_manual_firewall_nat_rules_source_nat_edit_button~~.png|border|class=tlt-border]]

−

}}

You will be redirected to that rule's configuration page:

−

[[File:~~Networking_rutos_manual_firewall_nat_rules_configuration_mobile_{{{~~mobile~~}}}_dualsim_{{{dualsim}}}_wired_{{{wired}}}~~.png|border|class=tlt-border]]

+

[[File:Networking rutos manual firewall nat rules configuration mobile general.png|border|class=tlt-border]]

Line 610: Line 688:

<tr>

<td>Protocol</td>

−

+

<td>TCP | UDP | ICMP | +Add new; default: All protocols</td>

<td>Specifies to which protocols the rule should apply.</td>

</tr>

Line 625: Line 703:

<tr>

<td>Source port</td>

−

<td>integer [0..65535] | range of integers [0..65534] - [1..65535]; default: none</td>

+

<td>integer [0..65535] | range of integers [0..65534] - [1..65535] | port inversion [!0..!65535]; default: none</td>

−

<td>Mathes traffic originated from specified port number.<td>

+

<td>Mathes traffic originated from specified port number.</td>

</tr>

<tr>

Line 632: Line 710:

<td>firewall zone; default: wan</td>

<td>Matches traffic destined for the specified zone.</td>

−

</tr>

+

</tr>

<tr>

<td>Destination IP address</td>

Line 640: Line 718:

<tr>

<td>Destination port</td>

−

<td>integer [0..65535] | range of integers [0..65534] - [1..65535]; default: none</td>

+

<td>integer [0..65535] | range of integers [0..65534] - [1..65535] | port inversion [!0..!65535]; default: none</td>

<td>Matches traffic destined for the specified port number.</td>

</tr>

<tr>

−

<td>~~SNAT address~~</td>

+

<td>Rewrite port</td>

−

<td>ip; default: ~~none~~</td>

+

<td>integer [0..65535] | range of integers [0..65534] - [1..65535] | port inversion [!0..!65535]; default: No rewrite</td>

−

<td>~~Changes~~ matched traffic ~~packet source IP address~~ to the ~~value specified in this field~~.</td>

+

<td>Rewrite matched traffic to the given source port.</td>

</tr>

+

</table>

+

[[File:Networking rutos manual firewall nat rules configuration mobile advanced.png|border|class=tlt-border]]

+

<tr>

−

+

<th>Field</th>

−

<~~td>integer [0..65535] | range of integers [0..65534] - [1..65535]; default: none</b~~></td>

+

<th>Value</th>

−

<td>~~Changes matched traffic packet source port number to the value specified in this field.~~</td>

+

<th>Description</th>

</tr>

<tr>

Line 657: Line 740:

<td>string; default: none</td>

<td>Adds extra .iptables options to the rule.</td>

+

</tr>

+

</table>

+

[[File:Networking rutos manual firewall nat rules configuration mobile time restriction.png|border|class=tlt-border]]

+

+

<tr>

+

<th>Field</th>

+

<th>Value</th>

+

<th>Description</th>

</tr>

<tr>

−

<td>days of the week [~~Sunday~~..~~Saturday~~]; default: none</td>

+

<td>days of the week [Monday..Sunday]; default: none</td>

<td>Specifies on which days of the week the rule is valid.</td>

</tr>

Line 691: Line 784:

<td>off | on; default: no</td>

−

<td>Specifies whether the device should use UTC time. If this is disabled, the time zone specified in the ~~Services~~ → [[{{{name}}} NTP|NTP]] page will be used.</td>

+

<td>Specifies whether the device should use UTC time. If this is disabled, the time zone specified in the System → Administration → [[{{{name}}}_Administration#NTP|NTP]] page will be used.</td>

</tr>

</table>

−

~~==Custom rules==~~

−

The Custom rules tab provides you with the possibility to execute iptables commands which are not otherwise covered by the device's firewall framework. The commands are executed after each firewall restart, right after the default rule set has been loaded.

−

~~The figure below is an example of the Custom rules tab:~~

−

~~[[File:Networking_rutos_manual_firewall_custom_rules.png|border|class=tlt-border]]~~

−

~~The rules added here are saved in the /etc/firewall.user file. Feel free to edit that file instead for the same effect in case you don't have access to the device's WebUI.~~

−

~~The Save button restarts the firewall service. Thus, adding the custom rules specified in this section to the device's list of firewall rules.~~

−

~~The Reset button resets the custom rules field to its default state.~~

==Attack Prevention==

Line 717: Line 796:

SYN Flood Protection allows you to protect yourself from attacks that exploit part of the normal TCP three-way handshake to consume resources on the targeted server and render it unresponsive. Essentially, with SYN flood DDOS, the offender sends TCP connection requests faster than the targeted machine can process them, causing network over-saturation.

−

[[File:~~Networking_rutos_manual_firewall_attack_prevention_syn_flood_protection~~.png|border|class=tlt-border]]

+

[[File:Networking_rutos_manual_firewall_attack_prevention_syn_flood_protection_v2.png|border|class=tlt-border]]

Line 733: Line 812:

<td>SYN flood rate</td>

<td>integer; default: 5</td>

−

<td>Set rate limit (packets per second) for SYN packets above which the traffic is considered ~~floodedb~~</td>

+

<td>Set rate limit (packets per second) for SYN packets above which the traffic is considered flooded</td>

</tr>

<tr>

<td>SYN flood burst</td>

<td>integer; default: 10</td>

−

<td>Sets burst limit for SYN packets above which the traffic is considered flooded if it exceeds the allowed ~~ratbe~~</td>

+

<td>Sets burst limit for SYN packets above which the traffic is considered flooded if it exceeds the allowed rate</td>

</tr>

<tr>

<td>TCP SYN cookies</td>

−

<td>off | on; default: ~~off~~</td>

+

<td>off | on; default: on</td>

−

<td>Enables the use of SYN cookies (particular choices of initial TCP sequence numbers by TCP servers)b</td>

+

<td>Enables the use of SYN cookies (particular choices of initial TCP sequence numbers by TCP servers)</td>

</tr>

</table>

Line 751: Line 830:

Some attackers use ICMP echo request packets directed to IP broadcast addresses from remote locations to generate denial-of-service attacks. You can set up some custom restrictions to help protect your router from ICMP bursts.

−

[[File:~~Networking_rutos_manual_firewall_attack_prevention_remote_icmp_requests~~.png|border|class=tlt-border]]

+

[[File:Networking_rutos_manual_firewall_attack_prevention_remote_icmp_requests_v2.png|border|class=tlt-border]]

Line 766: Line 845:

<tr>

<td>Enable ICMP limit</td>

−

<td>off | on; default: no</td>

+

<td>off | on; default: off</td>

<td>Turns ICMP echo-request limit in selected period on or off.</td>

</tr>

<tr>

−

<td>Limit period</td>

+

<td>Limit period</td>

<td>Second | Minute | Hour | Day; default: Second</td>

<td>Period length for matching the conditions of the rule.</td>

</tr>

<tr>

−

<td>Limit</td>

+

<td>Limit</td>

<td>integer; default: 5</td>

<td>Maximum ICMP echo-request number during the period.</td>

</tr>

<tr>

−

<td>Limit burst</td>

+

<td>Limit burst</td>

<td>integer; default: 10</td>

<td>Indicates the maximum burst before the above limit kicks in.</td>

Line 790: Line 869:

This protection prevent SSH attacks by limiting connections in a defined period.

−

[[File:~~Networking_rutos_manual_firewall_attack_prevention_ssh_attack_prevention~~.png|border|class=tlt-border]]

+

[[File:Networking_rutos_manual_firewall_attack_prevention_ssh_attack_prevention_v2.png|border|class=tlt-border]]

Line 810: Line 889:

<tr>

<td>Limit</td>

−

<td>integer; default: 5</td>

+

<td>integer [1..10000]; default: none</td>

<td>Maximum SSH connections during the set period</td>

</tr>

<tr>

<td>Limit burst</td>

−

<td>integer; default: 10</td>

+

<td>integer [1..10000]; default: none</td>

<td>Indicates the maximum burst before the above limit kicks in.</td>

</tr>

Line 824: Line 903:

An HTTP attack sends a complete, legitimate HTTP header, which includes a 'Content-Length' field to specify the size of the message body to follow. However, the attacker then proceeds to send the actual message body at an extremely slow rate (e.g. 1 byte/100 seconds.) Due to the entire message being correct and complete, the target server will attempt to obey the 'Content-Length' field in the header, and wait for the entire body of the message to be transmitted, hence slowing it down.

−

[[File:~~Networking_rutos_manual_firewall_attack_prevention_http_attack_prevention~~.png|border|class=tlt-border]]

+

[[File:Networking_rutos_manual_firewall_attack_prevention_http_attack_prevention_v2.png|border|class=tlt-border]]

Line 844: Line 923:

<tr>

<td>Limit</td>

−

<td>integer; default: 5</td>

+

<td>integer [1..10000]; default: none</td>

−

<td>Maximum HTTP connections during the set period<./td>

+

<td>Maximum HTTP connections during the set period.</td>

</tr>

<tr>

<td>Limit burst</td>

−

<td>integer; default: 10</td>

+

<td>integer [1..10000]; default: none</td>

<td>Indicates the maximum burst before the above limit kicks in.</td>

</tr>

Line 860: Line 939:

In cryptography and computer security, a man-in-the-middle attack (MITM) is an attack where the perpetrator secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other. One example of man-in-the-middle attacks is active eavesdropping, in which the attacker makes independent connections with the victims and relays messages between them to make them believe they are talking directly to each other over a private connection, when in fact the entire conversation is controlled by the attacker.

−

[[File:~~Networking_rutos_manual_firewall_attack_prevention_https_attack_prevention~~.png|border|class=tlt-border]]

+

[[File:Networking_rutos_manual_firewall_attack_prevention_https_attack_prevention_v2.png|border|class=tlt-border]]

Line 880: Line 959:

<tr>

<td>Limit</td>

−

<td>integer; default: 5</td>

+

<td>integer [1..10000]; default: none</td>

<td>Maximum HTTPS connections during the set period.</td>

</tr>

<tr>

<td>Limit burst</td>

−

<td>integer; default: 10</td>

+

<td>integer [1..10000]; default: none</td>

<td>Indicates the maximum burst number before the above limit kicks in.</td>

</tr>

Line 895: Line 974:

Port scanning is usually done in the initial phase of a penetration test in order to discover all network entry points into the target system. The Port Scan section provides you with the possibility to enable protection against port scanning software. The Defending Type section provides the possibility for the user to enable protections from certain types of online attacks. These include SYN-FIN, SYN-RST, X-Mas, FIN scan and NULLflags attacks.

−

[[File:~~Networking_rutos_manual_firewall_attack_prevention_port_scan~~.png|border|class=tlt-border]]

+

[[File:Networking_rutos_manual_firewall_attack_prevention_port_scan_v2.png|border|class=tlt-border]]

Line 910: Line 989:

<tr>

<td>Scan count</td>

−

<td>integer [5..~~65534~~]; default: 5</td>

+

<td>integer [5..10000]; default: none</td>

<td>How many port scans before blocked.</td>

</tr>

<tr>

<td>Interval</td>

−

<td>integer [10..60]; default: 10</td>

+

<td>integer [10..4096]; default: none</td>

<td>Time interval in seconds in which port scans are counted.</td>

</tr>

Line 944: Line 1,023:

</tr>

</table>

−

~~{{#ifeq: {{{series}}} | RUTX |~~

−

~~==Helpers==~~

−

The ~~Helpers~~ ~~section~~ provides you with the possibility to ~~add~~ firewall ~~exceptions for some VoIP protocols~~, ~~namely SIP and H~~.~~323~~. ~~In other words, these functions provide a pass-through for VoIP communications between~~ the ~~device's LAN and WAN.~~

+

==Custom Rules==

+

The Custom rules tab provides you with the possibility to execute iptables commands which are not otherwise covered by the device's firewall framework. The commands are executed after each firewall restart, right after the default rule set has been loaded.

+

Note: Custom rules are not recommended to be used with hostnames. The rules will not remain active after reboot due to security reasons.

+

The figure below is an example of the Custom rules tab:

−

~~Technical explanation~~:~~~~

+

[[File:Networking_rutos_manual_firewall_custom_rules.png|border|class=tlt-border]]

−

~~FTP, SIP and H.323 protocols~~ are ~~harder to filter by firewalls since they violate layering by introducing OSI layer 3/4 parameters~~ in the ~~OSI layer 7~~. ~~NAT helpers are modules~~ that ~~are able to assist~~ the ~~firewall~~ in ~~tracking these protocols. These helpers create~~ the ~~so-called expectations that can be used to open necessary ports for RELATED connections. For example, FTP, GRE and PPTP helpers are enabled by default~~.

+

The rules added here are saved in the /etc/firewall.user file. Feel free to edit that file instead for the same effect in case you don't have access to the device's WebUI.

−

[[File:~~Networking_rutos_manual_firewall_helpers_nat_helpers~~.png|border|class=tlt-border]]

+

The Save button restarts the firewall service. Thus, adding the custom rules specified in this section to the device's list of firewall rules.

+

The Reset button resets the custom rules field to its default state.

+

==DMZ==

+

The DMZ is a security concept. It comprises the separation of the LAN-side network into at least two networks: the user LAN and the DMZ. Generally the DMZ is imprisoned: only access to certain ports from the Internet are allowed into the DMZ, while the DMZ is not allowed to establish new connections to the WAN-side or LAN-side networks. That way, if a server inside of the DMZ is hacked the potential damage that can be done remains restricted! The whole point of the DMZ is to cleanly create a unique firewall rule set that dramatically restricts access in to, and out of the, DMZ.

+

[[File:Networking rutos manual network firewall dmz_v2.png|border|class=tlt-border]]

<tr>

<th>Field</th>

−

<th>Value</th>

+

<th>Value</th>

−

<th>Description</th>

+

<th>Description</th>

+

</tr>

+

<tr>

+

<td>Enable</td>

+

<td>off | on; default: off</td>

+

<td>Enables the DMZ configuration.</td>

+

</tr>

+

<tr>

+

+

<td>ipv4; default: none</td>

+

<td>Specifies the IP address of the DMZ host.</td>

</tr>

<tr>

−

+

<td>Protocol</td>

−

<td>~~off~~ <~~nowiki~~>|</~~nowiki~~> on; default: ~~off~~</td>

+

<td>All | TCP | UDP | ICMP; default: None</td>

−

<td>~~Turns H323 filtering on or off~~.</td>

+

<td>Specifies for which protocols the DMZ will be used.</td>

</tr>

<tr>

−

+

<td>Ports</td>

−

<td>~~off <nowiki>~~|~~</nowiki> on~~; default: ~~off~~</td>

+

<td>0..65535 | port range | port negation; default: none</td>

−

<td>~~Turns SIP filtering~~ on ~~or off~~.</td>

+

<td>Match incoming traffic directed at the given destination port or port range on DMZ host IP.</td>

</tr>

</table>

−

~~|}}~~

+

[[Category:{{{name}}} Network section]]

Vainius.l

Administrators

7,849

edits

Namespaces

Variants

Views

More

Search

Changes

Template:Networking rutos manual firewall (view source)

Revision as of 14:41, 5 January 2024

Navigation menu

Personal tools

NAVIGATION

Tools

Categories