Changes

Template:Networking rutos manual firewall (view source)

Revision as of 08:31, 27 July 2021

130 bytes added ,  08:31, 27 July 2021
no edit summary
Line 1: Line 1: −
{{Template:Networking_rutos_manual_fw_disclosure
+
{{Template: Networking_rutos_manual_fw_disclosure
−
| fw_version = {{{series}}}_R_00.02.05.1
+
| fw_version = {{{series}}}_R_00.07.00
 
| series    = {{{series}}}
 
| series    = {{{series}}}
 
}}
 
}}
 +
{{#ifeq: {{{series}}} | RUT9 |<br><i><b>Note</b>: <b>[[{{{name}}} Firewall (legacy WebUI)|click here]]</b> for the old style WebUI (FW version RUT9XX_R_00.06.08.3 and earlier) user manual page.</i>|}}
 
==Summary==
 
==Summary==
    
{{{name}}} devices use a standard Linux iptables package as its <b>firewall</b>, which uses routing chains and policies to facilitate control over inbound and outbound traffic.
 
{{{name}}} devices use a standard Linux iptables package as its <b>firewall</b>, which uses routing chains and policies to facilitate control over inbound and outbound traffic.
   −
This chapter of the user manual provides an overview of the Firewall section for {{{name}}} devices.
+
This chapter of the user manual provides an overview of the Firewall page for {{{name}}} devices.
    
{{Template:Networking_rutos_manual_basic_advanced_webui_disclaimer
 
{{Template:Networking_rutos_manual_basic_advanced_webui_disclaimer
Line 13: Line 14:  
}}
 
}}
   −
==General settings==
+
==General Settings==
    
The <b>General Settings</b> section is used to configure the main policies of the device's firewall. The figure below is an example of the General Settings section and the table below provides information on the fields contained in that section:
 
The <b>General Settings</b> section is used to configure the main policies of the device's firewall. The figure below is an example of the General Settings section and the table below provides information on the fields contained in that section:
Line 24: Line 25:  
         <th>Value</th>
 
         <th>Value</th>
 
         <th>Description</th>
 
         <th>Description</th>
−
    </tr>
  −
    <tr>
  −
      <td>Enable SYN flood protection</td>
  −
      <td>off | on; default: <b>on</b></td>
  −
      <td>Enables protection from SYN flood type attacks. A SYN flood is a type of denial-of-service (DOS) attack where an attacker sends bursts of SYN requests in an attempt to make the target host machine consume enough resources and become unresponsive.</td>
   
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
Line 34: Line 30:  
       <td>off | on; default: <b>off</b></td>
 
       <td>off | on; default: <b>off</b></td>
 
       <td>If enabled, a "Drop" action will be performed on packets that are determined to be invalid.</td>
 
       <td>If enabled, a "Drop" action will be performed on packets that are determined to be invalid.</td>
 +
    </tr>
 +
    <tr>
 +
      <td>Automatic helper assignment</td>
 +
      <td>off | on; default: <b>on</b></td>
 +
      <td>Automatically assigns conntrack helpers based on traffic protocol and port. If turned off, conntrack helpers can be selected for each zone.</td>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
 
       <td>Input</td>
 
       <td>Input</td>
−
       <td>Reject | Drop | Accept; default: <b>Accept</b></td>
+
       <td>Reject | Drop | Accept; default: <b>Reject</b></td>
 
       <td>Default action<span class="asterisk">*</span> of the INPUT chain if a packet does not match any existing rule on that chain.</td>
 
       <td>Default action<span class="asterisk">*</span> of the INPUT chain if a packet does not match any existing rule on that chain.</td>
 
     </tr>
 
     </tr>
Line 58: Line 59:  
     <li><b>Reject</b> – packet is stopped, deleted and, differently from Drop, a message of rejection is sent to the source from which the packet came.</li>
 
     <li><b>Reject</b> – packet is stopped, deleted and, differently from Drop, a message of rejection is sent to the source from which the packet came.</li>
 
</ul>
 
</ul>
 +
{{ifeq: {{{nat}}} | 1 |
 +
===Routing/NAT Offloading===
 +
----
 +
The <b>Routing/NAT Offloading</b> is used to turns software flow offloading on or off.
 +
 +
The device checks whether the flow (sequence of related packets) is of a received a packed is known. Packets of unknown flow are forwarded to the networking stack. Meanwhile, if the flow is known, NAT is applied (if matched) and the packet is forwarded to the correct destination port. This process is called <b>software flow offloading</b>.
 +
 +
[[File:Networking_rutos_manual_firewall_general_settings_routing_nat_offloading.png|border|class=tlt-border]]
 +
 +
<table class="nd-mantable">
 +
    <tr>
 +
        <th>Field</th>
 +
        <th>Value</th>
 +
        <th>Description</th>
 +
    </tr>
 +
    <tr>
 +
        <td>Software flow offloading</td>
 +
        <td>off | on; default: <b>off</b></td>
 +
        <td>Turns software flow offloading on or off.</td>
 +
    </tr>
 +
</table>
    
===Zones===
 
===Zones===
Line 118: Line 140:  
====Zones: Advanced Settings====
 
====Zones: Advanced Settings====
 
----
 
----
−
[[File:Networking_rutos_manual_firewall_general_settings_zones_advanced_settings.png|border|class=tlt-border]]
+
[[File:Networking_rutos_manual_firewall_general_settings_zones_advanced_settings_v3.png|border|class=tlt-border]]
    
<table class="nd-mantable">
 
<table class="nd-mantable">
Line 148: Line 170:  
     <tr>
 
     <tr>
 
         <td>Enable logging on this zone</td>
 
         <td>Enable logging on this zone</td>
−
         <td>off | <span style="color: red;">on</span>; default: <b>off</b></td>
+
         <td>off | <span style="color: #1550bf; font-weight: bold;">on</span>; default: <b>off</b></td>
 
         <td>Logs packets that hit this rule.</td>
 
         <td>Logs packets that hit this rule.</td>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
−
         <td><span style="color: red;">Limit log messages</span></td>
+
         <td><span style="color: #1550bf;">Limit log messages</span></td>
 
         <td>integer/minute; default: <b>none</b></td>
 
         <td>integer/minute; default: <b>none</b></td>
 
         <td>Limit how many messages can be logged in the span of 1 minute. For example, to log 50 packets per minute use: <i>50/minute</i>.</td>
 
         <td>Limit how many messages can be logged in the span of 1 minute. For example, to log 50 packets per minute use: <i>50/minute</i>.</td>
 +
    </tr>
 +
    <tr>
 +
        <td>Conntrack helpers</td>
 +
        <td> Amanda backup and archiving proto (AMANDA) | FTP passive connection tracking (FTP) | RAS proto tracking (RAS) | Q.931 proto tracking (Q.931) | IRC DCC connection tracking (IRC) | NetBIOS name service broadcast tracking (NETBIOS-NS) | PPTP VPN connection tracking (PPTP) | SIP VoIP connection tracking (SIP) | SNMP monitoring connection tracking (SNMP) | TFTP connection tracking (TFTP); default: <b>none</b></td>
 +
        <td><b>This option appears only when automatic helper assignment option in the firewall's general settings is disabled. </b>Explicitly choses allowed connection tracking helpers for zone traffic.</td>
 
     </tr>
 
     </tr>
 
</table>
 
</table>
Line 208: Line 235:  
         <td>string; default: <b>none</b></td>
 
         <td>string; default: <b>none</b></td>
 
         <td>Name of the rule. This is used for easier management purposes.</td>
 
         <td>Name of the rule. This is used for easier management purposes.</td>
−
    </tr>
  −
    <tr>
  −
        <td>Protocol</td>
  −
        <td>TCP+UDP | TCP | UDP | Other; default: <b>TCP+UDP</b></td>
  −
        <td>Specifies to which protocols the rule should apply.</td>
  −
    </tr>
  −
    <tr>
  −
        <td>External zone</td>
  −
        <td>firewall zone name; default: '''wan'''</td>
  −
        <td>The zone to which hosts will be connecting.</td>
   
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
Line 223: Line 240:  
         <td>integer [0..65535] | range of integers [0..65534] - [1..65535]; default: <b>none</b></td>
 
         <td>integer [0..65535] | range of integers [0..65534] - [1..65535]; default: <b>none</b></td>
 
         <td>The port number to which hosts will be connecting.<td>
 
         <td>The port number to which hosts will be connecting.<td>
−
    </tr>
  −
    <tr>
  −
        <td>Internal zone</td>
  −
        <td>firewall zone name; default: '''lan'''</td>
  −
        <td>The zone to which the incoming connection will be redirected.</td>
   
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
Line 462: Line 474:  
===Open Ports on Router===
 
===Open Ports on Router===
 
----
 
----
−
The <b>Open Ports on Router</b> section provides a quick way to set simple rules that allow traffic on specified ports of the device. The figure below is an example of the Open ports on device section and the table below provides information on the fields contained in that section:
+
In the <b>Add new instance</b> section, select <b>Open ports on router</b>. This provides a quick way to set simple rules that allow traffic on specified ports of the device. The figure below is an example of the Open ports on device section and the table below provides information on the fields contained in that section:
    
[[File:Networking_rutos_manual_firewall_traffic_rules_open_ports_on_router.png|border|class=tlt-border]]
 
[[File:Networking_rutos_manual_firewall_traffic_rules_open_ports_on_router.png|border|class=tlt-border]]
Line 491: Line 503:  
===Add New Forward Rule===
 
===Add New Forward Rule===
 
----
 
----
−
The <b>Add New Forward Rule</b> section is used to create firewall rules that control traffic on the FORWARD chain. The figure below is an example of the Add New Forward Rule section and the table below provides information on the fields contained in that section:
+
In the <b>Add new instance</b> section, select <b>Add new forward rule</b>. This is used to create firewall rules that control traffic on the FORWARD chain. The figure below is an example of the Add New Forward Rule section and the table below provides information on the fields contained in that section:
    
[[File:Networking_rutos_manual_firewall_traffic_rules_add_new_forward_rule.png|border|class=tlt-border]]
 
[[File:Networking_rutos_manual_firewall_traffic_rules_add_new_forward_rule.png|border|class=tlt-border]]
Line 694: Line 706:  
     </tr>
 
     </tr>
 
</table>
 
</table>
−
  −
==Custom rules==
  −
  −
The <b>Custom rules</b> tab provides you with the possibility to execute <b>iptables</b> commands which are not otherwise covered by the device's firewall framework. The commands are executed after each firewall restart, right after the default rule set has been loaded.
  −
  −
The figure below is an example of the Custom rules tab:
  −
  −
[[File:Networking_rutos_manual_firewall_custom_rules.png|border|class=tlt-border]]
  −
  −
The rules added here are saved in the <b>/etc/firewall.user</b> file. Feel free to edit that file instead for the same effect in case you don't have access to the device's WebUI.
  −
  −
The <b>Save</b> button restarts the firewall service. Thus, adding the custom rules specified in this section to the device's list of firewall rules.
  −
  −
The <b>Reset</b> button resets the custom rules field to its default state.
      
==Attack Prevention==
 
==Attack Prevention==
Line 766: Line 764:  
     <tr>
 
     <tr>
 
       <td>Enable ICMP limit</td>
 
       <td>Enable ICMP limit</td>
−
       <td>off | on; default: <b>no</b></td>
+
       <td>off | <span style="color: #1550bf;">on</span>; default: <b>off</b></td>
 
       <td>Turns ICMP echo-request limit in selected period on or off.</td>
 
       <td>Turns ICMP echo-request limit in selected period on or off.</td>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
−
     <td>Limit period</td>
+
     <td><span style="color: #1550bf;">Limit period</span></td>
 
         <td>Second | Minute | Hour | Day; default: <b>Second</b></td>
 
         <td>Second | Minute | Hour | Day; default: <b>Second</b></td>
 
       <td>Period length for matching the conditions of the rule.</td>
 
       <td>Period length for matching the conditions of the rule.</td>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
−
     <td>Limit</td>
+
     <td><span style="color: #1550bf;">Limit</span></td>
 
         <td>integer; default: <b>5</b></td>
 
         <td>integer; default: <b>5</b></td>
 
         <td>Maximum ICMP echo-request number during the period.</td>
 
         <td>Maximum ICMP echo-request number during the period.</td>
 
     </tr>
 
     </tr>
 
     <tr>
 
     <tr>
−
     <td>Limit burst</td>
+
     <td><span style="color: #1550bf;">Limit burst</span></td>
 
         <td>integer; default: <b>10</b></td>
 
         <td>integer; default: <b>10</b></td>
 
         <td>Indicates the maximum burst before the above limit kicks in.</td>
 
         <td>Indicates the maximum burst before the above limit kicks in.</td>
Line 944: Line 942:  
     </tr>
 
     </tr>
 
</table>
 
</table>
−
{{#ifeq: {{{series}}} | RUTX |
  −
==Helpers==
     −
The <b>Helpers</b> section provides you with the possibility to add firewall exceptions for some VoIP protocols, namely SIP and H.323. In other words, these functions provide a pass-through for VoIP communications between the device's LAN and WAN.
+
==Custom Rules==
 +
 
 +
The <b>Custom rules</b> tab provides you with the possibility to execute <b>iptables</b> commands which are not otherwise covered by the device's firewall framework. The commands are executed after each firewall restart, right after the default rule set has been loaded.
 +
 
 +
The figure below is an example of the Custom rules tab:
   −
<b>Technical explanation:</b>
+
[[File:Networking_rutos_manual_firewall_custom_rules.png|border|class=tlt-border]]
   −
FTP, SIP and H.323 protocols are harder to filter by firewalls since they violate layering by introducing OSI layer 3/4 parameters in the OSI layer 7. NAT helpers are modules that are able to assist the firewall in tracking these protocols. These helpers create the so-called expectations that can be used to open necessary ports for RELATED connections. For example, FTP, GRE and PPTP helpers are enabled by default.
+
The rules added here are saved in the <b>/etc/firewall.user</b> file. Feel free to edit that file instead for the same effect in case you don't have access to the device's WebUI.
   −
[[File:Networking_rutos_manual_firewall_helpers_nat_helpers.png|border|class=tlt-border]]
+
The <b>Save</b> button restarts the firewall service. Thus, adding the custom rules specified in this section to the device's list of firewall rules.
 +
 
 +
The <b>Reset</b> button resets the custom rules field to its default state.
   −
<table class="nd-mantable">
  −
    <tr>
  −
        <th>Field</th>
  −
      <th>Value</th>
  −
      <th>Description</th>
  −
    </tr>
  −
    <tr>
  −
      <td>H323</td>
  −
      <td>off <nowiki>|</nowiki> on; default: <b>off</b></td>
  −
      <td>Turns H323 filtering on or off.</td>
  −
    </tr>
  −
    <tr>
  −
      <td>SIP</td>
  −
      <td>off <nowiki>|</nowiki> on; default: <b>off</b></td>
  −
      <td>Turns SIP filtering on or off.</td>
  −
    </tr>
  −
</table>
  −
|}}
   
[[Category:{{{name}}} Network section]]
 
[[Category:{{{name}}} Network section]]
Retrieved from "https://wiki.teltonika-networks.com/view/Special:MobileDiff/73751...83020"

Navigation menu