Skip to main content

Firewall

Principle of Operation

One of the main means of traffic management on the server is a firewall. It helps to limit user traffic:

  • From LANs to external ones via the server.
  • Between different LANs of the server.
  • To the SafeUTM server.

The principle of operation for a firewall is as follows: it analyzes headers of packets passing through the server interfaces. This low-level task is solved by a gateway based on the TCP/IP protocol stack. This is why a firewall is well-suited for determining global traffic management rules for network protocols, ports, belonging to certain IP networks, and other criteria based on values of fields in network packet headers.

The firewall is not designated to solve problems related to controlling access to the internet resources based on URL address, domain name or website content type. These higher-level tasks usually related to web traffic are solved with the help of Content Filtering module.

Firewall is configured in the web interface section Traffic Rules -> Firewall.

SafeUTM has pre-configured and automatically enabled system rules. They provide protection for proxy and reverse proxy, mail server services, and others. As a rule, it is not necessary to additionally configure protection for the SafeUTM server with the help of user-defined rules. Use them to filter LAN traffic and publish resources. Even when the user firewall is disabled in the web interface, system rules continue to work.

In case incorrect rules have been created (for example, access to SafeUTM web interface has been prohibited), you can disable the user firewall from the local server menu. To do this, select Disable Useruser's Firewallfirewall, enter 8 and press Enter.
1. Firewall.png

Automatic SNAT

NAT (Network Address Translation) is a mechanism in TCP/IP networks that allows you to convert IP addresses of transit packets. Read more.

The Automatic LANlocal SNAT setting enables the automatic translation of the address for traffic going to the external interface in the firewall if the source is 10.0.0.0/8, 172.16.0.0/12 192.168.0.0/16 and addresses that are registered in the SNAT tab if the SNAT Action is selected . This way you don't have to create such rules manually and change them when you add or change local networks.
2. Firewall.png

Disable this setting if there is a need for access from external networks (for example, DMZ) to SafeUTM LAN without NAT.

You can create SNAT rules manually for those who need it and disable it (by “"Not SNAT”SNAT" rule) for those who need to be allowed into the network without network address translation.

Firewall Tables

Rules in the table have the priority from top to bottom (i.e., the upper rule has priority over the lower one).
Before creating rules for networks, IP addresses or IP address ranges, first create them in the Objects section.

For the convenience of rule management, they are divided into four tables:

  • FORWARD – rules in this table apply to traffic passing between the server interfaces, (i.e., the internet and LAN, as well as between LANs). This is the main table to which rules that restrict user traffic can be added.
  • DNAT (port redirection) – the rules of this table are used to redirect ports from the external interface to certain resources in LAN. Such rules are often called port forwarding rules (port forwarding, portmapper).
  • INPUT – a table for rules of incoming traffic to the server interfaces. As a rule, it is traffic for server services (for example, a mail server).
  • SNAT – a table of rules for managing the translation of network addresses.

It is strongly NOT recommended creating a FORWARD or INPUT rule that blocks all traffic.

Protocols

When creating a rule, you need to select the data transfer protocol that the rule you are creating will apply to. If you select Any from the list of options, the rule will apply to all traffic.
3. Firewall.png

Descriptions of each protocol from the list
  • UDP - It is one of the simplest transport layer protocols of the OSI model. Does not guarantee packet delivery. This allows for a much more quick and efficient delivery of data for apps that require high bandwidth or a short data delivery time.
  • TCP - Performs the functions of a transport layer protocol of the OSI model. Unlike UDP, TCP guarantees packet delivery.
  • ICMP - It is mainly used to transmit error messages and other exceptions that occur during data transmission.
  • GRE - This protocol is used to encapsulate the network layer packets of the OSI model into IP packets. Number of the protocol in IP – 47. It is mainly used when creating VPN (Virtual Private Network).
  • AH - A protocol protecting transmitted data in IPsec. Provides identification, integrity check and protection from information reproduction.
  • ESP - A protocol protecting transmitted data in IPsec. Provides identification, integrity check and protection from information reproduction. Unlike AH protocol, ESP encrypts data. When working with ESP, both end systems use a common key to encrypt data.

Creating Firewall Rules

To create rules in the desired table, click the Add button in the upper left corner of the screen.

Specify the required parameters and actions for the rule and click the Save button. The rule will be added to the end of the list. If necessary, change its priority with the buttons.

When creating rules for filtering web traffic from local networks (80, 443 TCP ports), the Any object must be specified in the Incoming interface field for the rule to work properly. If a different incoming interface is specified, the rule will not process web traffic.

Firewall Rules

By default, ALLOW policy is used. If you do not create prohibiting rules, all ports and protocols for users will be allowed.

Firewall rules parameters:

  • Protocol - Data transfer protocol (UDP/TCP/ICMP/GRE/ESP/AH or Any)
  • Source - IP address of the source (src) of traffic passing through the gateway. IP addresses, IP address ranges, networks or domains can be specified in the field. Data is taken from Objects specified by the user. Users and groups can also be used as a source (when changing their IP addresses, the firewall will automatically take it into account).
  • Destination port - Specified when creating a rule with TCP/UDP protocols. It can be a single port, a list of ports, or a range of ports defined in Objects.
  • InboundIncoming interface - UTM interface that traffic will come in to.
  • OutboundOutgoing interface - UTM interface that traffic will come out of.
  • DurationTime of action - The duration period of the rule. Time intervals (for example, working hours) are specified, that are defined in Objects.
Action - Allows or prohibits traffic. Comment - Any text explaining the purpose of the rule. Maximum 255 characters. Action - Allows or prohibits traffic.
Actions

The values of Action parameter:

  • ProhibitDeny - Prohibits traffic
  • Allow - Allows traffic
  • DNAT - Translates destination addresses, thus redirecting inbound traffic. Below in the field Change destination IP address you can specify one IP address or range (when specifying a range of IP addresses, the packet will be redirected to any of them). Similarly, if you specify TCP or UDP when creating the rule, the field Change destination port will appear. With this feature you can transparently redirect inbound traffic to another address or port.
  • Don't use DNAT - Cancels DNAT for traffic meeting the rule criteria.
SNAT - Translates source addresses DisableDon't use SNAT - Cancels SNAT for traffic meeting the rule criteria. Disable DNAT - Cancels DNAT for traffic meeting the rule criteria.

Examples of Rules and Techniques

Port mapping, DNAT, server publishing in LAN

Examples of these settings are described in detail in the corresponding articles in Publishing Resources section.

Blocking various resources by means of firewall

Issues of blocking various resources – remote control software (AmmyAdmin and TeamViewer), messengers and other software are described in Blocking Popular Resources section.

Mass blocking of IP addresses and networks

1. You need to create a list for blocking in a text file:

  • The file name must be named manual_blocklist.txt .
  • Only one IP address or one network should be specified in one line.
  • IP address format: 1.2.3.4
  • Network format: 1.2.3.0/24

    4. Firewall.png

2. Move file manual_blocklist.txt to catalog /var/opt/ideco/firewall-backend directory/
3. In SafeUTM terminal, run command ideco-apply-manual-blocklist

After restarting SafeUTM, IP addresses and networks from the file will be blocked automatically (you don't need to execute command ideco-apply-manual-blocklist additionally). When updating SafeUTM, the list of blockings will be saved.

If you need to add addresses to the blocked list, add the addresses to file /var/opt/ideco/firewall-backend/manual_blocklist.txt and re-execute command ideco- apply-manual-blocklist.

To remove addresses from the blocked list, delete the necessary addresses from file /var/opt/ideco/firewall-backend/manual_blocklist.txt and execute command ideco-apply-manual-blocklist

Access to the terminal server for a specific user

1. In the Forward tab, click Add
2. Fill in the following fields:

  • Protocol - select TCP
  • Source - select a user or user group
  • DestinationsDestination - specify the address of the terminal server
  • Destination ports - specify port 3389
  • Action - Allow
    5. Firewall.png

3. Click Save.