Skip to main content

Firewall HowTo

Introduction​

This document covers common Firewall use cases and step-by-step configuration examples using WeOS.

For more information, see the Firewall Configuration Guide.

Private Network With Web Server​

Figure 1 shows a common network setup. Two LAN subnets and a WEB subnet are connected through a gateway and Firewall to the Internet. The following example shows how the Firewall can be configured to allow devices on both LANs to communicate with each other, access Gateway services, and connect to the web server. Devices on the Internet should also be able to access the web server, while all other traffic is dropped.

Desired outcome:

  • All private subnets can communicate with each other.
  • All private subnets can access Gateway services such as DHCP.
  • The web server is accessible by the LANs and Internet.
  • All other external traffic is dropped.
                           .--.-.
                          ( (    )__
                         (_,  \ ) ,_)  Internet/Intranet
                           '-'--`--'
                              |  WAN (vlan4)                        ^
                          .---+----.                                |
                          |        |                              Public
                    +-----+ GW/FW  +-----+                        ------
                    |  .99|        |.99  |                        Private
LAN (vlan1)         |     '----+---'     |      LAN (vlan2)         |
192.168.1.0/24      |          |.99      |      192.168.2.0/24      V
           ----+----+          |         +----+----
               |.1             |              |.1
             .-+--.            |            .-+--.
             | H2 |            |            | H3 |
             '----'            |            '----'
                               |
                           ----+---- WEB (vlan3)
                               |.1   192.168.3.0/24
                             .-+--.
                             | H1 |
                             '----'

Figure 1: Showing the example network setup using a Firewall. 

example:/#> configure
example:/config/#> ip
example:/config/ip/#> firewall
example:/config/ip/firewall/#> policy input drop
example:/config/ip/firewall/#> policy forward drop
example:/config/ip/firewall/#> forward accept in vlan1
example:/config/ip/firewall/#> forward accept in vlan2
example:/config/ip/firewall/#> forward accept in vlan3
example:/config/ip/firewall/#> input accept in vlan1
example:/config/ip/firewall/#> input accept in vlan2
example:/config/ip/firewall/#> input accept in vlan3
example:/config/ip/firewall/#> port-forward in vlan4 dport 80 to-daddr 192.168.3.1
to-dport 8080 proto tcp
example:/config/ip/firewall/#> forward accept in vlan4 daddr 192.168.3.1 dport 8080 proto tcp
example:/config/ip/firewall/#> leave
Configuration activated.  Remember "copy run start" to save to flash (NVRAM).
example:/#> copy run start

Example Input Rules​

When enabling the Firewall, all incoming packets will be blocked unless the policy for input filters is changed from drop to accept or individual accept rules are created for each service.

note

If you do not allow any management access (SSH, HTTP, HTTPS) on any interface, you will not be able to reach the device after enabling the Firewall. Be careful and do not lock yourself out!

Allow SSH access only on vlan1​

example:/config/ip/firewall/#> input accept in vlan1 dport ssh proto tcp

Allow HTTP access on any interface​

example:/config/ip/firewall/#> input accept dport http proto tcp

Allow HTTPS access only on vlan1​

example:/config/ip/firewall/#> input accept in vlan1 dport https proto tcp

Allow DNS access (tcp, port 53) on any interface​

example:/config/ip/firewall/#> input accept dport 53 proto tcp

Allow DNS access (udp, port 53) on any interface​

example:/config/ip/firewall/#> input accept dport 53 proto udp

Allow DHCP access on any interface (udp, port 67)​

example:/config/ip/firewall/#> input accept dport 67 proto udp

Allow NTP on any interface (udp, port 123)​

example:/config/ip/firewall/#> input accept dport 123 proto udp

Allow ping (ICMP) only on vlan2​

example:/config/ip/firewall/#> input accept in vlan2 proto icmp

Allow traceroute on any interface​

example:/config/ip/firewall/#> input accept proto udp dport 33434-33534

Allow TFTP only on vlan1 (udp, port 69)​

example:/config/ip/firewall/#> input accept in vlan1 dport 69 proto udp

Allow SNMP access on vlan1 (udp, port range 161-162)​

example:/config/ip/firewall/#> input accept in vlan1 dport 161-162 proto udp

Allow VRRP on interface vrrp1​

example:/config/ip/firewall/#> input accept in vrrp1 proto vrrp

Allow OSPF on interface vlan1​

example:/config/ip/firewall/#> input accept in vlan1 proto ospf

In a similar way, other services can be reached by accepting the following protocol/port numbers:

  • Modbus - tcp, port 502
  • MlkII - udp, port 60000
  • RIP - udp, port 520
  • Telnet - tcp, port 23
  • FTP - tcp, port 20-21 (not supported through NAT)

More port numbers can be found on Wikipedia.

Example Forward Rules​

Forward rules control what traffic is allowed to pass through the device between interfaces. When the default forward policy is drop, explicit accept rules must be created for each desired traffic flow.

Allow all traffic from vlan1 to vlan2​

example:/config/ip/firewall/#> forward accept in vlan1 out vlan2

Allow traffic from vlan1 to a specific host on vlan2​

example:/config/ip/firewall/#> forward accept in vlan1 out vlan2 daddr 192.168.2.10/32

Allow HTTP and HTTPS traffic from vlan1 to vlan3​

example:/config/ip/firewall/#> forward accept in vlan1 out vlan3 dport 80 proto tcp
example:/config/ip/firewall/#> forward accept in vlan1 out vlan3 dport 443 proto tcp

Allow traffic from a private subnet to the WAN interface​

example:/config/ip/firewall/#> forward accept in vlan1 out vlan4 saddr 192.168.1.0/24

Drop traffic from a specific host regardless of destination​

example:/config/ip/firewall/#> forward drop saddr 192.168.1.50/32

Example Prerouting Rules​

Prerouting rules are evaluated before the routing decision. In WeOS, prerouting supports DSCP mangling, so packets can be marked with a DSCP value to influence QoS treatment along the forwarding path.

Mark all traffic arriving on vlan1 with DSCP 46 (Expedited Forwarding)​

example:/config/ip/firewall/#> prerouting dscp 46 in vlan1

Mark HTTP traffic from vlan2 with DSCP 10 (AF11)​

example:/config/ip/firewall/#> prerouting dscp 10 in vlan2 dport 80 proto tcp

Mark traffic destined for a specific host with DSCP 34 (AF41)​

example:/config/ip/firewall/#> prerouting dscp 34 daddr 10.0.0.1/32

Example NAT Rules​

NAT (NAPT/masquerading) rules allow hosts on a private subnet to share a single public IP address on an outbound interface. NAT rules apply during postrouting.

Enable masquerading on the WAN interface (vlan4)​

example:/config/ip/firewall/#> nat out vlan4

Enable masquerading on the WAN interface for a specific source subnet only​

example:/config/ip/firewall/#> nat out vlan4 saddr 192.168.1.0/24

Enable masquerading for multiple private subnets on the WAN interface​

example:/config/ip/firewall/#> nat out vlan4 saddr 192.168.1.0/24
example:/config/ip/firewall/#> nat out vlan4 saddr 192.168.2.0/24

Example Port Forward Rules​

Port forwarding allows a service on a private host to be reached from an external network by mapping an external port on the gateway to an internal address and port. Port forwarding rules apply during prerouting and typically require a corresponding forward rule to allow the redirected traffic through.

Forward incoming HTTP (port 80) on vlan4 to an internal web server​

example:/config/ip/firewall/#> port-forward in vlan4 dport 80 to-daddr 192.168.3.1 proto tcp
example:/config/ip/firewall/#> forward accept in vlan4 daddr 192.168.3.1 dport 80 proto tcp

Forward a non-standard external port to an internal service port​

example:/config/ip/firewall/#> port-forward in vlan4 dport 2222 to-daddr 192.168.1.10 to-dport 22 proto tcp
example:/config/ip/firewall/#> forward accept in vlan4 daddr 192.168.1.10 dport 22 proto tcp

Forward a port range to an internal device​

example:/config/ip/firewall/#> port-forward in vlan4 dport 5000-5010 to-daddr 192.168.2.20 proto udp
example:/config/ip/firewall/#> forward accept in vlan4 daddr 192.168.2.20 dport 5000-5010 proto udp

Example of ALG Helpers​

This is an example of how a D-2 device can access files on a TFTP/FTP server running TFTP over the default port 69 and FTP over a custom port 2222. The device D-1 is acting as a firewall.

┌──────────┐       ┌──────────┐       ┌──────────┐
│    D-1   │       │    D-2   │       │    D-3   │
│ TFTP/FTP │       │    FW    │       │  CLIENT  │
│    SRV   │       │          │       │          │
│      eth1├───────┤eth1  eth2├───────┤eth1      │
└──────────┘       └──────────┘       └──────────┘
             vlan21             vlan20

Part of the firewall configuration on D-1:

FW:/config/#> ip firewall
FW:/config/ip/firewall/#> policy forward drop
FW:/config/ip/firewall/#> forward accept in vlan20 out vlan21 dport 2222 proto tcp
FW:/config/ip/firewall/#> forward accept in vlan20 out vlan21 dport 69 proto udp
FW:/config/ip/firewall/#> alg ftp 2222
FW:/config/ip/firewall/#> alg tftp
FW:/config/ip/firewall/#> show

____________________________________________________________________
Forward Rules
ID  Rule                                                            
001 forward accept in vlan20 out vlan21 dport 2222 proto tcp
002 forward accept in vlan20 out vlan21 dport 69 proto udp
N/A drop

____________________________________________________________________
Application Level Gateway
Alg Helper                                                          
FTP  ENABLED  PORT 2222
TFTP ENABLED  PORT 69