Skip to main content

Firewall Guide

Introduction​

When connecting a network to the Internet or any untrusted network, a router with Firewall functionality can be used to protect against undesired access to your local network and devices. This is done by applying rules to different parts/hooks of the path through which packets flow. These hooks are prerouting, input, forward, and postrouting and can be seen in Figure 2. Figure 1 shows an example of a basic network using a Firewall to protect its local devices.

                           .--.-.
                          ( (    )__
                         (_,  \ ) ,_)  Internet/Intranet
                           '-'--`--'
                              |  WAN (vlan4)                        ^
                          .---+----.                                |
                          |        |                              Public
                    +-----+ GW/FW  +-----+                        ------
                    |  .99|        |.99  |                        Private
LAN (vlan1)         |     '----+---'     |      LAN (vlan2)         |
192.168.1.0/24      |          |.99      |      192.168.2.0/24      V
           ----+----+          |         +----+----
               |.1             |              |.1
             .-+--.            |            .-+--.
             | H2 |            |            | H3 |
             '----'            |            '----'
                               |
                           ----+---- WEB (vlan3)
                               |.1   192.168.3.0/24
                             .-+--.
                             | H1 |
                             '----'

Figure 1: Showing an example network setup using a Firewall. In the case of this example, the Firewall can be set up to allow all private subnets (vlan1, vlan2, vlan3) to communicate with each other and with the Gateway itself, while blocking external traffic from e.g. the Internet.

tip

A real configuration of the example in Figure 1 can be seen on the Firewall HowTo page.

Overview​

The WeOS Firewall supports the following types of functionality:

  • Input Filtering
  • Forward Filtering
  • Prerouting Filtering
  • NAT (Network Address Translation)
  • Port Forwarding
  • ALG Helpers
note

For products of software level Extended, all of the above mentioned functions are available. For products of software level Standard, only input filtering is available.

  • Prerouting Filtering: The prerouting filtering support is used to classify and modify traffic before the routing decision (see Figure 2). In WeOS, prerouting filtering currently supports only DSCP mangling, allowing packets to be marked with a DSCP value for QoS handling further along the forwarding path.

  • Input Filtering: The input filtering support is primarily used to control accessibility to services on the device itself. Input rules are checked after the routing decision (see Figure 2) and apply to packets that are directed to the local device and processes running on the device itself. An input filtering rule is configured to either drop or accept a packet.

  • Forward Filtering: The forward filtering support is primarily used to control what traffic is allowed to be routed to connected devices. Forwarding rules are checked after the routing decision (see Figure 2) and apply to packets that are not directed to the local device. A forward filtering rule is configured to either drop or accept a packet.

  • NAT (Network Address Translation): NAPT (Network Address Port Translation) is the most common NAT form. It allows a common (public) IP address to be shared by a set of hosts on a private network. NAT rules are checked during the postrouting as seen in Figure 2. This form of NAT is sometimes referred to as IP Masquerading or PAT (Port Address Translation).

note

IPsec traffic is exempted from being subjected to NAT unless it is packaged in NAT-traversing UDP packets.

  • Port Forwarding: Port forwarding allows a service (such as a Web server) located on a private network to be made accessible from another public network. This is done by mapping a public IP address and public port number to a private IP address and a corresponding private port number. Traffic designated for the public IP and the specified public port will be redirected to the private IP and its specified port. Port forwarding rules are checked during prerouting as shown in Figure 2.
                 prerouting ---Port Forwarding---
                     |
                     v
            .-----------------.
            | Routing decision|
            '---+---------+---'
                |         |
                v         v
              input    forward
                |         |
             <--'         |
local device              |
             ---.         |
                |         |
                v         |
     .----------------.   |
     |Routing decision|   |
     '----------------'   |
                |         |
                '---. .---'
                     |
                     v
                postrouting ---NAT---

Figure 2: Representation of the different hooks where Firewall rules apply.

  • ALG Helpers: The WeOS firewall utilises connection tracking; a filter rule allowing traffic to pass through the firewall in one direction will implicitly allow traffic of established connections (and traffic of related connections) to also pass in the reverse direction. Connection tracking can be configured to handle more complex protocols by enabling ALG helpers a.k.a. Application Level Gateway helpers. Some network protocols are more complex and therefore more difficult than others to be handled by the connection tracking function in a firewall or NAT device. An example is FTP, which utilises one port (often 21) as a control channel to exchange commands and another random port as a data channel for actual file transfers. To enable a PC to download files through a firewall from an FTP server on the Internet, the firewall must inspect the FTP control connection to learn which connections to let through. To make the firewall handle such protocols correctly, protocol-specific ALG helpers can be enabled. ALG helpers have some impact on the unit’s routing performance and are therefore disabled by default.

Order of Firewall Rules​

Configured firewall rules have an order. For input, forward, NAT, and port-forward rules, packets are evaluated against the rules in order and the first matching rule will decide how to treat the packet. For prerouting DSCP rules, all matching rules are evaluated in order and the last matching rule determines the final DSCP value applied to the packet.

Configuration​

The Firewall configuration is a sub-context to the IP configuration context in the CLI:

example:/#> configure
example:/config/#> ip
example:/config/ip/#> firewall
example:/config/ip/firewall#>

By default the firewall is disabled. The command enable can be used to enable the firewall.

warning

It is vitally important to configure the firewall correctly before enabling it. Failing to do so can get you permanently locked out. For example, if you are managing the firewall through SSH, HTTP or HTTPS, you will not be able to reach the device if you enable the firewall without first explicitly allowing the management traffic in question.

To prevent lockout, you have to specify an input rule for your management interface. The following example enables HTTP on vlan1:

example:/config/ip/firewall#> input accept in vlan1 dport http proto tcp

In Figure 1, this rule would enable devices on the LAN to access the web interface of the Gateway over HTTP. More examples can be seen in the Firewall HowTo page.

note

Offloaded traffic is not subject to firewall processing, and the number of tracked connections is limited to 4096.

Syntax​

[no] prerouting dscp VALUE [pos POSITION] [in IFACE] [saddr ADDR[/LEN]] [sport PORT|RANGE] [daddr ADDR[/LEN]] [dport PORT|RANGE] [proto PROTO] [bind-counter COUNTER] [counter] [comment COMMENT] [log]

Description

Manage prerouting rules.

Create or delete a prerouting rule. Prerouting rules apply to all incoming and forwarded packets.

Options

OptionDescription
no

Delete specified rule.

dscp VALUE

A DSCP value (0 - 63) to be assigned to packets matching configured criteria.

pos POSITION

The position in the list of rules you want to apply your command to.

in IFACE

Inbound Interface: The interface where the packet comes in.

saddr

Source IP Address/Subnet: The source IP address of the packet.

sport

Source Port: The source port of the packet.

daddr

Destination IP Address/Subnet: The destination address of the packet.

dport

Destination Port: The destination port of the packet.

ADDR[/LEN]

IP address specified as either a single IP address, or a whole IP subnet.

PORT|RANGE

Port specified as either a single port, or a range of ports.

proto PROTO

Protocol: The protocol type of the IP payload. Can be specified as a well-known protocol name (e.g. tcp, udp, icmp, gre, esp, ah, ospf, vrrp, sctp) or as an IANA protocol number (1–255). Use a protocol name or number when filtering traffic that does not use TCP or UDP ports, such as GRE tunnels (47) or OSPF (89). For a full list of IANA protocol numbers see https://www.iana.org/assignments/protocol-numbers/.

Common protocol numbers:

NumberName
1icmp
6tcp
17udp
47gre
50esp
51ah
89ospf
112vrrp/carp
132sctp
bind-counter COUNTER

Assigns the rule to COUNTER.

counter

Add a counter that only shows in the raw output. This counter is reset any time the firewall configuration is changed.

comment COMMENT

Add a comment to the rule.

log

Log traffic matching this rule.

[no] input accept|drop [pos POSITION] [in IFACE] [saddr ADDR[/LEN]] [sport PORT|RANGE] [daddr ADDR[/LEN]] [dport PORT|RANGE] [proto PROTO] [bind-counter COUNTER] [counter] [comment COMMENT] [log]

Description

Manage input rules.

Create or delete an input rule. Input rules are checked after the routing decision and apply to packets that are directed to the local device and processes running on the device itself.

Options

OptionDescription
no

Delete specified rule.

accept|drop

Accept or drop traffic matching the specified rule.

pos POSITION

The position in the list of rules you want to apply your command to.

in IFACE

Inbound Interface: The interface where the packet comes in.

saddr

Source IP Address/Subnet: The source IP address of the packet.

sport

Source Port: The source port of the packet.

daddr

Destination IP Address/Subnet: The destination address of the packet.

dport

Destination Port: The destination port of the packet.

ADDR[/LEN]

IP address specified as either a single IP address, or a whole IP subnet.

PORT|RANGE

Port specified as either a single port, or a range of ports.

proto PROTO

Protocol: The protocol type of the IP payload. Can be specified as a well-known protocol name (e.g. tcp, udp, icmp, gre, esp, ah, ospf, vrrp, sctp) or as an IANA protocol number (1–255). Use a protocol name or number when filtering traffic that does not use TCP or UDP ports, such as GRE tunnels (47) or OSPF (89). For a full list of IANA protocol numbers see https://www.iana.org/assignments/protocol-numbers/.

Common protocol numbers:

NumberName
1icmp
6tcp
17udp
47gre
50esp
51ah
89ospf
112vrrp/carp
132sctp
bind-counter COUNTER

Assigns the rule to COUNTER.

counter

Add a counter that only shows in the raw output. This counter is reset any time the firewall configuration is changed.

comment COMMENT

Add a comment to the rule.

log

Log traffic matching this rule.

[no] forward accept|drop [pos POSITION] [in IFACE] [out IFACE] [saddr ADDR[/LEN]] [sport PORT|RANGE] [daddr ADDR[/LEN]] [dport PORT|RANGE] [proto PROTO] [bind-counter COUNTER] [counter] [comment COMMENT] [log]

Description

Manage forward rules.

Create or delete a forward rule. Forward rules are checked after the routing decision and apply to packets that are not directed to the local device.

Options

OptionDescription
no

Delete specified rule.

accept|drop

Accept or drop traffic matching the specified rule.

pos POSITION

The position in the list of rules you want to apply your command to.

in IFACE

Inbound Interface: The interface where the packet comes in.

out IFACE

Outbound Interface: The interface where the packet is sent out.

saddr

Source IP Address/Subnet: The source IP address of the packet.

sport

Source Port: The source port of the packet.

daddr

Destination IP Address/Subnet: The destination address of the packet.

dport

Destination Port: The destination port of the packet.

ADDR[/LEN]

IP address specified as either a single IP address, or a whole IP subnet.

PORT|RANGE

Port specified as either a single port, or a range of ports.

proto PROTO

Protocol: The protocol type of the IP payload. Can be specified as a well-known protocol name (e.g. tcp, udp, icmp, gre, esp, ah, ospf, vrrp, sctp) or as an IANA protocol number (1–255). Use a protocol name or number when filtering traffic that does not use TCP or UDP ports, such as GRE tunnels (47) or OSPF (89). For a full list of IANA protocol numbers see https://www.iana.org/assignments/protocol-numbers/.

Common protocol numbers:

NumberName
1icmp
6tcp
17udp
47gre
50esp
51ah
89ospf
112vrrp/carp
132sctp
bind-counter COUNTER

Assigns the rule to COUNTER.

counter

Add a counter that only shows in the raw output. This counter is reset any time the firewall configuration is changed.

comment COMMENT

Add a comment to the rule.

log

Log traffic matching this rule.

[no] nat [pos POSITION] out IFACE [saddr ADDR[/LEN]] [comment COMMENT] [log]

Description

Manage Network Address Translation rules.

Create or delete a NAT rule of NAPT type. NAPT is also known as IP masquerading, NAT overload and many-to-one NAT.

NAT can be used to hide private subnets behind a single public IP.

Options

OptionDescription
no

Delete specified rule.

pos POSITION

The position in the list of rules you want to apply your command to.

IFACE

The outbound interface used for NAPT. Outgoing packets handled by this rule will appear to originate from the IP number configured (the primary address) or acquired (DHCP) for this interface.

ADDR[/LEN]

Specify that packets must originate from a specific subnet for this rule to apply.

comment COMMENT

Add a comment to the rule.

log

Log traffic matching this rule.

[no] port-forward [pos POSITION] [in IFACE] [daddr ADDR[/LEN]] dport PORT|RANGE [to-dport PORT] to-daddr ADDR proto PROTO [comment COMMENT] [log]

Description

Manage port forwarding rules.

Create or delete a Port Forwarding rule. Port Forwarding can be used to expose an internal device to the Internet.

Options

OptionDescription
no

Delete specified rule.

pos POSITION

The position in the list of rules you want to apply your command to.

in IFACE

Inbound Interface: The interface where the packet comes in.

daddr

Destination IP Address/Subnet: The destination IP address of the packet.

dport

Destination Port: The destination port of the packet.

to-daddr

Forward Destination IP Address/Subnet: The destination address where the packets are to be forwarded.

to-dport

Forward Destination Port: The destination port where the packets are to be forwarded.

ADDR[/LEN]

IP address specified as either a single IP address, or a whole IP subnet.

PORT|RANGE

Port specified as either a single port, or a range of ports.

proto PROTO

Protocol: The protocol type of the IP payload.

comment COMMENT

Add a comment to the rule.

log

Log traffic matching this rule.

policy forward|input drop|accept

Description

Set default filter policy.

Options

OptionDescription
forward|input

Specify which hook to apply the policy to.

drop|accept

Specify which policy to apply.

move input|forward|nat|port-forward id ID pos NEW-ID

Description

Reorder rules.

Change the order of existing rules.

Options

OptionDescription
input|forward|nat|port-forward

Specify from which rule set to move.

ID

ID of the rule to move.

NEW-ID

New ID of the rule to move.

counter NAME [reset]

Description

Show or modify counters.

Options

OptionDescription
NAME

Create a new named counter called NAME.

reset

Reset the counter NAME.

[no] log [limit none | ENTRIES/second|minute|hour|day ]

Description

Handle logging for the firewall.

This command is used to globally enable or disable firewall logging and set a limitation on the maximum rate of entries that will be stored. Note that you need to add the "log" flag on individual rules as well.

Options

OptionDescription
no

Globally disable logging.

none

No rate limitation for logging. Be warned that no limit may open for denial-of-service attacks!

ENTRIES

Number of entries to be logged in the specified time unit. Should be in the range 1-10000.

second|minute|hour|day

Time unit for the rate limit. The lowest possible rate is 2/day.

[no] log input|forward|nat|port-forward NUM

Description

Toggle logging flag on an existing firewall rule.

Options

OptionDescription
no

Disable logging for the specified rule.

input|forward|nat|port-forward

The type of the specified rule.

NUM

The specified rule number.

[no] alg ftp|tftp [PORT]

Description

Application Level Gateway (NAT) helpers.

Options

OptionDescription
ftp|tftp

Specify what helper should be enabled.

PORT

Specify port for control channel. If not specified, default values will be 21 for FTP and 69 for TFTP.

show

Description

Show all rules.

Firewall Configuration Overview​

In order to see the current rules for the Firewall, the following command can be used:

example:/config/ip/firewall/#> show
Firewall is enabled.
Logging is Enabled, limited to 99 entries/hour
____________________________________________________________________
Prerouting Rules
Pos  Rule                                                           
001 prerouting dscp 53 in vlan1 saddr 10.0.2.0/24
002 prerouting dscp 46 in

____________________________________________________________________
Input Rules
Pos  Rule                                                           
001 input accept saddr 10.0.2.0/24
002 input accept in vlan1
N/A drop

____________________________________________________________________
Forward Rules
Pos  Rule                                                           
001 forward accept in vlan1 out vlan2
002 forward accept in vlan2 daddr 192.168.3.1/32 dport 80 proto tcp
N/A drop

____________________________________________________________________
NAT Rules (NAPT/masquerading)
Pos  Rule                                                           
N/A ipsec out accept
    "IPsec-NAT-exempt-policy"
001 nat out vlan2

____________________________________________________________________
Port-Forward Rules
Pos  Rule                                                           
001 port-forward in vlan2 dport 80 to-daddr 192.168.3.1 proto tcp

____________________________________________________________________
Application Level Gateway
Alg Helper                                                          
FTP  ENABLED  PORT 2222
TFTP ENABLED  PORT 69

Advanced: The command show ip firewall raw can be used in admin-exec mode to show the complete Linux nftables (NFT) ruleset, which contains the rules added in the WeOS firewall.

Counters​

There are two types of counters available: temporary inline counters and named counters.

Temporary inline counters​

Temporary inline counters are mainly intended for temporary debugging; see the section on named counters for more information about runtime-persistent counters. The inline counters are only visible in the raw firewall output and are reset every time the firewall configuration changes.

example:/config/ip/firewall/#> input accept dport 22 proto tcp counter
example:/#> show ip firewall raw
...
tcp dport ssh counter packets 10 bytes 443 accept comment "cli-input-009"
...

Named counters​

A named counter can be created and bound to one or more firewall rules. A named counter can be bound to input or forward rules. A named counter is persistent during runtime.

Example of a counter that counts all inbound web interface traffic:

example:/config/ip/firewall/#> counter web
example:/config/ip/firewall/#> input accept dport 80 proto tcp bind-counter web
example:/config/ip/firewall/#> input accept dport 443 proto tcp bind-counter web

example:/#> show ip firewall counter web
Users                                                               
001 input accept dport 80 proto tcp bind-counter web
002 input accept dport 443 proto tcp bind-counter web

Value                                                               
packets 26 bytes 1560

Status of Firewall Rules​

The show ip firewall command in admin-exec can be used to show the status of the applied firewall rules, and the output looks identical to the output in the configuration context.

The following keywords can be used in combination with the show ip firewall command:

  • counters: show detailed information about the counters.
  • conntrack: show information about the active network connections.
example:/#> show ip firewall conntrack
[DESTROY] udp      17 src=169.254.159.156 dst=239.255.255.250 sport=1900 dport=1900 [UNREPLIED] src=239.255.255.250 dst=169.254.159.156 sport=1900 dport=1900
[DESTROY] udp      17 src=198.18.1.1 dst=239.255.255.250 sport=1900 dport=1900 [UNREPLIED] src=239.255.255.250 dst=198.18.1.1 sport=1900 dport=1900
 [UPDATE] tcp      6 432000 ESTABLISHED src=198.18.1.99 dst=198.18.1.1 sport=36934 dport=22 src=198.18.1.1 dst=198.18.1.99 sport=22 dport=36934 [ASSURED] mark=0 use=1
 [UPDATE] unknown  2 510 src=198.18.1.1 dst=224.0.0.1 [UNREPLIED] src=224.0.0.1 dst=198.18.1.1 mark=0 use=1