Endian banner

The Network Menu

The network menu can be used to tweak the networking configuration by adding specific hosts and routes, or configuring the uplink and adding VLANs. This menu should not be confused with the Network configuration wizard available at Menubar ‣ System ‣ Network Configuration, that allows to configure interfaces, zones, and to define uplinks, although many settings and configuration options, especially in the Interfaces menu item are the same found there.

The sub-menu on the left-hand side of the screen contains these items, each of which groups several configuration options:

  • Edit hosts - define hosts for local domain name resolution.

  • Routing - set up static routes and policy routing.

  • Interfaces - edit the uplinks or create VLANs.

Edit hosts

The page contains the list of hosts previously defined. Each line contains an IP address, the associated hostname, and the domain name, if specified. Two available actions are available for each entry: To edit it edit or to delete it. delete

Warning

Deleting an host entry by clicking on the small delete icon does not require any confirmation and is not reversible. If deleted by mistake, an entry must be re-added manually.

A new entry in the file can be added by clicking on the Add a host link right above the table. A simple form will replace the table, in which to enter the following options:

IP address

The IP address of the remote host.

Hostname

The hostname associated to the IP address.

Domain name

An optional domain name.

Note

Unlike in the /etc/hosts file (see below), each IP address added here corresponds to one hostname and viceversa. To add two hostnames to a same IP, add two entries with the same IP address.

The choice can be confirmed by clicking on the Add Host button. To associate more hostnames to the same IP address, repeat the procedure by inserting the same IP address but a different name.

Hosts management, dnsmasq and /etc/hosts.

The dnsmasq application is used in small networks as DNS server for local hosts and as a DNS forwarder and caching server for worldwide DNS servers. The Endian UTM Edge Appliance uses dnsmasq to be able to correctly resolve and answer DNS requests coming from the GREEN, ORANGE, and BLUE zones. It is sometimes desirable (e.g., for testing purposes on a remote website) to override some entries in dnsmasq, or to add some local server to dnsmasq’s cache, for local clients to be able to connect to it.

The hosts added in this page are stored in a dnsmasq’s settings file and merged with the /etc/hosts file at every restart of the daemon. Host added to that files directly via CLI will not persist after a reboot of the Endian UTM Edge Appliance or a restart of dnsmasq.

The /etc/hosts file contains the so-called static lookup table, in the form:

IP1  hostname1  [hostname2]
IP2  hostname3  [hostname4] [hostname5]

Here, IP1 and IP2 are unique (numerical) IP addresses and hostname1, hostname2, hostname3,`hostname4`, and hostname5 are custom names given to those IPs. Names within square brackets are optional: In other words, each IP address can be associated with one or more names of known hosts. Custom host entries can be added to the file, that will then be resolved for all the clients connecting through the Endian UTM Edge Appliance. On a typical Endian UTM Edge Appliance, the /etc/hosts file contains at least the following entries:

127.0.0.1     localhost.localhost localhost
172.20.0.21   myappliance.localdomain myappliance
172.20.0.21   spam.spam spam
172.20.0.21   ham.ham      ham
172.20.0.21   wpad.localdomain wpad

Here, 127.0.0.1 is the IP address of the loopback device, localhost, which is a mandatory entry for the correct workink of any Linux system; while 172.20.0.21 is the IP address of the GREEN interface. The entries listed for that IP have the following meaning and purposes:

myappliance.localdomain

The hostname and domainname of the Endian UTM Edge Appliance, as set up during the Network configuration.

spam.spam spam and ham.ham ham

These two entries combined are used for the training of the spamassassin e-mail filter.

wpad.localdomain wpad

A facility for some browsers to detect and apply proxy settings automatically without the user’s interaction when the prosy is not transparent.

Routing

Besides the default routing table, that can be seen in Menubar ‣ Status ‣ Network status, the routing on the Endian UTM Edge Appliance can be improved with static and policy routing rules. This page displays a unique table that contains all the custom routings, although new rules are added from the two different tabs that present on this page. Indeed, static and policy routing rules require slight different settings. The table contains a summary of the rule: the source and destination networks or zones, the gateway, a remark, and the list of available actions: Enable or disable, edit, and delete a rule.

Whenever a modification is carried out on the routing table, it is required that the changes be saved and the service be restarted.

Static routing

A static route allows to associate specific source and destination networks with a given gateway or uplink. A click on the Add a new route link above the table allows create new routes by defining the following fields in the form that will appear:

Source Network

The source network, in CIDR notation.

Destination Network

The destination network, in CIDR notation.

Route Via

Four options are available to define through which means should the traffic be channeled: Static Gateway, Uplink, OpenVPN User, or L2TP User. In the case the Static Gateway is selected, the IP address of a gateway should be provided in the text box on the right. Otherwise, a drop-down will appear, proposing the choice among the available uplinks, OpenVPN users, or L2TP users.

Enabled

A ticked checkbox means that the rule is enabled (default). If unchecked, then the rule is only created but not activated: It can always be enabled later.

Remark

A remark or comment to explain the purpose of this rule.

A click on one of the icons will trigger an action on the respective item:

  • on off - toggle the status of the item, enabled or disabled.

  • edit - modify the item’s property.

  • delete - remove the item

Policy routing

A policy route rule allows to associate specific network addresses, zones, or services (expressed as port and protocol) with a given uplink.

The table shows all the already defined rules for both static and policy routing, with some of their properties: Source, Destination, TOS, Gateway, Service, Remark, and the available actions:

  • up down - move a rule

  • on off - toggle the status of the item, enabled or disabled.

  • edit - modify the item’s property.

  • delete - remove the item

Hint

The TOS column appears only if at least one rule with that field has been defined.

Rules that appear higher in the table have higher priority.

Policy routing, HTTP proxy, and uplink.

The interaction between these three components of the Endian UTM Edge Appliance might produce some behaviour that may appear strange or even wrong when clients in the zones try to access the Internet. There are indeed three steps to highlight, for a correct understanding how traffic flows to the Internet when both HTTP proxy is enabled and there are policy routing rules defined:

  1. An HTTP proxy uses the main uplink (i.e., it accesses the RED zone and the Internet using the main uplink).

  2. An HTTP proxy “breaks” a connection from a client to a remote server in two connections: One from the client to the Endian UTM Edge Appliance and one from the Endian UTM Edge Appliance to the remote server.

  3. Policy routing rules are taken into account after the traffic goes through the HTTP proxy.

When clicking on the Create a policy routing rule link, a form will open, which seems rather more complicated then the one for static routes and very similar to the firewall rule’s editor. However, this policy rule editor is much like the previous one, but gives more control over the definition of the rule. Additionally, the setup of the rule is guided by several drop-down menus, to simplify entering the data in the following fields:

Source

The first drop-down menu allows to choose the source of the traffic. More entries, one per line, are accepted, but all must belong to the same type, either: A zone or interface, OpenVPN or L2TP users, IPs or networks, or MAC addresses. Depending on the choice, different values shall be supplied. To apply the rule to all sources, select <ANY>.

Destination

The second drop-down menu permits the choice of the destination of the traffic, in form of a list of IPs, networks, OpenVPN or L2TP users. Again, by selecting <ANY> the rule will match every destination.

Service/Port

The next two drop-down menus allow to specify the service, protocol, and a destination port for the rule when the TCP, UDP, or TCP + UDP protocols are selected. Some predefined combinations service/protocol/port exists, like HTTP/TCP/80, <ALL>/TCP+UDP/0:65535, or <ANY>, which is a shortcut for all services, protocols, and ports. User defined permits to specify a custom protocol and the ports to block, an option that proves useful when running services on ports different from the standard ones.

Protocol

The type of traffic that is interested by the rule: TCP, UDP, TCP+UDP, ESP, GRE, and ICMP. TCP and UDP are the most used, GRE is used by tunnels, ESP by IPsec, and ICMP by the ping and traceroute commands.

Route Via

How the traffic should be routed for this rule. Four options are available:

  1. Static gateway: In this case an IP Address shall be provided

  2. Uplink: The uplink that should be used for this rule. There is the option, when the uplink becomes unavailable, that the routing be carried over to the backup link corresponding to the selected uplink. This option is enabled when the checkbox next to the drop-down menu is ticked.

  3. OpenVPN user: An OpenVPN user, choosen from those available in the drop-down menu.

  4. L2TP user: An L2TP user, choosen from those available in the drop-down menu.

Type Of Service

The type of service (TOS) can be chosen here. Four values can be chosen, depending on what is the most important charactertic of the traffic interested by that rule: default, lowdelay, reliability, or throughput.

Remark

A remark or comment to explain the purpose of this rule.

Position

The position in which to insert the rule (relative position in the list of rules).

Enabled

Tick this checkbox to enable the rule (default). If unchecked, the rule is created but not active: A rule can be enabled later.

Log all accepted packets

This checkbox must be ticked to log all the packets affected by this rule.

Warning

The activation of this option may cause the size of the log files to dramatically improve.

Interfaces

The uplinks manager allows to carry out a number of tasks that are related with the uplink and the interfaces, and in particular to define custom VLANs on the network interfaces.

VLANs

The idea behind offering VLAN support in Endian UTM Edge Appliance is to allow arbitrary associations of VLAN IDs to the zones and to provide an additional level of separation (and therefore adding another level of security) between the zones. The existing VLANS are shown in the table, if any had already been created. The only action available is:

  • delete - remove the VLAN. A pop-up window will open, that requires a confirmation for the deletion.

A new VLAN can be defined by clicking on the Add new VLAN hyperlink above the VLAN list. In the form that will open a few click suffice to create an association between an interface and a VLAN, by specifying a few values:

Interface

The physical interface to which the VLAN is connected to. Only the available interfaces can be chosen from the drop-down menu. The menu also shows the status of the link of the interface.

VLAN ID

The VLAN ID, which must be an integer number between 0 and 4095.

Zone

The zone to which the VLAN is associated with. Only the zones that have been defined in the network configuration wizard can be selected. The option “NONE” can be chosen, if that interface is used as a High Availability management port.

Warning

It is not possible to define a VLAN that serves one zone (e.g., a VLAN on BLUE) on an interface that already serves another zone (e.g., eth1 serving GREEN). When trying to do so, the form closes and a red callout appears, informing that the VLAN can not be created.

Whenever a virtual LAN is created, a new interface is created and named as ethX.y where X is the number of the interface and y is the VLAN ID. This interface is then assigned to the chosen zone and will show up as a regular interface in the various sections that report network information, like Menubar ‣ Status ‣ Network Configuration or in the Dashboard, where it can be selected to be drawn in the graph.

Table Of Contents

Previous topic

The Status Menu

Next topic

The Services Menu

Documentation archive (Endian UTM)

Version 2.5
Version 2.4
Version 2.3
Version 2.2
Version 2.1

Other products

Endian 4i Edge 3.0
Endian UTM 3.0