Select Firewall from the menu bar at the top of the screen.
This section allows setting up the rules that specify if and how IP traffic flows through your Endian UTM Appliance. Following is a list of links that appear in the submenu on the left side of the screen:
Each of these subsections will be explained individually in the following chapters.
Select Firewall from the menu bar at the top of the screen, then select Port forwarding / NAT from the submenu on the left side of the screen.
Changed in version 2.3.
Destination NAT is usually used to allow limited network access from an untrusted network or to map certain ports to another address. It is possible to define which port on which interface should be forwarded to a given host and port.
Click the Create Rule button to confirm your rule. You can then disable/enable, edit or delete each rule from the list by clicking on the appropriate icon on the right side of the table (see the icon legend at the bottom).
After making changes or additions to your rule set, do not forget to click the Apply button on the top of the screen!
Warning
When selecting IP, OpenVPN User or Load balancing as the Translate to Type you must keep in mind that the ports will not be mapped 1:1 but a round robin balancing is performed. Therefore mapping destination ports 137:139 to destination ports 137:139 will result in these ports being used randomly. Leave the translation Port/Range field empty in this case!
Note
The Map network translation statically maps a whole network of addresses onto another network of addresses. This can be useful for companies whose subsidiaries all use the same internal network. In this case all these networks can be connected to each other through network mapping.
An example would be:
original network 1: 192.168.0.0/24
mapped network 1: 192.168.1.0/24
original network 2: 192.168.0.0/24
mapped network 2: 192.168.1.1/24
In this section you can define to which outgoing connections source network address translation (Source NAT) should be applied. Source NAT can be useful if a server behind your Endian UTM Appliance has its own external IP and outgoing packets should therefore not use the RED IP address of the firewall. Adding Source NAT rules is similar to adding port forwarding rules. The following options are available:
Here you can choose whether you want to apply Source NAT or not. If you choose to use source network address translation you can select the IP address that should be used. The Auto entries will automatically choose the IP address depending on the outgoing interface.
New in version 2.3.
When choosing the MAP Network option here all IPs from the source subnet will be statically mapped to another network of the same size.
In certain cases you may want to explicitly declare that no Source NAT should be performed, e.g. if a server in your DMZ is configured with an external IP and you do not want its outgoing connections to have your RED IP as source.
To save the rule just click on the Save button.
Configuring an SMTP server running on IP 123.123.123.123 (assuming that 123.123.123.123 is an additional IP address of your uplink) in the DMZ with source NAT:
New in version 2.3.
With this module you can redirect traffic that has been routed through your Endian UTM Appliance. This is very useful if you have more than one external IP address and want to use some of them in your DMZ without having to use NAT.
Click the Create Rule button to confirm your rule. You can then disable/enable, edit or delete each rule from the list by clicking on the appropriate icon on the right side of the table (see the icon legend at the bottom).
After making changes or additions to your rule set, do not forget to click the Apply button on the top of the screen!
Select Firewall from the menu bar at the top of the screen, then select Outgoing traffic from the submenu on the left side of the screen. Endian UTM Appliance comes with a preconfigured set of rules, that allow outgoing traffic (i.e. “internet access”) from the GREEN zone with regard to the most common services (HTTP, HTTPS, FTP, SMTP, POP, IMAP, POP3s, IMAPs, DNS, ping). All other services are blocked by default.
Likewise, access to HTTP, HTTPS, DNS and ping is allowed from the BLUE zone (WLAN) while only DNS and ping are allowed from the ORANGE zone (DMZ).
Everything else is forbidden by default.
In this section you can disable/enable, edit or delete rules by clicking on the appropriate icon on the right side of the table (see the icon legend at the bottom). You can also add your own rules by clicking on the Add a new firewall rule link at the top. Please consider that the order of rules is important: the first matching rule decides whether a packet is allowed or denied, no matter how many matching rules might follow. You can change the order of rules using the arrow down/up icons next to each rule.
A rule is defined by the following parameters:
After making changes to a rule, do not forget to click the Apply button on the top of the list!
At the bottom of the page you can also find the rules that are set automatically by Endian UTM Appliance depending on your configuration. It is possible to disable or enable the whole outgoing firewall by using the Enable Outgoing firewall toggle. When disabled, all outgoing traffic is allowed (not recommended).
Select Firewall from the menu bar at the top of the screen, then select Inter-Zone traffic from the submenu on the left side of the screen.
This section allows you to set up rules that determine how traffic can flow between the different network zones, excluding the RED zone. Endian UTM Appliance comes with a simple set of preconfigured rules: traffic is allowed from the GREEN zone to any other zone (ORANGE and BLUE) and traffic is allowed within each zone.
Everything else is forbidden by default.
Analogous to the outgoing traffic firewall you can disable/enable, edit or delete rules by clicking on the appropriate icon on the right side of the table. You can also add your own rules by clicking on the Add a new inter-zone firewall rule link at the top. Please see the preceding section (Outgoing traffic) for details about handling firewall rules.
The inter-zone firewall can be disabled/enabled as a whole using the Enable Inter-Zone firewall toggle. When disabled, all traffic is allowed between all zones other than the RED zone (not recommended).
Select Firewall from the menu bar at the top of the screen, then select VPN traffic from the submenu on the left side of the screen.
The VPN traffic firewall allows to add firewall rules applied to hosts that are connected via VPN.
The VPN traffic firewall is normally not active, which means traffic can flow freely between the VPN hosts and hosts in the GREEN zone and VPN hosts can access all other zones. Please note that VPN hosts are not subject to the outgoing traffic firewall or the Inter-Zone traffic firewall. If you need to limit access from or to VPN hosts you need to use the VPN traffic firewall.
The handling of the rules is identical to the outgoing traffic firewall. Please refer to the Outgoing traffic section in this chapter for details about handling firewall rules.
Select Firewall from the menu bar at the top of the screen, then select System access from the submenu on the left side of the screen.
In this section you can set up rules that grant or deny access to the Endian UTM Appliance itself.
There is a list of preconfigured rules that cannot be changed. This is to guarantee the proper working of the firewall, since these rules are automatically created as they are required by the services the firewall provides. Click on the >> button labeled “Show rules of system services” to show these rules.
Click on the Add a new system access rule link to add your own custom rules here. The following parameters describe the rule:
Click the Add button to confirm your rule. You can then disable/enable, edit or delete each rule from the list of rules by clicking on the appropriate icon on the right side of the table (see the icon legend at the bottom).
After making changes or additions to your rule set, do not forget to click the Apply button on the top of the list!
On this page you can find a list of all firewall modules. For each of the modules a diagram has been created for better understanding.
By clicking on a diagram a bigger version will appear.
Enter search terms or a module, class or function name.