Overview
Readers will learn how to create firewall rules that protect the router and the Local Area Network (LAN). The rules that are manually created using this article can also be automatically created by running the Basic Setup wizard.
NOTES & REQUIREMENTS:
Applicable to the latest EdgeOS firmware on all EdgeRouter models. Please see the Related Articles below for more information.
Device used in this article:
|
Adding Firewall Rules
Firewall policies are used to allow traffic in one direction and block it in another direction.
The EdgeRouter uses a stateful firewall, which means the router firewall rules can match on different connection states. The traffic states are:
new
The incoming packets are from a new connection.established
The incoming packets are associated with an already existing connection.related
The incoming packets are new, but associated with an already existing connection.invalid
The incoming packets do not match any of the other states.
Using these firewall states, the router can accept/drop traffic in different directions depending on the state of the connection. For example, the router can block all traffic from WAN to LAN, unless it is return traffic associated with a already existing connection. The Basic Setup wizard in EdgeOS adds the following firewall rules to the router:
WAN_IN
Matches on established/related and invalid traffic that is passed through the router (WAN to LAN).WAN_LOCAL
Matches on established/related and invalid traffic that is destined for the router itself (WAN to LOCAL).
Follow the steps below to manually create the firewall policies from the Basic Setup wizard:
GUI: Access the EdgeRouter Web UI.
|
1. Navigate to the Firewall/NAT tab.
2. Add a WAN_IN firewall policy and set the default action to drop.
Firewall/NAT > Firewall Policies > + Add Ruleset
Name: WAN_IN
Description: WAN to internal
Default action: Drop
2. Add two firewall rules to the newly created firewall policy.
Firewall/NAT > Firewall Policies > WAN_IN > Actions > Edit Ruleset > + Add New Rule
Description: Allow established/related
Action: Accept
Protocol: All protocols
Advanced > State: Established / Related
Firewall/NAT > Firewall Policies > WAN_IN > Actions > Edit Ruleset > + Add New Rule
Description: Drop invalid state
Action: Drop
Protocol: All protocols
Advanced > State: Invalid
3. Attach the firewall policy to the WAN interface in the inbound direction.
Firewall/NAT > Firewall Policies > WAN_IN > Actions > Interfaces
Interface: eth0
Direction: in
4. Add a WAN_LOCAL firewall policy and set the default action to drop.
Firewall/NAT > Firewall Policies > + Add Ruleset
Name: WAN_LOCAL
Description: WAN to router
Default action: Drop
5. Add two firewall rules to the newly created firewall policy.
Firewall/NAT > Firewall Policies > WAN_LOCAL > Actions > Edit Ruleset > + Add New Rule
Description: Allow established/related
Action: Accept
Protocol: All protocols
Advanced > State: Established / Related
Firewall/NAT > Firewall Policies > WAN_LOCAL > Actions > Edit Ruleset > + Add New Rule
Description: Drop invalid state
Action: Drop
Protocol: All protocols
Advanced > State: Invalid
6. Attach the firewall policy to the WAN interface in the local direction.
Firewall/NAT > Firewall Policies > WAN_LOCAL > Actions > Interfaces
Interface: eth0
Direction: local
NOTE: EdgeRouter firewall policies only become active when they are attached to an interface + direction.
|
The above configuration can also be set using the CLI:
CLI: Access the Command Line Interface. You can do this using the CLI button in the GUI or by using a program such as PuTTY.
|
1. Enter configuration mode.
configure
2. Configure the WAN_IN firewall policy.
set firewall name WAN_IN default-action drop
set firewall name WAN_IN description 'WAN to internal'
set firewall name WAN_IN rule 10 action accept
set firewall name WAN_IN rule 10 description 'Allow established/related'
set firewall name WAN_IN rule 10 state established enable
set firewall name WAN_IN rule 10 state related enable
set firewall name WAN_IN rule 20 action drop
set firewall name WAN_IN rule 20 description 'Drop invalid state'
set firewall name WAN_IN rule 20 state invalid enable
3. Configure the WAN_LOCAL firewall policy.
set firewall name WAN_LOCAL default-action drop
set firewall name WAN_LOCAL description 'WAN to router'
set firewall name WAN_LOCAL rule 10 action accept
set firewall name WAN_LOCAL rule 10 description 'Allow established/related'
set firewall name WAN_LOCAL rule 10 state established enable
set firewall name WAN_LOCAL rule 10 state related enable
set firewall name WAN_LOCAL rule 20 action drop
set firewall name WAN_LOCAL rule 20 description 'Drop invalid state'
set firewall name WAN_LOCAL rule 20 state invalid enable
4. Attach the firewall policies to the WAN interface in the inbound and local direction.
set interfaces ethernet eth0 firewall in name WAN_IN
set interfaces ethernet eth0 firewall local name WAN_LOCAL
NOTE: EdgeRouter firewall policies only become active when they are attached to an interface + direction.
|
5. Commit the changes and save the configuration.
commit ; save
Related Articles
EdgeRouter - How to Create a Guest\LAN Firewall Rule
Intro to Networking - Network Firewall Security
Intro to Networking - How to Establish a Connection Using SSH