Overview

Readers will learn how to create firewall rules that protect the router and the Local Area Network (LAN) from the outside. The rules that are manually created using this article can also be automatically created by running the Basic Setup wizard.

NOTES & REQUIREMENTS: Applicable to the latest EdgeOS firmware on all EdgeRouter models. Please see the Related Articles below for more information.   Device used in this article: EdgeRouter-4 (ER-4)

Table of Contents

1. Network Diagram
2. Adding Firewall Rules
3. Related Articles

Network Diagram

Back to Top

The network topology is shown below:

Firewall policies are used to allow traffic in one direction and block it in another direction.

Adding Firewall Rules

Back to Top

The EdgeRouter uses a stateful firewall, which means the router firewall rules can match on different connection states. The traffic states that can be matched on are:

• new The incoming packets are from a new connection.
• established The incoming packets are associated with an already existing connection.
• related The incoming packets are new, but associated with an already existing connection.
• invalid The incoming packets do not match any of the other states.

Using these states, the router can accept/drop traffic in different directions depending on the connection states. For example, the router block all traffic from WAN to LAN, unless it is return traffic associated with a already existing connection. The Basic Setup wizard in EdgeOS adds the following firewall rules to the router:

• WAN_INMatches on established/related and invalid traffic that is passed through the router (WAN to LAN).
• WAN_LOCALMatches on established/related and invalid traffic that is destined for the router itself (WAN to LOCAL).

Follow the steps below to manually create these firewall policies using either the GUI or the Command Line Interface (CLI).

GUI: Access the Graphical User Interface (GUI).

1. Navigate to the Firewall/NAT tab

2. Add a WAN_IN firewall policy and set the default action to drop.

Firewall/NAT > Firewall Policies > + Add Ruleset

Name: WAN_IN
Description: WAN to internal
Default action: Drop

2. Add two firewall rules to the newly created firewall policy.

Firewall/NAT > Firewall Policies > WAN_IN > Actions > Edit Ruleset > + Add New Rule

Description: Allow established/related
Action: Accept
Protocol: All protocols
Advanced > State: Established / Related

Firewall/NAT > Firewall Policies > WAN_IN > Actions > Edit Ruleset > + Add New Rule

Description: Drop invalid state
Action: Drop
Protocol: All protocols
Advanced > State: Invalid

3. Attach the firewall policy to the WAN interface in the inbound direction.

Firewall/NAT > Firewall Policies > WAN_IN > Actions > Interfaces

Interface: eth0
Direction: in

4. Add a WAN_LOCAL firewall policy and set the default action to drop.

Firewall/NAT > Firewall Policies > + Add Ruleset

Name: WAN_LOCAL
Description: WAN to router
Default action: Drop

5. Add two firewall rules to the newly created firewall policy.

Firewall/NAT > Firewall Policies > WAN_LOCAL > Actions > Edit Ruleset > + Add New Rule

Description: Allow established/related
Action: Accept
Protocol: All protocols
Advanced > State: Established / Related

Firewall/NAT > Firewall Policies > WAN_LOCAL > Actions > Edit Ruleset > + Add New Rule

Description: Drop invalid state
Action: Drop
Protocol: All protocols
Advanced > State: Invalid

6. Attach the firewall policy to the WAN interface in the local direction.

Firewall/NAT > Firewall Policies > WAN_LOCAL > Actions > Interfaces

Interface: eth0
Direction: local

NOTE: EdgeRouter firewall policies only become active when they are attached to an interface + direction.

CLI: Access the command line interface (CLI). You can do this using the CLI button in the GUI or by using a program such as PuTTY.

1. Enter configuration mode.

configure

2. Configure the WAN_IN firewall policy.

set firewall name WAN_IN default-action drop
set firewall name WAN_IN description 'WAN to internal'

set firewall name WAN_IN rule 10 action accept
set firewall name WAN_IN rule 10 description 'Allow established/related'
set firewall name WAN_IN rule 10 state established enable
set firewall name WAN_IN rule 10 state related enable

set firewall name WAN_IN rule 20 action drop
set firewall name WAN_IN rule 20 description 'Drop invalid state'
set firewall name WAN_IN rule 20 state invalid enable

3. Configure the WAN_LOCAL firewall policy.

set firewall name WAN_LOCAL default-action drop
set firewall name WAN_LOCAL description 'WAN to router'

set firewall name WAN_LOCAL rule 10 action accept
set firewall name WAN_LOCAL rule 10 description 'Allow established/related'
set firewall name WAN_LOCAL rule 10 state established enable
set firewall name WAN_LOCAL rule 10 state related enable

set firewall name WAN_LOCAL rule 20 action drop
set firewall name WAN_LOCAL rule 20 description 'Drop invalid state'
set firewall name WAN_LOCAL rule 20 state invalid enable

4. Attach the firewall policies to the WAN interface in the inbound and local direction.

set interfaces ethernet eth0 firewall in name WAN_IN
set interfaces ethernet eth0 firewall local name WAN_LOCAL

NOTE: EdgeRouter firewall policies only become active when they are attached to an interface + direction.

5. Commit the changes and save the configuration.

commit ; save

Related Articles

Back to Top

Intro to Networking - How to Establish a Connection Using SSH

Intro to Networking - Network Firewall Security