Firewall rules - what am I missing?

bittwiddler
Full Member

Posts: 39

Firewall rules - what am I missing? May 2, 2019 22:09:24 GMT

Quote

Post by bittwiddler on May 2, 2019 22:09:24 GMT

I have a rule where I block traffic on my DMZ interface to all interfaces but WAN. I am testing it by running the command "ping google.com" from the DMZ network.

I see in the firewall log that the destination for the ping command is listed as "den02s01-in-f14.1e100.net" (a Google server) which should be routed through WAN (my service provider). My destination in the rule is "! WAN address". Am I misunderstanding this rule?

I may run wireshark or fiddler to see what is happening with the rule disabled but I wanted to run it past the smart crowd first to be sure I was not missing anything.

Thoughts?

            Proto    Source    Port    Destination        Port    Description
BLOCK   TCP      DMZ net *    ! WAN address    *       Block DMZ traffic to all but WAN
PASS    TCP       DMZ net *       WAN address      *       Permit DMZ to only WAN

--
bT

Software developer, IoT security architect, maker of smoke

Lee Sharp
Administrator

Posts: 522

Firewall rules - what am I missing? May 2, 2019 23:44:58 GMT

Quote

Post by Lee Sharp on May 2, 2019 23:44:58 GMT

That is not the proper way to do it. You are allowing access to the WAN address, not the Internet. You need a block rule at the top for your local networks and an allow all similar to the default rule after. Here is an example at a client... Note that the first 4 lines are bloick rules. Only the last line is pass.

Proto Source Port Destination Port Description
* * * LAN net * Block LAN Access
* * * LAN2 net * Block LAN2 Access
* * * Storage net * Block Storage Access
TCP/UDP WiFi net * * 25 (SMTP 25) Block Outbound email
* WiFi net * * * Default WiFI -> any

Last Edit: May 2, 2019 23:45:49 GMT by Lee Sharp

bittwiddler
Full Member

Posts: 39

Firewall rules - what am I missing? May 3, 2019 0:03:03 GMT

Quote

Post by bittwiddler on May 3, 2019 0:03:03 GMT

Thanks Lee.

I usually use the same approach. E.G. block all networks and then a default allow any rule. I was hoping the !WAN rule would create a shortcut but doesn't work as I had hoped. Even the following does not block all non-WAN networks and then allow any.

Proto Source Port Destination Port Description
BLOCK TCP DMZ net * ! WAN address * Block DMZ traffic to all but WAN
PASS TCP DMZ net * * * Default DMZ to any

It is probably better (in my case) to list each blocked network explicitly but it can get lengthy!

--
bT

Software developer, IoT security architect, maker of smoke

Lee Sharp Administrator Posts: 522	Firewall rules - what am I missing? May 3, 2019 0:17:20 GMT Quote Select Post Deselect Post Link to Post Member Give Gift Back to Top Post by Lee Sharp on May 3, 2019 0:17:20 GMT WAN Address is the single IP address of the firewall on the WAN port. The rules you have works, but not as you intend.

bittwiddler
Full Member

Posts: 39

Firewall rules - what am I missing? May 3, 2019 17:01:30 GMT

Quote

Post by bittwiddler on May 3, 2019 17:01:30 GMT

If memory serves, ipchains (OK, I am dating myself here) had a method of creating an alias which represented one or more networks (back then classes but think CIDR now). Not that I am pining for for the days of ipchains.... ;-)

--
bT

Software developer, IoT security architect, maker of smoke

SmallWall

Firewall rules - what am I missing?

Post by bittwiddler on May 2, 2019 22:09:24 GMT

Post by Lee Sharp on May 2, 2019 23:44:58 GMT

Post by bittwiddler on May 3, 2019 0:03:03 GMT

Post by Lee Sharp on May 3, 2019 0:17:20 GMT

Post by bittwiddler on May 3, 2019 17:01:30 GMT

Quick Reply