46

|

Chapter 4:

Firewall Protection and Content Filtering

ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN FVS336Gv2 Reference Manual

DNS so that external users can always find your network (see

“Configuring Dynamic DNS

(Optional)”

on page 26).

•

If the IP address of the local server PC is assigned by DHCP, it may change when the PC

is rebooted. To avoid this, use the Reserved IP address feature to keep the PC’s IP

address constant (see <pdf>“Configuring DHCP Address Reservation” on page 3-37).

•

Local PCs must access the local server using the server’s local LAN address. Attempts

by local PCs to access the server using the external WAN IP address will fail.

Note:

See

“Configuring Port Triggering”

on page 66 for yet another way to

allow certain types of inbound traffic that would otherwise be blocked

by the VPN firewall.

Table 4-4.

Inbound Rules

Item

Description

Service

Select the desired service or application to be covered by this rule. If the desired

service or application does not appear in the table, you must define it using the

Services screen (see

“Adding Customized Services”

on page 57).

Action

Select the desired action for packets covered by this rule:

•

BLOCK always

•

BLOCK by schedule, otherwise Allow

•

ALLOW always

•

ALLOW by schedule, otherwise Block

Note

: Any inbound traffic which is not allowed by rules you create will be blocked

by the Default rule.

Select Schedule

Select the desired time schedule (Schedule1, Schedule2, or Schedule3) that will

be used by this rule (see

“Setting a Schedule to Block or Allow Specific Traffic”

on page 61).

•

This drop-down list gets activated only when “BLOCK by schedule,

otherwise Allow” or “ALLOW by schedule, otherwise Block” is selected as

Action.

•

Use schedule screen to configure the time schedules.

Send to LAN Server

This field appears only with NAT routing (not classical routing). This LAN

address or range of LAN addresses determines which computer or computers

on your network are hosting this service rule. (You can also translate these

addresses to a port number.)

Translate to Port

Number

Check this box and enter a port number to assign the LAN Server to a different

service port number. Inbound traffic to the service port will have the destination

port number modified to the port number configured here.

WAN Destination IP

Address

Specifies the destination IP address applicable to incoming traffic.

This is the public IP address that will map to the internal LAN server; it can either

be the address of the WAN1 or WAN2 ports or another public IP address

.

Chapter 4:

Firewall Protection and Content Filtering

|

47

ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN FVS336Gv2 Reference Manual

Note:

Some residential broadband ISP accounts do not allow you to run

any server processes (such as a Web or FTP server) from your

location. Your ISP may periodically check for servers and may

suspend your account if it discovers any active services at your

location. If you are unsure, refer to your ISP Acceptable Use Policy.

Remember that allowing inbound services opens holes in your VPN firewall. Enable only

those ports that are necessary for your network. We also recommend enabling the server’s

application security and configuring user password or privilege levels, if provided.

LAN users

This field appears only with NAT routing (not classical routing). Specifies which

computers on your network are affected by this rule. Select the desired options:

•

Any – All PCs and devices on your LAN.

•

Single address – Enter the required address and the rule will be applied to

that particular PC.

•

Address range – If this option is selected, you must enter the start and finish

fields.

•

Groups – Select the Group to which this rule will apply. Use the LAN Groups

screen (under Network Configuration) to assign PCs to Groups. See

“Managing Groups and Hosts (LAN Groups)”

on page 34.

WAN Users

Specifies which Internet locations are covered by the rule, based on their IP

addresses. Select the desired option:

•

Any – All Internet IP address are covered by this rule.

•

Single address – Enter the required address in the start field.

•

Address range – If this option is selected, you must enter the start and end

fields.

Log

Specifies whether packets covered by this rule are logged. Select the desired

action:

•

Always – Always log traffic considered by this rule, whether it matches or

not. This is useful when debugging your rules.

•

Never – Never log traffic considered by this rule, whether it matches or not.

Bandwidth Profile

Bandwidth Limiting determines the way in which the data is sent to/from your

host. The purpose of bandwidth limiting is to provide a solution for limiting the

outgoing/incoming traffic, thus preventing the LAN users for consuming all the

bandwidth of our Internet link. Bandwidth Limiting for outbound traffic is done on

the available WAN interface in the single port and Auto-Failover modes. The

limiting is done on the user-specified interface in Load Balancing mode. The

bandwidth limiting for inbound traffic is done on the LAN interface for all WAN

modes. See

“Creating Bandwidth Profiles”

on page 59.

Table 4-4.

Inbound Rules (Continued)

Item

Description

48

|

Chapter 4:

Firewall Protection and Content Filtering

ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN FVS336Gv2 Reference Manual

Viewing the Rules

To view the firewall rules: Select Security > Firewall from the menu. The LAN WAN Rules

screen is displayed. The following figure shows some examples:

Order of Precedence for Rules

As you define new rules, they are added to the tables in the LAN WAN Rules screen as the

last item in the table, as shown in the previous example,

Viewing the Rules

. For any traffic

attempting to pass through the VPN firewall, the packet information is subjected to the rules

in the order shown in the

Outbound Services

and

Inbound Services

rules tables, beginning

at the top and proceeding to the bottom, before applying the default rule. In some cases, the

order of precedence of two or more rules may be important in determining the disposition of a

packet. For example, you should place the most strict rules at the top (those with the most

specific services or addresses). The

Up

and

Down

buttons allow you to relocate a defined

rule to a new position in the table.

Setting the Default Outbound Policy

The Default Outbound Policy is to allow all traffic to the Internet to pass through. Firewall

rules can then be applied to block specific types of traffic from going out from the LAN to the

Internet (Outbound). The default policy of Allow Always can be changed to block all outbound

traffic which then allows you to enable only specific services to pass through the VPN firewall.

To change the default outbound policy, follow these steps:

1.

Go to the LAN WAN Rules screen, shown in the previous example,

Viewing the Rules

.

2.

Change the

Default Outbound Policy

by selecting

Block Always

from the drop-down

list.

3.

Click

Apply

.

Chapter 4:

Firewall Protection and Content Filtering

|

49

ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN FVS336Gv2 Reference Manual

Creating a LAN WAN Outbound Services Rule

An outbound rule will block or allow the selected application from an internal IP LAN address

to an external WAN IP address according to the schedule created on the Schedule screen.

You can also tailor these rules to your specific needs (see

“Administrator Tips”

on page 69).

Note:

This feature is for advanced administrators only! Incorrect

configuration will cause serious problems.

To create a new outbound service rule in the LAN WAN Rules screen:

1.

Click

Add

under the

Outbound Services

table. The Add LAN WAN Outbound Service

screen is displayed.

2.

Configure the parameters based on the descriptions in .

3.

Click

Apply

to save your changes and reset the fields on this screen. The new rule will

be listed on the Outbound Services table.

Creating a LAN WAN Inbound Services Rule

This

Inbound Services

table lists all existing rules for inbound traffic. If you have not defined

any rules, no rules will be listed. By default, all inbound traffic is blocked. Remember that

allowing inbound services opens holes in your VPN firewall. Only enable those ports that are

necessary for your network.

50

|

Chapter 4:

Firewall Protection and Content Filtering

ProSafe Dual WAN Gigabit Firewall with SSL & IPsec VPN FVS336Gv2 Reference Manual

To create a new inbound service rule in the LAN WAN Rules screen:

1.

Click

Add

under the

Inbound Services

table to display the Add LAN WAN Inbound

Service screen.

2.

Configure the parameters based on the descriptions in

Table 4-4 on page 46

.

3.

Click

Apply

to save your changes and reset the fields on this screen. The new rule will

be listed in the

Inbound Services

table.

Modifying Rules

To make changes to an existing outbound or inbound service rule on the the LAN WAN Rules

screen, in the Action column to the right of to the rule, click on of the following table buttons:

•

edit

.

Allows you to make any changes to the rule definition of an existing rule. Depending

on your selection, either the Edit LAN WAN Outbound Service screen or Edit LAN WAN

Inbound Service screen is displayed, containing the data for the selected rule.

•

up

. Moves the rule up one position in the table rank.

•

down

. Moves the rule down one position in the table rank.

To enable, disable, or delete one or more rules:

1.

Select the checkbox to the left of the rule that you want to delete or disable or click the

select all

table button to select all rules.

2.

Click one of the following table buttons:

•

enable

.

Enables the rule or rules. The “!” status icon changes from a grey circle to a

green circle, indicating that the rule is or rules are enabled. (By default, when a rule is

added to the table, it is automatically enabled.)

•

disable

.

Disables the rule or rules. The “!” status icon changes from a green circle to

a grey circle, indicating that the rule is or rules are disabled.

•

delete

.

Deletes the rule or rules.