FVS338 ProSafe VPN Firewall 50 Reference Manual

Firewall Protection and Content Filtering

4-3

v1.0, September 2006

Table 4-1.

Outbound Rules Fields

Item

Description

Services

Select the desired Service or application to be covered by this rule. If the desired

service or application does not appear in the list, you must define it using the

Services menu (see

“Adding Customized Services” on page 4-17

).

Action

Select the desired action for outgoing connections covered by this rule:

•

BLOCK always

•

BLOCK by schedule, otherwise Allow

•

ALLOW always

•

ALLOW by schedule, otherwise Block

Note

: Any outbound traffic which is not blocked by rules you create will be allowed by

the Default rule.

ALLOW rules are only useful if the traffic is already covered by a BLOCK rule. That

is, you wish to allow a subset of traffic that is currently blocked by another rule.

Select Schedule

Select the desired time schedule (i.e., Schedule1, Schedule2, or Schedule3) that will

be used by this rule.

•

This drop down menu gets activated only when “BLOCK by schedule, otherwise

Allow” or “ALLOW by schedule, otherwise Block” is selected as Action.

•

Use schedule page to configure the time schedules (see

“Setting a Schedule to

Block or Allow Traffic” on page 4-20

).

LAN users

These settings determine which computers on your network are affected by this rule.

Select the desired options:

•

Any – All PCs and devices on your LAN.

•

Single address - Enter the required address and the rule will be applied to that

particular PC.

•

Address range – If this option is selected, you must enter the start and finish fields.

•

Groups – Select the Group you wish this rule to apply to. You can use the Network

Database screen to assign PCs to Groups. See

“Managing Groups and Hosts” on

page 3-5

.

WAN Users

These settings determine which Internet locations are covered by the rule, based on

their IP address. Select the desired option:

•

Any – All Internet IP address are covered by this rule.

•

Single address – Enter the required address in the start fields.

•

Address range – If this option is selected, you must enter the start and finish fields.

FVS338 ProSafe VPN Firewall 50 Reference Manual

4-4

Firewall Protection and Content Filtering

v1.0, September 2006

Inbound Rules (Port Forwarding)

Because the FVS338 uses Network Address Translation (NAT), your network presents only one IP

address to the Internet and outside users cannot directly address any of your local computers.

However, by defining an inbound rule you can make a local server (for example, a Web server or

game server) visible and available to the Internet. The rule tells the firewall to direct inbound

traffic for a particular service to one local server based on the destination port number. This is also

known as port forwarding.

Whether or not DHCP is enabled and how the PCs will access the server’s LAN address impact the

Inbound Rules. For example:

•

If your external IP address is assigned dynamically by your ISP (DHCP enabled), the IP

address may change periodically as the DHCP lease expires. Consider using

Dyamic DNS

(under Network Configuration) so that external users can always find your network (see

“Configuring Dynamic DNS (If Needed)” on page 2-16

.

•

If the IP address of the local server PC is assigned by DHCP, it may change when the PC is

rebooted. To avoid this, use the Reserved IP address feature in the

LAN Groups

menu (under

Network Configuration) to keep the PC’s IP address constant (see

“Setting Up Address

Reservation” on page 3-8

).

•

Local PCs must access the local server using the local LAN address of the PC. Attempts by

local PCs to access the server using the external WAN IP address will fail.

QoS Priority

This setting determines the priority of a service, which in turn, determines the quality

of that service for the traffic passing through the firewall. By default, the priority

shown is that of the selected service. The user can change it accordingly. If the user

does not make a selection (i.e, leaves it as None), then the native priority of the

service will be applied to the policy. 6 is the highest priority. See

“Specifying Quality of

Service (QoS) Priorities” on page 4-19

.

Log

This determines whether packets covered by this rule are logged. Select the desired

action:

•

Always – always log traffic considered by this rule, whether it matches or not. This

is useful when debugging your rules.

•

Never – never log traffic considered by this rule, whether it matches or not.

Note:

See

“Setting Up Port Triggering” on page 4-24

for yet another way to allow

certain types of inbound traffic that would otherwise be blocked by the

firewall.

Table 4-1.

Outbound Rules Fields (continued)

Item

Description

FVS338 ProSafe VPN Firewall 50 Reference Manual

Firewall Protection and Content Filtering

4-5

v1.0, September 2006

Table 4-2.

Inbound Rules Fields

Item

Description

Services

Select the desired Service or application to be covered by this rule. If the desired

service or application does not appear in the list, you must define it using the

Services menu (see

“Adding Customized Services” on page 4-17

).

Action

Select the desired action for packets covered by this rule:

•

BLOCK always

•

BLOCK by schedule, otherwise Allow

•

ALLOW always

•

ALLOW by schedule, otherwise Block

Note

: Any inbound traffic which is not allowed by rules you create will be blocked by

the Default rule.

Select Schedule

Select the desired time schedule (i.e., Schedule1, Schedule2, or Schedule3) that will

be used by this rule.

•

This drop down menu gets activated only when “BLOCK by schedule, otherwise

Allow” or “ALLOW by schedule, otherwise Block” is selected as Action.

•

Use schedule page to configure the time schedules.

LAN Server

This LAN address determines which computer on your network is hosting this service

rule. (You can also translate this address to a port number.).

Translate to Port

Number

Check the “Translate to Port Number” and enter a port number if you want to assign

the LAN Server to a specific port.

WAN Users

These settings determine which Internet locations are covered by the rule, based on

their IP address. Select the desired option:

•

Any – All Internet IP address are covered by this rule.

•

Single address – Enter the required address in the start fields.

•

Address range – If this option is selected, you must enter the start and finish fields.

WAN Destination IP

Address

These settings determine the destination IP address applicable to incoming traffic.

This is the public IP address that will map to the internal server; it can either be the

address of the WAN1 or WAN2 ports or another public IP address

.

QoS Priority

This setting determines the priority of a service, which in turn, determines the quality

of that service for the traffic passing through the firewall. By default, the priority

shown is that of the selected service. The user can change it accordingly. If the user

does not make a selection (i.e, leaves it as None), then the native priority of the

service will be applied to the policy. See

“Specifying Quality of Service (QoS)

Priorities” on page 4-19

.

Log

This determines whether packets covered by this rule are logged. Select the desired

action:

•

Always – always log traffic considered by this rule, whether it matches or not. This

is useful when debugging your rules.

•

Never – never log traffic considered by this rule, whether it matches or not.

FVS338 ProSafe VPN Firewall 50 Reference Manual

4-6

Firewall Protection and Content Filtering

v1.0, September 2006

Remember that allowing inbound services opens holes in your VPN firewall. Only enable those

ports that are necessary for your network. It is also advisable to turn on the server application

security and invoke the user password or privilege levels, if provided.

Order of Precedence for Firewall Rules

As you define new rules, they are added to the tables in the Rules menu, as shown in

Figure 4-1

For any traffic attempting to pass through the firewall, the packet information is subjected to the

rules in the order shown in the Rules Table, beginning at the top and proceeding to the default rules

at the bottom. In some cases, the order of precedence of two or more rules may be important in

determining the disposition of a packet. For example, you should place the most strict rules at the

top (those with the most specific services or addresses). The

Up

and

Down

buttons allow you to

relocate a defined rule to a new position in the table.

Note:

Some residential broadband ISP accounts do not allow you to run any server

processes (such as a Web or FTP server) from your location. Your ISP may

periodically check for servers and may suspend your account if it discovers any

active services at your location. If you are unsure, refer to the Acceptable Use

Policy of your ISP.

Figure 4-1

FVS338 ProSafe VPN Firewall 50 Reference Manual

Firewall Protection and Content Filtering

4-7

v1.0, September 2006

Setting LAN WAN Rules

The Default Outbound Policy is to allow all traffic from and to the Internet to pass through.

Firewall rules can then be applied to block specific types of traffic from either going out from the

LAN to the Internet (Outbound) or coming in from the Internet to the LAN (Inbound). The default

policy can be changed to block all outbound traffic and enable only specific services to pass

through the router.

To change the Default Outbound Policy:

1.

Select

Security

from the main menu and

Firewall Rules

from the submenu. The

LAN WAN

Rules

screen will display.

2.

Change the

Default Outbound Policy

by selecting Block Always from the drop-down menu

and click

Apply

.

To make changes to an existing outbound or inbound service rule:

1.

In the

Action

column adjacent to the rule click:

•

Edit

– to make any changes to the rule definition of an existing rule. The Outbound

Service screen will display containing the data for the selected rule (see

Figure 4-3 on

page 4-9

).

•

Up

– to move the rule up one position in the table rank.

Figure 4-2