Tekst źródłowy strony Szablon:Web networkfirewall

The <b>Firewall</b> page of {{{model}}} router is used to creates zones over your network interfaces to control network traffic flow.

==General Settings==

{| class="wikitable"
|-
  ! Name
  ! Value
  ! Description
|-
  | Enable SYN-flood protection
  | On/Off, default: On
  | 
|-
  | Drop invalid packets
  | On/Off, default: Off
  | 
|-
  | Input
  | reject, drop or accept, default: accept
  | 
|-
  | Output
  | reject, drop or accept, default: accept
  | 
|-
  | Forward
  | reject, drop or accept, default: accept
  | 
|}

[[File:web_networkfirewall.png|800px|border|class=tlt-border]]

===Routing/NAT Offloading===

It is an experimental feature. Not fully compatible with QoS/SQM.

{| class="wikitable"
|-
  ! Name
  ! Value
  ! Description
|-
  | Software flow offloading
  | On/Off, default: Off
  | Software based offloading for routing/NAT
|-
  | Hardware flow offloading
  | On/Off, default: Off
  | Requires hardware NAT support. Implemented at least for mt7621
|}

[[File:web_networkfirewallrouting.png|800px|border|class=tlt-border]]

===Zones===

{| class="wikitable"
|-
  ! Name
  ! Description
|-
  | Zone ⇒ Forwardings
  | 
|-
  | Input
  | 
|-
  | Output
  | 
|-
  | Forward
  | 
|-
  | Masquerading
  | 
|}

[[File:web_networkfirewallzones.png|800px|border|class=tlt-border]]

Use Edit button to edit the zone or Delete to remove it.

<b>General Settings</b>

This section defines common properties of "lan". The input and output options set the default policies for traffic entering and leaving this zone while the forward option describes the policy for forwarded traffic between different networks within the zone. Covered networks specifies which available networks are members of this zone.

{| class="wikitable"
|-
  ! Name
  ! Value
  ! Description
|-
  | Name
  | string
  | 
|-
  | Input
  | reject, drop or accept, default: accept
  | 
|-
  | Output
  | reject, drop or accept, default: accept
  | 
|-
  | Forward
  | reject, drop or accept, default: accept
  | 
|-
  | Masquerading
  | On/Off, default: Off
  | 
|-
  | MSS clamping
  | On/Off, default: Off
  | 
|-
  | Covered networks
  | dhcp, gsm or lan
  | 
|}

The options below control the forwarding policies between this zone (lan) and other zones. Destination zones cover forwarded traffic originating from lan. Source zones match forwarded traffic from other zones targeted at lan. The forwarding rule is unidirectional, e.g. a forward from lan to wan does not imply a permission to forward from wan to lan as well.

{| class="wikitable"
|-
  ! Name
  ! Value
  ! Description
|-
  | Allow forward to destination zones:
  | 
  | 
|-
  | Allow forward from source zones:
  | 
  | 
|}

[[File:web_networkfirewallzonesg.png|800px|border|class=tlt-border]]

<b>Advanced Settings</b>

The options below control the forwarding policies between this zone (lan) and other zones. Destination zones cover forwarded traffic originating from lan. Source zones match forwarded traffic from other zones targeted at lan. The forwarding rule is unidirectional, e.g. a forward from lan to wan does not imply a permission to forward from wan to lan as well.

{| class="wikitable"
|-
  ! Name
  ! Value
  ! Description
|-
  | Covered devices
  | 
  | Use this option to classify zone traffic by raw, non-uci managed network devices.
|-
  | Covered subnets
  | 
  | Use this option to classify zone traffic by source or destination subnet instead of networks or devices.
|-
  | Restrict to address family
  | IPv4 and IPv6, IPv4 only or IPv6 only, default: IPv4 and IPv6
  | 
|-
  | Restrict Masquerading to given source subnets
  | 
  | 
|-
  | Restrict Masquerading to given destination subnets
  | 
  | 
|-
  | Enable logging on this zone
  | On/Off, default: Off
  | 
|-
  | Limit log messages
  | 
  | 
|}

[[File:web_networkfirewallzonesa.png|800px|border|class=tlt-border]]

<b>Conntrack Settings</b>

{| class="wikitable"
|-
  ! Name
  ! Value
  ! Description
|-
  | Allow "invalid" traffic
  | On/Off, default: Off
  | Do not install extra rules to reject forwarded traffic with conntrack state invalid. This may be required for complex asymmetric route setups.
|-
  | 
  | On/Off, default: On
  | Automatically assign conntrack helpers based on traffic protocol and port
|-
  | Conntrack helpers
  | 
  | Explicitly choses allowed connection tracking helpers for zone traffic
|}

[[File:web_networkfirewallzonesc.png|800px|border|class=tlt-border]]

<b>Extra iptables arguments</b>

Passing raw iptables arguments to source and destination traffic classification rules allows to match packets based on other criteria than interfaces or subnets. These options should be used with extreme care as invalid values could render the firewall ruleset broken, completely exposing all services.

{| class="wikitable"
|-
  ! Name
  ! Value
  ! Description
|-
  | Extra source arguments
  | 
  | Additional raw iptables arguments to classify zone source traffic, e.g. -p tcp --sport 443 to only match inbound HTTPS traffic.
|-
  | Extra destination arguments
  | 
  | Additional raw iptables arguments to classify zone destination traffic, e.g. -p tcp --dport 443 to only match outbound HTTPS traffic.
|}

[[File:web_networkfirewallzonese.png|800px|border|class=tlt-border]]

==Port Forwards==

Port forwarding allows remote computers on the Internet to connect to a specific computer or service within the private LAN.

{| class="wikitable"
|-
  ! Name
  ! Description
|-
  | Name
  | 
|-
  | Match
  | 
|-
  | Action
  | 
|-
  | Enable
  | Set to enable the port forwards.
|}

[[File:web_networkfirewallport.png|800px|border|class=tlt-border]]

Use Edit or Delete buttons to manage the port forwarding.

===General Settings===

{| class="wikitable"
|-
  ! Name
  ! Value
  ! Description
|-
  | Name
  | string
  | 
|-
  | Protocol
  | Any, TCP, UDP, ICMP or/and custom
  | 
|-
  | Source zone
  | 
  | 
|-
  | External port
  | 
  | Match incoming traffic directed at the given destination port or port range on this host
|-
  | Destination zone
  | 
  | 
|-
  | Internal IP address
  | 
  | Redirect matched incoming traffic to the specified internal host
|-
  | Internal port
  | 
  | Redirect matched incoming traffic to the given port on the internal host
|}

[[File:web_networkfirewallportg.png|800px|border|class=tlt-border]]

===Advanced Settings===

{| class="wikitable"
|-
  ! Name
  ! Value
  ! Description
|-
  | Source MAC address
  | 
  | Only match incoming traffic from these MACs.
|-
  | Source IP address
  | 
  | Only match incoming traffic from this IP or range.
|-
  | Source port
  | number from 0 to 65535
  | Only match incoming traffic originating from the given source port or port range on the client host
|-
  | External IP address
  | 
  | Only match incoming traffic directed at the given IP address.
|-
  | Enable NAT Loopback
  | On/Off, default: Off
  | 
|-
  | Loopback source IP
  | Use internal IP address or Use external IP address, default: Use internal IP address
  | Specifies whether to use the external or the internal IP address for reflected traffic.
|-
  | Match helper
  | 
  | Match traffic using the specified connection tracking helper.
|-
  | Match mark
  | string
  | Matches a specific firewall mark or a range of different marks.
|-
  | Limit matching
  | unlimited, 10/second, 60/minute, 3/hour or 500/day, default: unlimited
  | Limits traffic matching to the specified rate.
|-
  | Extra arguments
  | 
  | Passes additional arguments to iptables. Use with care!
|}

[[File:web_networkfirewallporta.png|800px|border|class=tlt-border]]

==Traffic Rules==

Traffic rules define policies for packets traveling between different zones, for example to reject traffic between certain hosts or to open WAN ports on the router.

{| class="wikitable"
|-
  ! Name
  ! Description
|-
  | Name
  | 
|-
  | Match
  | 
|-
  | Action
  | 
|-
  | Enable
  | Set to enable the rule
|}

[[File:web_networkfirewalltraffic.png|800px|border|class=tlt-border]]

Use Edit or Delete buttons to manage the rule

===General Settings===

{| class="wikitable"
|-
  ! Name
  ! Value
  ! Description
|-
  | Name
  | string
  | 
|-
  | Protocol
  | Any, TCP, UDP, ICMP, IGMP or/and IPSEC-ESP
  | 
|-
  | Source zone
  | 
  | 
|-
  | Source address
  | 
  | 
|-
  | Source port
  | number from 0 to 65535
  | 
|-
  | Destination zone
  | 
  | 
|-
  | Destination address
  | 
  | 
|-
  | Destination port
  | number from 0 to 65535
  | 
|-
  | Action
  | drop, accept, reject, don't track, assign conntrack helper, apply firewall mark, XOR firewall mark or DSCP classification
  | 
|-
  | Tracking helper
  | 
  | Assign the specified connection tracking helper to matched traffic.
|-
  | Set mark
  | 
  | Set the given mark value on established connections. Format is value[/mask]. If a mask is specified then only those bits set in the mask are modified.
|-
  | XOR mark
  | 
  | Apply a bitwise XOR of the given value and the existing mark value on established connections. Format is value[/mask]. If a mask is specified then those bits set in the mask are zeroed out.
|-
  | DSCP mark
  | 
  | Apply the given DSCP class or value to established connections.
|}

[[File:web_networkfirewalltrafficg.png|800px|border|class=tlt-border]]

===Advanced Settings===

{| class="wikitable"
|-
  ! Name
  ! Value
  ! Description
|-
  | Match device
  | unspecified, Inbound device or Outbound device
  | 
|-
  | Restrict to address family
  | IPv4 and IPv6, IPv4 or IPv6
  | 
|-
  | Source MAC address
  | 
  | 
|-
  | Match helper
  | 
  | Match traffic using the specified connection tracking helper.
|-
  | Match mark
  | 
  | Matches a specific firewall mark or a range of different marks.
|-
  | Match DSCP
  | 
  | Matches traffic carrying the specified DSCP marking.
|-
  | Limit matching
  | unlimited, 10/second, 60/minute, 3/hour or 500/day, default: unlimited
  | Limits traffic matching to the specified rate.
|-
  | Extra arguments
  | 
  | Passes additional arguments to iptables. Use with care!
|}

[[File:web_networkfirewalltraffica.png|800px|border|class=tlt-border]]

===Time Restrictions===

{| class="wikitable"
|-
  ! Name
  ! Value
  ! Description
|-
  | Week Days
  | 
  | 
|-
  | Start Time (hh:mm:ss)
  | 
  | 
|-
  | Stop Time (hh:mm:ss)
  | 
  | 
|-
  | Start Date (yyyy-mm-dd)
  | 
  | 
|-
  | Stop Date (yyyy-mm-dd)
  | 
  | 
|-
  | Time in UTC
  | On/Off, default: Off
  | 
|}

[[File:web_networkfirewalltraffict.png|800px|border|class=tlt-border]]

==NAT Rules==

NAT rules allow fine grained control over the source IP to use for outbound or forwarded traffic. Use Add button to add new NAT rule.

{| class="wikitable"
|-
  ! Name
  ! Description
|-
  | Name
  | 
|-
  | Match
  | 
|-
  | Action
  | 
|-
  | Enable
  | 
|}

[[File:web_networkfirewallnat.png|800px|border|class=tlt-border]]

==Custom Rules==

Custom rules allow you to execute arbitrary iptables commands which are not otherwise covered by the firewall framework. The commands are executed after each firewall restart, right after the default ruleset has been loaded.

[[File:web_networkfirewallcustom.png|800px|border|class=tlt-border]]

[[Category:{{{model}}} User Manual]]