Szablon:Web networkfirewall - Historia wersji

Elproma o 12:14, 26 kwi 2024

2024-04-26T12:14:35Z

← poprzednia wersja		Wersja z 14:14, 26 kwi 2024
Linia 286:		Linia 286:
	\|}		\|}

	[[File:web_networkfirewallportg.png\|~~500px~~\|frameless\|class=tlt-border]]		[[File:web_networkfirewallportg.png\|600px\|frameless\|class=tlt-border]]

	===Advanced Settings===		===Advanced Settings===
Linia 337:		Linia 337:
	\|}		\|}

	[[File:web_networkfirewallporta.png\|~~600px~~\|frameless\|class=tlt-border]]		[[File:web_networkfirewallporta.png\|700px\|frameless\|class=tlt-border]]

	==Traffic Rules==		==Traffic Rules==
Linia 426:		Linia 426:
	\|}		\|}

	[[File:web_networkfirewalltrafficg.png\|~~500px~~\|frameless\|class=tlt-border]]		[[File:web_networkfirewalltrafficg.png\|400px\|frameless\|class=tlt-border]]

	===Advanced Settings===		===Advanced Settings===
Linia 469:		Linia 469:
	\|}		\|}

	[[File:web_networkfirewalltraffica.png\|~~500px~~\|frameless\|class=tlt-border]]		[[File:web_networkfirewalltraffica.png\|600px\|frameless\|class=tlt-border]]

	===Time Restrictions===		===Time Restrictions===
Linia 504:		Linia 504:
	\|}		\|}

	[[File:web_networkfirewalltraffict.png\|~~500px~~\|frameless\|class=tlt-border]]		[[File:web_networkfirewalltraffict.png\|400px\|frameless\|class=tlt-border]]

	==NAT Rules==		==NAT Rules==

Elproma o 12:12, 26 kwi 2024

2024-04-26T12:12:02Z

← poprzednia wersja		Wersja z 14:12, 26 kwi 2024
Linia 30:		Linia 30:
	\|}		\|}

	[[File:web_networkfirewall.png\|~~500px~~\|frameless\|class=tlt-border]]		[[File:web_networkfirewall.png\|400px\|frameless\|class=tlt-border]]

	===Routing/NAT Offloading===		===Routing/NAT Offloading===
Linia 51:		Linia 51:
	\|}		\|}

	[[File:web_networkfirewallrouting.png\|~~800px~~\|frameless\|class=tlt-border]]		[[File:web_networkfirewallrouting.png\|500px\|frameless\|class=tlt-border]]

	===Zones===		===Zones===
Linia 286:		Linia 286:
	\|}		\|}

	[[File:web_networkfirewallportg.png\|~~800px~~\|frameless\|class=tlt-border]]		[[File:web_networkfirewallportg.png\|500px\|frameless\|class=tlt-border]]

	===Advanced Settings===		===Advanced Settings===
Linia 337:		Linia 337:
	\|}		\|}

	[[File:web_networkfirewallporta.png\|~~800px~~\|frameless\|class=tlt-border]]		[[File:web_networkfirewallporta.png\|600px\|frameless\|class=tlt-border]]

	==Traffic Rules==		==Traffic Rules==
Linia 426:		Linia 426:
	\|}		\|}

	[[File:web_networkfirewalltrafficg.png\|~~800px~~\|frameless\|class=tlt-border]]		[[File:web_networkfirewalltrafficg.png\|500px\|frameless\|class=tlt-border]]

	===Advanced Settings===		===Advanced Settings===
Linia 469:		Linia 469:
	\|}		\|}

	[[File:web_networkfirewalltraffica.png\|~~800px~~\|frameless\|class=tlt-border]]		[[File:web_networkfirewalltraffica.png\|500px\|frameless\|class=tlt-border]]

	===Time Restrictions===		===Time Restrictions===
Linia 504:		Linia 504:
	\|}		\|}

	[[File:web_networkfirewalltraffict.png\|~~800px~~\|frameless\|class=tlt-border]]		[[File:web_networkfirewalltraffict.png\|500px\|frameless\|class=tlt-border]]

	==NAT Rules==		==NAT Rules==

Elproma o 12:08, 26 kwi 2024

2024-04-26T12:08:44Z

← poprzednia wersja		Wersja z 14:08, 26 kwi 2024
Linia 30:		Linia 30:
	\|}		\|}

	[[File:web_networkfirewall.png\|~~800px~~\|frameless\|class=tlt-border]]		[[File:web_networkfirewall.png\|500px\|frameless\|class=tlt-border]]

	===Routing/NAT Offloading===		===Routing/NAT Offloading===

Elproma o 12:07, 26 kwi 2024

2024-04-26T12:07:17Z

← poprzednia wersja		Wersja z 14:07, 26 kwi 2024
Linia 1:		Linia 1:
	The <b>Firewall</b> page of {{{model}}} ~~router~~ is used to creates zones over your network interfaces to control network traffic flow.		The <b>Firewall</b> page of {{{model}}} {{{type}}} is used to creates zones over your network interfaces to control network traffic flow.

	==General Settings==		==General Settings==
Linia 341:		Linia 341:
	==Traffic Rules==		==Traffic Rules==

	Traffic rules define policies for packets traveling between different zones, for example to reject traffic between certain hosts or to open WAN ports on the ~~router~~.		Traffic rules define policies for packets traveling between different zones, for example to reject traffic between certain hosts or to open WAN ports on the {{{type}}}.

	{\| class="wikitable"		{\| class="wikitable"

Elproma o 13:45, 19 kwi 2024

2024-04-19T13:45:50Z

← poprzednia wersja		Wersja z 15:45, 19 kwi 2024
Linia 30:		Linia 30:
	\|}		\|}

	[[File:web_networkfirewall.png\|800px\|~~border~~\|class=tlt-border]]		[[File:web_networkfirewall.png\|800px\|frameless\|class=tlt-border]]

	===Routing/NAT Offloading===		===Routing/NAT Offloading===
Linia 51:		Linia 51:
	\|}		\|}

	[[File:web_networkfirewallrouting.png\|800px\|~~border~~\|class=tlt-border]]		[[File:web_networkfirewallrouting.png\|800px\|frameless\|class=tlt-border]]

	===Zones===		===Zones===
Linia 76:		Linia 76:
	\|}		\|}

	[[File:web_networkfirewallzones.png\|800px\|~~border~~\|class=tlt-border]]		[[File:web_networkfirewallzones.png\|800px\|frameless\|class=tlt-border]]

	Use Edit button to edit the zone or Delete to remove it.		Use Edit button to edit the zone or Delete to remove it.
Linia 136:		Linia 136:
	\|}		\|}

	[[File:web_networkfirewallzonesg.png\|800px\|~~border~~\|class=tlt-border]]		[[File:web_networkfirewallzonesg.png\|800px\|frameless\|class=tlt-border]]

	<b>Advanced Settings</b>		<b>Advanced Settings</b>
Linia 177:		Linia 177:
	\|}		\|}

	[[File:web_networkfirewallzonesa.png\|800px\|~~border~~\|class=tlt-border]]		[[File:web_networkfirewallzonesa.png\|800px\|frameless\|class=tlt-border]]

	<b>Conntrack Settings</b>		<b>Conntrack Settings</b>
Linia 200:		Linia 200:
	\|}		\|}

	[[File:web_networkfirewallzonesc.png\|800px\|~~border~~\|class=tlt-border]]		[[File:web_networkfirewallzonesc.png\|800px\|frameless\|class=tlt-border]]

	<b>Extra iptables arguments</b>		<b>Extra iptables arguments</b>
Linia 221:		Linia 221:
	\|}		\|}

	[[File:web_networkfirewallzonese.png\|800px\|~~border~~\|class=tlt-border]]		[[File:web_networkfirewallzonese.png\|800px\|frameless\|class=tlt-border]]

	==Port Forwards==		==Port Forwards==
Linia 245:		Linia 245:
	\|}		\|}

	[[File:web_networkfirewallport.png\|800px\|~~border~~\|class=tlt-border]]		[[File:web_networkfirewallport.png\|800px\|frameless\|class=tlt-border]]

	Use Edit or Delete buttons to manage the port forwarding.		Use Edit or Delete buttons to manage the port forwarding.
Linia 286:		Linia 286:
	\|}		\|}

	[[File:web_networkfirewallportg.png\|800px\|~~border~~\|class=tlt-border]]		[[File:web_networkfirewallportg.png\|800px\|frameless\|class=tlt-border]]

	===Advanced Settings===		===Advanced Settings===
Linia 337:		Linia 337:
	\|}		\|}

	[[File:web_networkfirewallporta.png\|800px\|~~border~~\|class=tlt-border]]		[[File:web_networkfirewallporta.png\|800px\|frameless\|class=tlt-border]]

	==Traffic Rules==		==Traffic Rules==
Linia 361:		Linia 361:
	\|}		\|}

	[[File:web_networkfirewalltraffic.png\|800px\|~~border~~\|class=tlt-border]]		[[File:web_networkfirewalltraffic.png\|800px\|frameless\|class=tlt-border]]

	Use Edit or Delete buttons to manage the rule		Use Edit or Delete buttons to manage the rule
Linia 426:		Linia 426:
	\|}		\|}

	[[File:web_networkfirewalltrafficg.png\|800px\|~~border~~\|class=tlt-border]]		[[File:web_networkfirewalltrafficg.png\|800px\|frameless\|class=tlt-border]]

	===Advanced Settings===		===Advanced Settings===
Linia 469:		Linia 469:
	\|}		\|}

	[[File:web_networkfirewalltraffica.png\|800px\|~~border~~\|class=tlt-border]]		[[File:web_networkfirewalltraffica.png\|800px\|frameless\|class=tlt-border]]

	===Time Restrictions===		===Time Restrictions===
Linia 504:		Linia 504:
	\|}		\|}

	[[File:web_networkfirewalltraffict.png\|800px\|~~border~~\|class=tlt-border]]		[[File:web_networkfirewalltraffict.png\|800px\|frameless\|class=tlt-border]]

	==NAT Rules==		==NAT Rules==
Linia 528:		Linia 528:
	\|}		\|}

	[[File:web_networkfirewallnat.png\|800px\|~~border~~\|class=tlt-border]]		[[File:web_networkfirewallnat.png\|800px\|frameless\|class=tlt-border]]

	==Custom Rules==		==Custom Rules==
Linia 534:		Linia 534:
	Custom rules allow you to execute arbitrary iptables commands which are not otherwise covered by the firewall framework. The commands are executed after each firewall restart, right after the default ruleset has been loaded.		Custom rules allow you to execute arbitrary iptables commands which are not otherwise covered by the firewall framework. The commands are executed after each firewall restart, right after the default ruleset has been loaded.

	[[File:web_networkfirewallcustom.png\|800px\|~~border~~\|class=tlt-border]]		[[File:web_networkfirewallcustom.png\|800px\|frameless\|class=tlt-border]]

	[[Category:{{{model}}} User Manual]]		[[Category:{{{model}}} User Manual]]

Elproma o 11:23, 8 cze 2022

2022-06-08T11:23:11Z

Podgląd zmian

Elproma o 14:05, 7 cze 2022

2022-06-07T14:05:38Z

@@ Linia 319: / Linia 319: @@
 |-
    | Limit matching
+   | unlimited, 10/second, 60/minute, 3/hour or 500/day, default: unlimited
    | Limits traffic matching to the specified rate.
 |-
@@ Linia 328: / Linia 328: @@
 ==Traffic Rules==
 [[File:web_serviceswatchcat.png|800px|border|class=tlt-border]]

Elproma: Utworzono nową stronę "The Firewall page of {{{model}}} router is used to creates zones over your network interfaces to control network traffic flow. ==General Settings== {| class="wikitable" |- ! Name ! Value ! Description |- | Enable SYN-flood protection | On/Off, default: On | |- | Drop invalid packets | On/Off, default: Off | |- | Input | reject, drop or accept, default: accept | |- | Output | reject, drop or accept, default: accept | |- |…"

2022-06-07T12:51:28Z

Utworzono nową stronę "The Firewall page of {{{model}}} router is used to creates zones over your network interfaces to control network traffic flow. ==General Settings== {| class="wikitable" |- ! Name ! Value ! Description |- | Enable SYN-flood protection | On/Off, default: On | |- | Drop invalid packets | On/Off, default: Off | |- | Input | reject, drop or accept, default: accept | |- | Output | reject, drop or accept, default: accept | |- |…"

Nowa strona

The Firewall page of {{{model}}} router is used to creates zones over your network interfaces to control network traffic flow.

==General Settings==

{| class="wikitable"
|-
! Name
! Value
! Description
|-
| Enable SYN-flood protection
| On/Off, default: On
|
|-
| Drop invalid packets
| On/Off, default: Off
|
|-
| Input
| reject, drop or accept, default: accept
|
|-
| Output
| reject, drop or accept, default: accept
|
|-
| Forward
| reject, drop or accept, default: accept
|
|}

[[File:web_serviceswatchcat.png|800px|border|class=tlt-border]]

===Routing/NAT Offloading===

It is an experimental feature. Not fully compatible with QoS/SQM.

{| class="wikitable"
|-
! Name
! Value
! Description
|-
| Software flow offloading
| On/Off, default: Off
| Software based offloading for routing/NAT
|-
| Hardware flow offloading
| On/Off, default: Off
| Requires hardware NAT support. Implemented at least for mt7621
|}

[[File:web_serviceswatchcat.png|800px|border|class=tlt-border]]

===Zones===

{| class="wikitable"
|-
! Name
! Description
|-
| Zone ⇒ Forwardings
|
|-
| Input
|
|-
| Output
|
|-
| Forward
|
|-
| Masquerading
|
|}

Use Edit button to edit the zone or Delete to remove it.

General Settings

This section defines common properties of "lan". The input and output options set the default policies for traffic entering and leaving this zone while the forward option describes the policy for forwarded traffic between different networks within the zone. Covered networks specifies which available networks are members of this zone.

{| class="wikitable"
|-
! Name
! Value
! Description
|-
| Name
| string
|
|-
| Input
| reject, drop or accept, default: accept
|
|-
| Output
| reject, drop or accept, default: accept
|
|-
| Forward
| reject, drop or accept, default: accept
|
|-
| Masquerading
| On/Off, default: Off
|
|-
| MSS clamping
| On/Off, default: Off
|
|-
| Covered networks
| dhcp, gsm or lan
|
|}

The options below control the forwarding policies between this zone (lan) and other zones. Destination zones cover forwarded traffic originating from lan. Source zones match forwarded traffic from other zones targeted at lan. The forwarding rule is unidirectional, e.g. a forward from lan to wan does not imply a permission to forward from wan to lan as well.

{| class="wikitable"
|-
! Name
! Value
! Description
|-
| Allow forward to destination zones:
|
|
|-
| Allow forward from source zones:
|
|
|}

Advanced Settings

The options below control the forwarding policies between this zone (lan) and other zones. Destination zones cover forwarded traffic originating from lan. Source zones match forwarded traffic from other zones targeted at lan. The forwarding rule is unidirectional, e.g. a forward from lan to wan does not imply a permission to forward from wan to lan as well.

{| class="wikitable"
|-
! Name
! Value
! Description
|-
| Covered devices
|
| Use this option to classify zone traffic by raw, non-uci managed network devices.
|-
| Covered subnets
|
| Use this option to classify zone traffic by source or destination subnet instead of networks or devices.
|-
| Restrict to address family
| IPv4 and IPv6, IPv4 only or IPv6 only, default: IPv4 and IPv6
|
|-
| Restrict Masquerading to given source subnets
|
|
|-
| Restrict Masquerading to given destination subnets
|
|
|-
| Enable logging on this zone
| On/Off, default: Off
|
|-
| Limit log messages
|
|
|}

Conntrack Settings

{| class="wikitable"
|-
! Name
! Value
! Description
|-
| Allow "invalid" traffic
| On/Off, default: Off
| Do not install extra rules to reject forwarded traffic with conntrack state invalid. This may be required for complex asymmetric route setups.
|-
|
| On/Off, default: On
| Automatically assign conntrack helpers based on traffic protocol and port
|-
| Conntrack helpers
|
| Explicitly choses allowed connection tracking helpers for zone traffic
|}

Extra iptables arguments

Passing raw iptables arguments to source and destination traffic classification rules allows to match packets based on other criteria than interfaces or subnets. These options should be used with extreme care as invalid values could render the firewall ruleset broken, completely exposing all services.

{| class="wikitable"
|-
! Name
! Value
! Description
|-
| Extra source arguments
|
| Additional raw iptables arguments to classify zone source traffic, e.g. -p tcp --sport 443 to only match inbound HTTPS traffic.
|-
| Extra destination arguments
|
| Additional raw iptables arguments to classify zone destination traffic, e.g. -p tcp --dport 443 to only match outbound HTTPS traffic.
|}

[[File:web_serviceswatchcat.png|800px|border|class=tlt-border]]

==Port Forwards==

Port forwarding allows remote computers on the Internet to connect to a specific computer or service within the private LAN.

{| class="wikitable"
|-
! Name
! Description
|-
| Name
|
|-
| Match
|
|-
| Action
|
|-
| Enable
| Set to enable the port forwards.
|}

Use Edit or Delete buttons to manage the port forwarding.

===General Settings===

{| class="wikitable"
|-
! Name
! Value
! Description
|-
| Name
| string
|
|-
| Protocol
| Any, TCP, UDP, ICMP or/and custom
|
|-
| Source zone
|
|
|-
| External port
|
| Match incoming traffic directed at the given destination port or port range on this host
|-
| Destination zone
|
|
|-
| Internal IP address
|
| Redirect matched incoming traffic to the specified internal host
|-
| Internal port
|
| Redirect matched incoming traffic to the given port on the internal host
|}

[[File:web_serviceswatchcat.png|800px|border|class=tlt-border]]

===Advanced Settings===

{| class="wikitable"
|-
! Name
! Value
! Description
|-
| Source MAC address
|
| Only match incoming traffic from these MACs.
|-
| Source IP address
|
| Only match incoming traffic from this IP or range.
|-
| Source port
| number from 0 to 65535
| Only match incoming traffic originating from the given source port or port range on the client host
|-
| External IP address
|
| Only match incoming traffic directed at the given IP address.
|-
| Enable NAT Loopback
| On/Off, default: Off
|
|-
| Loopback source IP
| Use internal IP address or Use external IP address, default: Use internal IP address
| Specifies whether to use the external or the internal IP address for reflected traffic.
|-
| Match helper
|
| Match traffic using the specified connection tracking helper.
|-
| Match mark
| string
| Matches a specific firewall mark or a range of different marks.
|-
| Limit matching
|
| Limits traffic matching to the specified rate.
|-
| Extra arguments
|
| Passes additional arguments to iptables. Use with care!
|}

==Traffic Rules==

[[File:web_serviceswatchcat.png|800px|border|class=tlt-border]]

==NAT Rules==

[[File:web_serviceswatchcat.png|800px|border|class=tlt-border]]

==Custom Rules==

[[File:web_serviceswatchcat.png|800px|border|class=tlt-border]]

[[Category:{{{model}}} User Manual]]