Skip to content

docs(firewall): document current features and command syntax #2247

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
l0crian1 wants to merge 1 commit into
base: rolling
Choose a base branch
from
Open

docs(firewall): document current features and command syntax #2247

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/configexamples/fwall-and-bridge.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -284,7 +284,7 @@ set firewall ipv4 input filter rule 120 action 'drop'
set firewall ipv4 input filter rule 120 inbound-interface group 'br2-ifaces'
```

And for traffic that is going to other local networks, and to he Internet, we
And for traffic that is going to other local networks and to the Internet, we
need to use the base chain `forward`. As in the bridge firewall, we are
going to use custom rulesets for each bridge, that would be used in the
`forward` chain. Those rulesets are `ip-br1-fwd` and `ip-br2-fwd`:
Expand Down
15 changes: 10 additions & 5 deletions docs/configexamples/fwall-and-vrf.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,8 +72,8 @@ and match interfaces and VRFs. In case where an interface is assigned to a
non-default VRF, if we want to use inbound-interface or outbound-interface in
firewall rules, we need to:

- For **inbound-interface**: use the interface name with the VRF name, like
`MGMT` or `LAN`.
- For **inbound-interface**: use the VRF name rather than the underlying
interface name, for example `MGMT` or `LAN`.
- For **outbound-interface**: use the interface name, like `eth0`, `vtun0`,
`eth2*` or similar.

Expand All @@ -87,9 +87,10 @@ set firewall ipv4 forward filter rule 10 action 'accept'
set firewall ipv4 forward filter rule 10 description 'MGMT - Allow to LAN and PROD'
set firewall ipv4 forward filter rule 10 inbound-interface name 'MGMT'
set firewall ipv4 forward filter rule 10 outbound-interface name 'eth2*'
set firewall ipv4 forward filter rule 99 action 'drop'
set firewall ipv4 forward filter rule 99 description 'MGMT - Drop all going to mgmt'
set firewall ipv4 forward filter rule 99 outbound-interface name 'eth1'
set firewall ipv4 forward filter rule 15 action 'drop'
set firewall ipv4 forward filter rule 15 description 'MGMT - Deny internet'
set firewall ipv4 forward filter rule 15 inbound-interface name 'MGMT'
set firewall ipv4 forward filter rule 15 outbound-interface name 'pppoe0'
set firewall ipv4 forward filter rule 120 action 'accept'
set firewall ipv4 forward filter rule 120 description 'LAN - Allow to PROD'
set firewall ipv4 forward filter rule 120 inbound-interface name 'LAN'
Expand All @@ -98,6 +99,10 @@ set firewall ipv4 forward filter rule 130 action 'accept'
set firewall ipv4 forward filter rule 130 description 'LAN - Allow internet'
set firewall ipv4 forward filter rule 130 inbound-interface name 'LAN'
set firewall ipv4 forward filter rule 130 outbound-interface name 'pppoe0'
set firewall ipv4 forward filter rule 140 action 'accept'
set firewall ipv4 forward filter rule 140 description 'WAN - Allow to PROD'
set firewall ipv4 forward filter rule 140 inbound-interface name 'WAN'
set firewall ipv4 forward filter rule 140 outbound-interface name 'eth2.3500'
```

Also, we are adding global state policies, in order to allow established and
Expand Down
14 changes: 7 additions & 7 deletions docs/configexamples/policy-based-ipsec-and-firewall.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ This configuration example and the requirements consists of:
> - Protect the router on 'WAN' interface, allowing only IPSec connections
> and SSH access from trusted IPs.
> - Allow access to the router only from trusted networks.
> - Allow DNS requests only only for local networks.
> - Allow DNS requests only for local networks.
> - Allow ICMP on all interfaces.
> - Allow all new connections from local subnets.
> - Allow connections from LANs to LANs through the tunnel.
Expand Down Expand Up @@ -128,10 +128,10 @@ set firewall ipv4 forward filter default-action 'drop'

# Forward traffic: global state policies
set firewall ipv4 forward filter rule 1 action 'accept'
set firewall ipv4 forward filter rule 1 state established 'enable'
set firewall ipv4 forward filter rule 1 state related 'enable'
set firewall ipv4 forward filter rule 1 state established
set firewall ipv4 forward filter rule 1 state related
set firewall ipv4 forward filter rule 2 action 'drop'
set firewall ipv4 forward filter rule 2 state invalid 'enable'
set firewall ipv4 forward filter rule 2 state invalid

# Forward traffic: Accept all connections from local networks
set firewall ipv4 forward filter rule 10 action 'accept'
Expand All @@ -147,10 +147,10 @@ set firewall ipv4 input filter default-action 'drop'

# Input traffic: global state policies
set firewall ipv4 input filter rule 1 action 'accept'
set firewall ipv4 input filter rule 1 state established 'enable'
set firewall ipv4 input filter rule 1 state related 'enable'
set firewall ipv4 input filter rule 1 state established
set firewall ipv4 input filter rule 1 state related
set firewall ipv4 input filter rule 2 action 'drop'
set firewall ipv4 input filter rule 2 state invalid 'enable'
set firewall ipv4 input filter rule 2 state invalid

# Input traffic: add rules needed for ipsec connection
set firewall ipv4 input filter rule 10 action 'accept'
Expand Down
12 changes: 6 additions & 6 deletions docs/configexamples/pppoe-ipv6-basic.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,16 +88,16 @@ To have basic protection while keeping IPv6 network functional, we need to:
```none
set firewall ipv6 name WAN_IN default-action 'drop'
set firewall ipv6 name WAN_IN rule 10 action 'accept'
set firewall ipv6 name WAN_IN rule 10 state established 'enable'
set firewall ipv6 name WAN_IN rule 10 state related 'enable'
set firewall ipv6 name WAN_IN rule 10 state established
set firewall ipv6 name WAN_IN rule 10 state related
set firewall ipv6 name WAN_IN rule 20 action 'accept'
set firewall ipv6 name WAN_IN rule 20 protocol 'icmpv6'
set firewall ipv6 name WAN_IN rule 20 protocol 'ipv6-icmp'
set firewall ipv6 name WAN_LOCAL default-action 'drop'
set firewall ipv6 name WAN_LOCAL rule 10 action 'accept'
set firewall ipv6 name WAN_LOCAL rule 10 state established 'enable'
set firewall ipv6 name WAN_LOCAL rule 10 state related 'enable'
set firewall ipv6 name WAN_LOCAL rule 10 state established
set firewall ipv6 name WAN_LOCAL rule 10 state related
set firewall ipv6 name WAN_LOCAL rule 20 action 'accept'
set firewall ipv6 name WAN_LOCAL rule 20 protocol 'icmpv6'
set firewall ipv6 name WAN_LOCAL rule 20 protocol 'ipv6-icmp'
set firewall ipv6 name WAN_LOCAL rule 30 action 'accept'
set firewall ipv6 name WAN_LOCAL rule 30 destination port '546'
set firewall ipv6 name WAN_LOCAL rule 30 protocol 'udp'
Expand Down
Loading
Loading