EdgeOS WAN IN Firewall Rules

welcome to our first of three firewall rule videos this first firewall rule video is going to deal with inbound traffic and we're going to look at how to block traffic but then if you run on a web server how to allow traffic at the same time so we're going to look at that and then we'll touch on the time-based options so let's hop right into it we're going to log it into our router do not use ub + tu b ub NT i use that for demonstration purposes only make sure you change the username and password on your firewall for the login we're going to firewall Nath firewall policies we're going to modify weighing-in because it has zero direction in which is our ran interface and the direction in and you can see the default action is drop but if we edit the rule set rule number one says allow establish and related established and related connections so basically we are accepting everything that has been initiated from the inside so what we're going to do is we're going to create a rule and we're going to call this block web and we're going to drop the traffic it'll be TCP and we will do new establish and related source since it's just the web will be port 80 and destination we're going to leave like we'll go ahead and save that and now what you'll see here is since we didn't move that rule when I go to a web site it loads fine because it processes these rules in order and our first rule is accepting everything so we're going to move this up and make it rule number one and we're going to save the rural order and then when we try to refresh this you're going to see it just says connecting connecting connecting connecting and it never does anything but if we come over here to the stats will see that this block web is incrementing if we go over here and we go to Facebook Facebook redirects to HTTPS which is a different port so it loads so the allow establish related you're going to see it incrementing but then the block block web is also aggravating because it's dropping the other one is incrementing because it is accepting so how do we change that well what we'll do is we could we could try to stack more ports in here I don't recommend it I like everything to be clear and concise so when I open this up I see boom block web port 80 destination protocol we're dropping very clear to me we'll add another rule we'll call this block secure web will drop it'll be TCP establish new related source port 443 destination we're going to leave that alone for now we're not going to touch the time yet we'll drag this guy out and put them right underneath rule number one so now if i refresh this sea just says waiting waiting waiting waiting waiting it is eventually going to come back and it's going to look like this and we can tell these are working because our action is drop and our packets and our bytes are incrementing so we are we're matching those rules and the routers do what it's supposed to do the firewall is doing what's supposed to is blocking those packets so boom all right so how do we know 100% sure that that's working okay I don't know if that's really the question you're asking but I'm going to show you so you know how we left the destination blank let's say that you've got an IP address on a tablet internally or a laptop or a computer and you've bound that in your DHCP server and so the IP address so that never change or let's let's say that when you use your configuration wizard that you use some of the ports as a different subnet so you could change the destination and have this affect some addresses or some networks but not others so on this computer we are 192 168 1 dot 2 so if we take this destination for block web and we go in here and we change the destination because this is the destination is on the inside of the firewall sources on the outside when you're talking about block and traffic from the the wyeth 0 in that's how we got to think about this but let's say that I want to block it let's say that my kids computer is 1.3 so we change this rule 10 to block port 80 destined for 192 168 1.3 so I'm 1.2 so if I hit refresh look waiting and boom the site loads however Facebook still because we didn't modify that HTTP rule for the secure web rule it is still incrementing and it's still blocked so we come back over here to our rules and we come in here and we take out that destination so if you're doing dnat and you've got you know what you've got to do is you'll have to add a rule call allow web server you're going to allow TCP but this time you would have a destination of port 80 so you'll see there's a differentiation in the rules one we are blocking a source the other one we are allowing a destination so this configuration would block your your people behind the router from surfing port 80 and 443 but would still allow port 80 to be forwarded from the outside so real quick before we wrap this up let's take a look at these rules and we'll just touch on the time configuration and this is something that you're really going to have to experiment with and and kind of mold it to your liking but if we come in here we go to time I think what I want to do is I want to block the web on Sundays and we're gonna start that 2016 0 7 13 so starting tomorrow and 1:00 a.m. we're gonna block the web on Sundays I encourage you to get in there you're not really going to mess this thing up you can always delete the rules but part of learning is touching it and and seeing how it reacts and getting it in your hands very important so now what we've got is for rule number 10 or our our block web rule which shows up over here in order number one is we're going to block that starting on Sundays so if we refresh my site you can see it came up so let's go to blog let's make sure it's not a fluke so it comes up and it's working so let's see if we get to Facebook and there's the rub see we are just still blocking that full time so you see that secure still anchor incrementing so if we came into this rule we did a time-based rule on this where we're going to block on Sunday then you could invert it and only if you click match all weekdays except for these no but a lot I'm sorry it would allow it on Sunday and block the rest of it it's kind of hard to think about inversion there but we will do the same thing and there's Facebook so another thing now that we're talking about we talked about our destination rules so let's say that that you've got a web server you know behind this or you want to allow SSH through but you only want to do it let's say that you're a small company and you're going to do the maintenance of Linux servers inside you know and your maintenance window is Saturdays or Sundays you can come in here on this except this port let's just pretend that this was SSH and you could do the same thing so you can allow this rule to work on Sunday during your maintenance window so I think that that kind of wraps it up for the way in the e e:0 direction in if you liked the video please give a thumbs up please subscribe please comment share ask questions we'll work through some of this together if you ask questions I promise and we will see you at video number two

Channel: Willie Howe

Views: 82,253

Rating: 4.9130435 out of 5

Keywords: edgeos firewall rules, wan in firewall rules, edgerouter firewall rules, edgerouter block traffic, edgeos block web, edgerouter block web, edgeos block, edgerouter block, edgeos wan_in, edgerouter wan_in, edgemax wan_in, edgemax block inbound, edgeos block inbound, edgerouter block inbound, ubiquiti firewall, ubiquiti firewall rules, time based firewall, time based firewall rules, dnat, edgeos dnat, edgeos nat

Id: HTNcgVneX08

Length: 10min 58sec (658 seconds)

Published: Tue Jul 12 2016