Use groups instead of literals#
You will end up with named sets — management, iot, web-ports — that firewall rules
match on instead of repeating literals. Adding a machine to the management network then
becomes one edit in one place, rather than an audit of every rule that happened to mention
it.
Before you start#
- The operator role and a licence.
- A rule or two that repeat the same address. If nothing repeats yet, this is still worth doing for anything that will grow: the second time you type an address into a rule is the moment to make a group.
The kinds, and what each holds#
Protect → Firewall → Groups.
| Type | Holds | Example member |
|---|---|---|
| Address group | IPv4 addresses and ranges | 192.0.2.1 or 192.0.2.1-192.0.2.9 |
| Network group | IPv4 networks | 192.0.2.0/24 |
| Port group | Ports, ranges and service names | 443, 8000-8100 |
| Domain group | Domain names | example.com |
| MAC address group | MAC addresses | 00:53:00:12:34:56 |
| Interface group | The router's interfaces | eth0, eth0.20 |
| IPv6 address group | IPv6 addresses | 2001:db8::1 |
| IPv6 network group | IPv6 networks | 2001:db8::/48 |
A group may also include other groups of the same type; the table shows them beside the members.
Step 1 — Create the group#
Add group, choose the type, name it, and add the members one at a time. Each is checked as it is added — a network group refuses an address without its prefix length and says what it expects.
| Type | Name | Members | Description |
|---|---|---|---|
| Network group | management | 192.0.2.0/28 | where admins sit |
| Port group | web-ports | 80, 443 |
A group may be saved with no members, when you want the name to exist before you know what goes in it.
Changing the members later is the same panel: click the group, add or remove with ×, and Save changes. The pending changes then read Add 198.51.100.0/28 to network group “management”.
Step 2 — Match on it from a rule#
In the rule editor, choose Group for the source or the destination and pick the group; only the groups that fit the rule's family are offered. For ports, choose the Port group beside the destination port once the protocol is TCP or UDP.
| Field | Value |
|---|---|
| Rule set | Input |
| Rule number | 60 |
| Action | Accept |
| Protocol | TCP |
| Source | Group: management |
| Port group | web-ports |
| Description | management to the router |
Step 3 — Apply, and then use it#
The value of a group is the second time you use it. Write the next rule with the group rather than the literal, and the one after that.
Check it worked#
The rule still matches. The Firewall page shows the counters on each rule; a rule that stopped matching when you swapped a literal for a group has the group wrong — usually the wrong type, or a network that does not cover what you thought.
Then edit the group and watch every rule follow. Add an address, apply, and check the counters on the rules that match on it — the group's Used by column says how many.
Things that will bite#
A group in use cannot be deleted. The group's Delete group is unavailable while a rule matches on it or another group includes it, and the panel lists them. Change those first.
A group is not a zone. It is a named set of values, matched in a rule. It carries no policy of its own.
Family matters. An IPv4 rule cannot match on an IPv6 network group. The editor only offers the groups that fit the family you are editing, which is why the list looks short on the IPv6 tab.
A domain group resolves names. What it matches depends on what those names resolve to, which is a moving target. Prefer addresses where you can.
Undoing it#
Point the rules back at literals, or delete them, then open the group and Delete group.