Security, VPN and accounts#
This section documents the web interface's Protect group — Firewall, NAT, IDS, WireGuard, IPsec and OpenVPN — the Users and API tokens pages from the Admin group, and the Account page, which opens from the account menu at the top right and from your name at the bottom of the navigation. The other two Admin pages, Agent settings and Licence, are documented with the services.
Two kinds of page live here. The firewall, NAT, IDS and VPN pages edit the router's configuration: a change made in their editors is added to the pending changes, and nothing reaches the router until somebody applies them from the bar at the bottom of the page. The accounts pages — Users, API tokens, Account — are not router configuration at all: they change the web interface's own records, and they take effect the moment you save.
Where each screen is#
| Screen | In the web interface | Address | Who sees it |
|---|---|---|---|
| Firewall | Protect → Firewall | /firewall | anyone signed in |
| NAT | Protect → NAT | /nat | anyone signed in |
| IDS | Protect → IDS | /ids | anyone signed in, once the feature is on |
| WireGuard | Protect → WireGuard | /wireguard | anyone signed in, once the feature is on |
| IPsec | Protect → IPsec | /ipsec | anyone signed in |
| OpenVPN | Protect → OpenVPN | /openvpn | anyone signed in |
| Account | the account menu at the top right, or your name at the bottom of the navigation | /account | anyone signed in |
| Users | Admin → Users | /users | admins |
| API tokens | Admin → API tokens | /tokens | admins |
The admin pages are not part of the web interface at all for somebody who is not an admin, and the agent refuses their requests from anyone else.
The pages#
| Page | The screen it documents |
|---|---|
| Firewall | The screen itself: both address families, the chains and named rule sets, the connection state policy, the global options, the country data, and where the hit counters come from. |
| Firewall — rules | The rule table column by column, and the rule editor field by field: matches, countries, schedules, rate and repeat limits, going to a rule set. |
| Firewall — groups | The eight group kinds, the group editor, and matching on a group from a rule instead of a literal. |
| Worked rulesets | Three rulesets in full: a default-drop edge, a published service, and a segment that may not reach the LAN. |
| NAT | Three tables on one page — port forwards, 1:1, source NAT — with per-rule counters. |
| Port forwards | The port forward editor, the Forward rule that admits it, and reaching the service from inside on its public address. |
| Source NAT | Adding a rule where it will match, masquerade and fixed-address translation, and the rule the installer writes. |
| 1:1 NAT | A public address for one device, every port, both ways: the editor, how a mapping is numbered, and what it refuses. |
| IDS | Suricata intrusion detection: turning it on, its interfaces and groups, its rules and their scheduled update, the alerts, and what detection does not do. |
| Inline prevention | Putting the engine in the path of the traffic, what keeps traffic flowing if it stops, and the safe way to turn it on. |
| WireGuard | Tunnels and peers: adding and changing either, and adding a phone or laptop with a QR code. |
| IPsec | Site-to-site peers beside the live security associations, and the panel that adds and changes a peer with its keys and groups. |
| OpenVPN | Servers, clients and site-to-site ends, with their certificates and keys, and a server's clients: added, revoked, and given their files. |
| Users | Accounts, roles, adding and deleting users, password resets, clearing somebody's two-factor authentication, and linking a user to an identity provider. |
| Roles | What viewer, approver, operator and admin may each do, as the agent enforces it. |
| Account | Your own password, Advanced mode, two-factor authentication and its recovery codes, your sessions, and unlinking single sign-on. |
| API tokens | Issuing a token with a role of its own, the one time the token is shown, expiry and revocation. |
| Single sign-on | What signing in through an identity provider does, what the web interface manages, and what only the agent's own options can change. |
What holds across the configuration pages#
Nothing on the Firewall, NAT, IDS or VPN pages changes the router when you click. Each editor adds its change to the pending changes. The bar that then appears at the bottom of the page counts them — N pending changes — and Review changes lists each one as a sentence, with a button to remove it. Apply changes sends them to the router; Discard throws them away. The pending changes are shared by everybody signed in to this router, not kept per browser. Two buttons act at once because they change no configuration: Update rules now on the IDS page and Update country data now on the Firewall page's Settings tab fetch the router's data files.
Changes that could cut you off are marked. The bar marks a change to the firewall or NAT, to the SSH or HTTPS services, to an interface's addressing or to an interface the router reaches the internet through, and to the default route, among others, and says "These changes could cut off your connection to the router. Apply with auto-revert undoes them if you lose access." Apply with auto-revert applies them and waits for you to press Keep changes; if nobody does within the auto-revert window — two minutes unless an admin changes it on Agent settings — the router restarts with its saved configuration.
Reading needs a session. Changing needs a role and a licence. Every page here can be read by anyone signed in. Preparing a change needs the operator role, and applying one needs at least the approver role; both need a usable licence. The Users and API tokens pages, and Agent settings, need the admin role.
Secrets are hidden below the admin role. When a viewer, an approver or an operator reads the router's configuration, private keys, pre-shared keys and other credentials come back hidden — Roles lists what is and is not. WireGuard keys are withheld from every reader, and a key the agent generates for a tunnel or an OpenVPN client never reaches the browser; a WireGuard device's key reaches it once, in the configuration the device imports.
Two pages are hidden until their feature is on. IDS and WireGuard appear in the navigation when their switch is on in Apps or when their configuration already exists on the router — so a router that already runs WireGuard shows the page whatever the switch says. Firewall and NAT are never hidden.
In Advanced mode, each of these pages also shows the configuration commands its changes become.
What this section will not tell you#
- The whole compiled firewall at once. In Advanced mode, the Firewall page's nftables view shows one ruleset at a time: what the router compiled each rule's match into, with its packet and byte counters. Nothing shows every chain the router compiled in one place.
- IPv6 NAT. The NAT page covers IPv4 NAT only. Nothing on it reads or writes IPv6 NAT.
- Raw WireGuard byte counters. Handshake age, active or inactive, endpoint, allowed IPs and transfer are shown per peer, but transfer is the router's own wording ("6 KB sent") rather than a number, because that is all the router reports.
See also#
- Pending changes — why nothing on a configuration page changes the router when you click it.
- The Commit Bar and Apply with auto-revert — how pending changes are applied.
- Read, write and admin planes — the concept behind Roles.
- Task guides — security — the same jobs, start to finish.
- The HTTP API — every route these screens call.