Firewall — groups#
A firewall group is a named set — of addresses, networks, ports, domains, MAC addresses or interfaces — that rules match on by name. Change the set and every rule that names it follows. The Groups tab of the Firewall page lists every group, and the group editor adds, changes and deletes them.
The kinds#
| Type | A member is | Example | Matched by |
|---|---|---|---|
| Address group | An IPv4 address or range | 192.0.2.10, 192.0.2.10-192.0.2.19 | the source or destination of an IPv4 rule |
| Network group | An IPv4 network | 192.0.2.0/24 | the source or destination of an IPv4 rule |
| IPv6 address group | An IPv6 address or range | 2001:db8::10 | the source or destination of an IPv6 rule |
| IPv6 network group | An IPv6 network | 2001:db8::/48 | the source or destination of an IPv6 rule |
| Port group | A port, a range or a service name | 443, 8000-8100, https | the destination port of a TCP or UDP rule |
| Domain group | A domain name | example.com | the source or destination of a rule of either family |
| MAC address group | A MAC address | 00:53:00:12:34:56 | the source or destination of a rule of either family |
| Interface group | One of the router's interfaces | eth1, eth0.20 | the incoming or outgoing interface of a rule |
The rule editor offers only the groups a rule can use: an IPv6 address group is not offered on an IPv4 rule, and a port group only once the rule's protocol is TCP or UDP.
The table#
| Column | What it shows |
|---|---|
| Name | The group's name. |
| Type | One of the kinds above. |
| Members | The first four members, and how many more; the groups it includes, in another colour. |
| Used by | How many rules match on it, or Not used. |
| Description | Its description. |
The group editor#
Clicking a group opens it; Add group opens an empty one.
| Field | What it does |
|---|---|
| Type | Chosen when the group is made. |
| Name | Letters, digits, hyphens, underscores and dots; a domain group's name starts with a letter or an underscore. A name already used by a group of the same type is refused. |
| Members | Add one at a time. Each is checked for its kind before it is added — a network group refuses 192.0.2.300/24 and says what it expects — and × removes one. An interface group chooses from the router's interfaces. |
| Includes the members of | Other groups of the same type whose members this group takes in. Shown when there are any. |
| Description | Optional. |
Save changes adds only what changed: adding a member to a network group reads, in the list of pending changes, as Add 198.51.100.0/24 to network group “LAN”. A group may be saved with no members; a rule that matches on it then matches nothing.
Delete group asks twice, and is unavailable while a rule matches on the group or another group includes it. The panel lists them under Used by; change or remove those first.
Matching on a group from a rule#
In the rule editor, choose Group for the source or the destination and pick the group. For ports, choose the Port group beside the destination port. An interface group is offered in the Incoming interface and Outgoing interface lists after the router's interfaces.
Adding a second web server to a port group is then one change, and every rule that names the group picks it up when it is applied.
See also#
- Firewall — rules — the fields that match on these groups.
- Worked rulesets — a segment kept apart from the LAN with network groups.
- Firewall — the rest of the page.
- Use groups instead of literals — the guide.