Worked rulesets#

Three rulesets, in full, in the order most people build them. Each one is given as the commands it consists of, so it can be typed at the console, staged from the rule editor field by field, or read as a check against what your router already has. Every address is from a documentation range or RFC 1918; substitute your own.

Throughout: eth1 is the uplink, eth0 is the LAN, eth2 is a second segment.

1. A default-drop edge#

This is what the installer writes when its Firewall box is left checked and a WAN was chosen. It does not need a LAN — a router with a WAN and no LAN is the machine that most needs a closed front door. Reproduced here from packaging/wheelhouse-install, which is the file that generates it.

The global state policy first. Without it, every rule below would need its own state match for return traffic:

set firewall global-options state-policy established action accept
set firewall global-options state-policy related action accept
set firewall global-options state-policy invalid action drop

IPv4, traffic to the router and traffic through it:

set firewall ipv4 input filter default-action drop
set firewall ipv4 input filter rule 10 action accept
set firewall ipv4 input filter rule 10 description "LAN to router"
set firewall ipv4 input filter rule 10 inbound-interface name eth0
set firewall ipv4 input filter rule 20 action accept
set firewall ipv4 input filter rule 20 description "loopback"
set firewall ipv4 input filter rule 20 inbound-interface name lo
set firewall ipv4 input filter rule 30 action accept
set firewall ipv4 input filter rule 30 description "ping"
set firewall ipv4 input filter rule 30 protocol icmp
set firewall ipv4 input filter rule 40 action accept
set firewall ipv4 input filter rule 40 description "DHCP from the provider"
set firewall ipv4 input filter rule 40 inbound-interface name eth1
set firewall ipv4 input filter rule 40 protocol udp
set firewall ipv4 input filter rule 40 destination port 68
set firewall ipv4 forward filter default-action drop
set firewall ipv4 forward filter rule 10 action accept
set firewall ipv4 forward filter rule 10 description "LAN out"
set firewall ipv4 forward filter rule 10 inbound-interface name eth0

IPv6, the same shape:

set firewall ipv6 input filter default-action drop
set firewall ipv6 input filter rule 10 action accept
set firewall ipv6 input filter rule 10 description "LAN to router"
set firewall ipv6 input filter rule 10 inbound-interface name eth0
set firewall ipv6 input filter rule 20 action accept
set firewall ipv6 input filter rule 20 description "loopback"
set firewall ipv6 input filter rule 20 inbound-interface name lo
set firewall ipv6 input filter rule 30 action accept
set firewall ipv6 input filter rule 30 description "ICMPv6 (neighbour discovery, path MTU)"
set firewall ipv6 input filter rule 30 protocol icmpv6
set firewall ipv6 input filter rule 40 action accept
set firewall ipv6 input filter rule 40 description "DHCPv6 from the provider"
set firewall ipv6 input filter rule 40 inbound-interface name eth1
set firewall ipv6 input filter rule 40 protocol udp
set firewall ipv6 input filter rule 40 destination port 546
set firewall ipv6 forward filter default-action drop
set firewall ipv6 forward filter rule 10 action accept
set firewall ipv6 forward filter rule 10 description "LAN out"
set firewall ipv6 forward filter rule 10 inbound-interface name eth0
set firewall ipv6 forward filter rule 20 action accept
set firewall ipv6 forward filter rule 20 description "ICMPv6 through the router"
set firewall ipv6 forward filter rule 20 protocol icmpv6

Five things about that ruleset are choices, and each of them is one you may want to revisit.

Rule 10 admits everything from the LAN interface, including the management UI. The agent listens on 0.0.0.0:8443, so on a router with this ruleset anything on the LAN can reach the web UI. Narrowing that means replacing rule 10 with rules that name the protocols and ports the LAN is allowed to reach on the router.
ICMP is accepted on every interface, WAN included. On IPv4 that is a preference: a router that does not answer ping is harder to diagnose. On IPv6 it is not — neighbour discovery and path-MTU discovery are ICMPv6, and dropping them costs the router its own default route.
Rule 40 exists so a lease renewal does not depend on connection tracking alone. It is only written when the uplink is DHCP on IPv4; the IPv6 one is always written, because a delegated prefix arrives over DHCPv6 on providers that do not use plain SLAAC.
Nothing here opens 8443 from the WAN, and nothing here opens anything through the router from the WAN. Both directions are closed by the two default-action drop lines.

A management source, if you gave the installer one, appears as rule 50 in whichever family that address belongs to:

set firewall ipv4 input filter rule 50 action accept
set firewall ipv4 input filter rule 50 description "management source"
set firewall ipv4 input filter rule 50 source address 203.0.113.0/24

Check what you actually have — on the router:

bash

show configuration commands | match firewall

An empty answer on a router with an uplink is an emergency, not a preference. In the web UI the same check is the four tiles at the top of the Firewall page, on both families.

2. Publishing one service to the internet#

Two things have to be true for an inbound connection to reach a host behind the router: the destination has to be translated, and the forward chain has to permit the translated packet. NAT alone does nothing — the packet is rewritten and then meets forward filter default-action drop.

The add-forward editor stages both halves together, and this is what it produces for HTTPS to 10.0.10.20, with the accept rule left checked:

set nat destination rule 100 inbound-interface name eth1
set nat destination rule 100 protocol tcp
set nat destination rule 100 destination port 443
set nat destination rule 100 translation address 10.0.10.20
set nat destination rule 100 description 'https to the web server'
set firewall ipv4 forward filter rule 100 action accept
set firewall ipv4 forward filter rule 100 inbound-interface name eth1
set firewall ipv4 forward filter rule 100 destination address 10.0.10.20
set firewall ipv4 forward filter rule 100 description 'allow https to the web server'

The accept rule the editor writes matches the inside address, because that is what the packet carries by the time the forward chain sees it. It is deliberately no narrower than that: it does not name the port. If you want the tighter rule, add the port to it in the rule editor afterwards:

set firewall ipv4 forward filter rule 100 protocol tcp
set firewall ipv4 forward filter rule 100 destination port 443

Two limits of the helper, both worth knowing before you rely on it:

It writes IPv4 only. The accept rule is staged under firewall ipv4 forward filter. A dual-stack service needs its IPv6 forward rule written by hand — and on IPv6 there is no translation to write, only the accept.
It picks its own rule number. The accept rule takes the NAT rule's number when that number is free in the forward chain; when that number is taken it counts up in tens until it finds one that is not, so the helper can never overwrite a forward rule you already had.

3. A segment that may not reach the LAN#

A guest or IoT segment on eth2, 10.0.20.0/24, that may reach the internet and the router's own DNS and DHCP, and may not reach the LAN on 10.0.10.0/24. This is the case groups exist for: the sets are named once and every rule follows them.

The groups:

set firewall group network-group LAN-NETS network 10.0.10.0/24
set firewall group network-group GUEST-NETS network 10.0.20.0/24
set firewall group port-group GUEST-SERVICES port 53
set firewall group port-group GUEST-SERVICES port 67

What the segment may ask of the router itself. The input chain already defaults to drop and already accepts everything from eth0; eth2 is not eth0, so guests reach nothing on the router until this rule exists:

set firewall ipv4 input filter rule 60 action accept
set firewall ipv4 input filter rule 60 description 'guest DNS and DHCP'
set firewall ipv4 input filter rule 60 inbound-interface name eth2
set firewall ipv4 input filter rule 60 protocol udp
set firewall ipv4 input filter rule 60 destination group port-group GUEST-SERVICES

What the segment may do through the router. The drop comes first, at a lower rule number, because rules are evaluated in ascending number order and the editor's default numbering leaves gaps of ten precisely so a rule can be inserted ahead of another later:

set firewall ipv4 forward filter rule 30 action drop
set firewall ipv4 forward filter rule 30 description 'guest may not reach the LAN'
set firewall ipv4 forward filter rule 30 source group network-group GUEST-NETS
set firewall ipv4 forward filter rule 30 destination group network-group LAN-NETS
set firewall ipv4 forward filter rule 30 log
set firewall ipv4 forward filter rule 40 action accept
set firewall ipv4 forward filter rule 40 description 'guest to the internet'
set firewall ipv4 forward filter rule 40 inbound-interface name eth2
set firewall ipv4 forward filter rule 40 outbound-interface name eth1

Rule 40 names the outbound interface as well as the inbound one, so it permits the segment to the uplink and not to anything else the router can route. Rule 30 is redundant against rule 40 alone, and it is there anyway: it logs the attempts, and it survives someone later widening rule 40.

Three traps in this shape, in the order they catch people:

The LAN keeps its own rule. forward rule 10 from the default-drop edge accepts everything inbound on eth0, which includes the LAN reaching the guest segment. That is usually what you want. If it is not, add a matching drop below rule 10 and above it in number.
A VLAN is its own interface. If the segment is eth0.20 rather than eth2, name eth0.20 in these rules. The Firewall page uses the same convention when it reports where a named ruleset is attached — it labels a VLAN attachment eth1.10.
Source NAT is separate. Reaching the internet also needs the segment's addresses translated. See source NAT; the installer's masquerade rule matches the LAN network only.

Add IPv6 as its own set of rules if the segment has IPv6 at all. Nothing above filters it.

Checking any of these worked#

On the router:

bash

show firewall statistics

In the UI, the same counters are the Packets and Bytes columns of the rule table, refreshed every five seconds. A rule you expected to match and which is not counting is either below a rule that matched first, in the wrong chain, or in the wrong address family.

For a rule with log, the matches appear in the router's journal; the Logs page reads the same journal.

Undoing one#

Every ruleset above is a set of configuration operations, so the two ways back are the two the product gives you everywhere:

Delete the rules, from the rule editor's Delete rule or by staging the delete lines yourself, and commit.
Roll back the commit from the commit history, which restores the configuration revision from before it.

If a commit has cut you off, the answer is the confirm window rather than either of those: a commit-confirm that is never confirmed reverts on its own.

Checked against#

packaging/wheelhouse-install, ui/src/pages/Firewall.tsx, ui/src/pages/Nat.tsx, docs/security.md, docs/install.md.