概述
本文介绍了如何创建防火墙规则来保护路由器和局域网(LAN)。本文创建的规则也可以通过运行“ Basic Setup”向导来自动创建。
添加防火墙规则
EdgeRouter 使用 stateful 防火墙,这意味着路由器防火墙规则可以在不同的连接状态上匹配。流量状态为:
new
传入未知的数据包。established
传入的数据包已建立连接。related
传入的数据包是未知的,但与源已建立连接。invalid
传入的数据包与其他状态都不匹配。
使用这些防火墙状态,路由器可以根据连接状态沿不同方向接收/丢弃流量。例如,路由器可以阻止从 WAN 到 LAN 的所有流量,除非它是与现有连接有关的返回流量。EdgeOS 中的 Basic Setup 向导将以下防火墙规则添加到路由器:
WAN_IN
匹配通过路由器(WAN 到 LAN)传递的已建立/相关的无效流量。WAN_LOCAL
匹配目的为路由器本身的已建立和无效流量(WAN 到 LOCAL)。
请按照以下步骤从“ Basic Setup:” 向导手动创建防火墙策略:
1.打开 Firewall/NAT 选项卡。
2.添加 WAN_IN 防火墙策略,并将默认操作设置为 drop。
Firewall/NAT > Firewall Policies > + Add Ruleset
Name: WAN_IN //填写规则名字
Description: WAN to internal //对规则的备注
Default action: Drop //将默认操作设置为 drop
- 将两个规则添加到新创建的防火墙策略中。
Firewall/NAT > Firewall Policies > WAN_IN > Actions > Edit Ruleset > + Add New Rule
Description: Allow established/related //对规则的备注,允许建立
Action: Accept //设置操作为允许
Protocol: All protocols //设置对象为所有协议
Advanced > State: Established / Related //设置状态为已建立
Firewall/NAT > Firewall Policies > WAN_IN > Actions > Edit Ruleset > + Add New Rule
Description: Drop invalid state //对规则的备注,阻止
Action: Drop //设置操作为阻止
Protocol: All protocols //设置对象为所有协议
Advanced > State: Invalid //设置状态为无效
- 在 in 将防火墙策略附加到 WAN 接口。
Firewall/NAT > Firewall Policies > WAN_IN > Actions > Interfaces
Interface: eth0 //设置接口为 eth0
Direction: in //对规则解释,为 in
- 添加 WAN_LOCAL 防火墙策略,并将默认操作设置为 drop。
Firewall/NAT > Firewall Policies > + Add Ruleset
Name: WAN_LOCAL //填写规则名字
Description: WAN to router //对规则的备注
Default action: Drop //将默认操作设置为阻止
5.将两个规则添加到新创建的防火墙策略中。
Firewall/NAT > Firewall Policies > WAN_LOCAL > Actions > Edit Ruleset > + Add New Rule
Description: Allow established/related //对规则的备注,允许建立
Action: Accept //设置操作为允许
Protocol: All protocols //设置对象为所有协议
Advanced > State: Established / Related //设置状态为已建立
Firewall/NAT > Firewall Policies > WAN_LOCAL > Actions > Edit Ruleset > + Add New Rule
Description: Drop invalid state //对规则的备注,阻止
Action: Drop //设置操作为阻止
Protocol: All protocols //设置对象为所有协议
Advanced > State: Invalid //设置状态为无效
6.在 LOCAL 方向上将防火墙策略附加到 WAN 接口。
Firewall/NAT > Firewall Policies > WAN_LOCAL > Actions > Interfaces
Interface: eth0 //设置接口为 eth0
Direction: local //对规则解释,为 local
也可以使用 CLI 设置以上配置:
1.进入配置模式。
configure
2.配置 WAN_IN 防火墙策略。
set firewall name WAN_IN default-action drop
set firewall name WAN_IN description 'WAN to internal'
//建立 wan in 规则,并对其添加备注
set firewall name WAN_IN rule 10 action accept
set firewall name WAN_IN rule 10 description 'Allow established/related'
set firewall name WAN_IN rule 10 state established enable
set firewall name WAN_IN rule 10 state related enable
//建立规则 10 放行所以协议流量
set firewall name WAN_IN rule 20 action drop
set firewall name WAN_IN rule 20 description 'Drop invalid state'
set firewall name WAN_IN rule 20 state invalid enable
//建立规则 20 阻止流量
3.配置 WAN_LOCAL 防火墙策略。
set firewall name WAN_LOCAL default-action drop
set firewall name WAN_LOCAL description 'WAN to router'
//建立 wan local 规则,并对其添加备注
set firewall name WAN_LOCAL rule 10 action accept
set firewall name WAN_LOCAL rule 10 description 'Allow established/related'
set firewall name WAN_LOCAL rule 10 state established enable
set firewall name WAN_LOCAL rule 10 state related enable
//建立规则 10 放行所以协议流量
set firewall name WAN_LOCAL rule 20 action drop
set firewall name WAN_LOCAL rule 20 description 'Drop invalid state'
set firewall name WAN_LOCAL rule 20 state invalid enable
//建立规则 20 阻止流量
4.在 inbound 和 local 上将防火墙策略添加到 WAN 接口。
set interfaces ethernet eth0 firewall in name WAN_IN
set interfaces ethernet eth0 firewall local name WAN_LOCAL
5.提交更改并保存配置。
commit ; save
完整的 CLI 配置如下:
configure
set firewall name WAN_IN default-action drop
set firewall name WAN_IN description 'WAN to internal'
set firewall name WAN_IN rule 10 action accept
set firewall name WAN_IN rule 10 description 'Allow established/related'
set firewall name WAN_IN rule 10 state established enable
set firewall name WAN_IN rule 10 state related enable
set firewall name WAN_IN rule 20 action drop
set firewall name WAN_IN rule 20 description 'Drop invalid state'
set firewall name WAN_IN rule 20 state invalid enable
set firewall name WAN_LOCAL default-action drop
set firewall name WAN_LOCAL description 'WAN to router'
set firewall name WAN_LOCAL rule 10 action accept
set firewall name WAN_LOCAL rule 10 description 'Allow established/related'
set firewall name WAN_LOCAL rule 10 state established enable
set firewall name WAN_LOCAL rule 10 state related enable
set firewall name WAN_LOCAL rule 20 action drop
set firewall name WAN_LOCAL rule 20 description 'Drop invalid state'
set firewall name WAN_LOCAL rule 20 state invalid enable
set interfaces ethernet eth0 firewall in name WAN_IN
set interfaces ethernet eth0 firewall local name WAN_LOCAL
commit ; save