|
Title: System access question re: firewall access Post by: xlancealotx on Saturday 10 April 2010, 11:01:22 pm I have an efw in beta right now and happy with the look, but wondering if I am missing something somewhere. If I have a /29 and 8 IP's have websites, I would like to make 1 rule, to simply say allow http -> webserver1, webserver2, etc. w/o allowing port 80 to ALL servers.
Looking at the "System access configuration" page, it looks like there should be a 'destination' box as well, I can limit the source address, zone, etc. but there should be a place to add destination IP's I would imagine the same way all other FW's work. If I have 10 ip's for example, I would like to make a rule to say allow SSH from ONLY this IP (or zone, host, etc.) ONLY to THIS destination IP and I just don't see that, so am I missing something obvious? Thanks ... Title: Re: System access question re: firewall access Post by: Steve on Saturday 10 April 2010, 11:26:52 pm A 'System Access' rule is a rule you create to access the Endian Firewall itself.
For example, if you wanted to access the Endian GUI from the internet you would create a System Access rule to allow port 10443 What you want to do is a simple NAT (Network Address Translation) which directs traffic to an IP BEHIND Endian. To create a rule go to Firewall > Port forward / NAT > Destination NAT Title: Re: System access question re: firewall access Post by: xlancealotx on Monday 12 April 2010, 02:35:12 am Ah, ok, Basically the current setup is;
ISP -> FW -> 3 subnets |--> public /29 - few random things specific to customers |--> public/29 -> Load Balancer -> webservers |--> private/24 for management functions ##Edited ## Sorry I had a brain hic-up. Basically my red zone will be my ISP's IP, but behind that I will have the above 2 publically accesable network's as well as a private management network (a normal 10.x) which that will be my 'green' zone. Looking at the nework wizard, I would try to guess and say the red would be my external IP from my ISP, I would then say I would need 2 orange zones if that's possible as well as my management green zone right? The wizard does say # of interfaces 4, but not sure how to proceed. As I thought, I could do a single orange, make it a /28 so both networks pass through that, and get a switch in between the 2 public networks, but basically is there a way to have 3 red's (ISP and 2 publics) or a red and 2 oranges? Thanks |