UISP - Setting firewall on UISP devices

Introduction

This article explains how to configure a firewall using a web browser and applies to the following devices:

• UISP Router
• UISP Router Pro
• UISP Console

At this time, firewall rules can only be edited through the device’s local WebUI, not directly within the UISP application. The local WebUI can be accessed using the Remote Access feature in UISP.

This article covers both firewall and NAT configuration in UISP. NAT controls how traffic is rewritten, including source and destination IP addresses and ports for TCP and UDP traffic, but does not determine whether traffic is allowed or blocked. Firewall rules define how traffic is handled, such as whether traffic is allowed, dropped, or rejected.

To verify that the firewall is configured as expected, run the following commands directly on the device: iptables -nvL, ip6tables -nvL

NAT

Firewall Rules

Firewall directions

Configuration Properties

Rule

Source and Destination

Action

Connection State

Valid for firewall rules only. Matching is based on the connection tracking table.

Groups

Firewall groups enable the creation of sets of IPs and/or IP subnets, ports, or MAC addresses. The use of groups in firewall and NAT rules enables shorter, more easily manageable rule sets. For example, you might create a firewall group for publicly accessible web servers listing their IP addresses, and another group for the ports allowed to those web servers. Then, if a new web server is added or removed in the future, or an additional port must be allowed to those servers, it’s simply a matter of modifying the appropriate group, rather than potentially several firewall rules. 

Examples

Dropping Bogons

Bogon IP Addresses are IP addresses not assigned to any entity by the Internet Assigned Numbers Authority (IANA) and Regional Internet Registries (RIR's). These IP addresses can be used in a malicious manner because they are not able to be traced back to a definitive source. To block these addresses, perform the following steps:

1. Create the address group with bogon subnets: 0.0.0.0/8, 127.0.0.0/8, 224.0.0.0/3

2. Create a destination IP address group rule for bogon addresses in the Forward chain.

   Filter rule

   Screenshot

   Chain name: Forward
   Protocol: All protocols
   IP Version: IPv4
   Destination Group: Bogon_Subnets (Address group)

   

3. Create a source IP address group rule for bogon addresses in the Forward chain.

   Filter rule

   Screenshot

   Chain name: Forward
   Protocol: All protocols
   IP Version: IPv4
   Source Group: Bogon_Subnets (Address group)

   
4. Move the rules to your desired position in the Forward chain.

Port Forwarding

*This is meant as an example only. Apply configuration for your subnets, hosts, and interfaces accordingly.  

Two rules must be configured to make the port forward function as desired. The NAT prerouting (DNAT) rule will translate the destination IP to the proper internal IP address. The filter rule in the forward chain will allow the packet to be accepted and pass through the firewall to the LAN host.

User Tip: For the filter rule to function properly, place the rule in the Forward chain above the predefined Drop rules.

NAT Prerouting

1. Only the Prerouting rule is necessary in this case.

   Prerouting Rule

   Screenshot

   Prerouting Rule
   Chain Name: Prerouting
   Protocol: TCP
   IP Version: IPv4
   Inbound Interface: 9.1010
   Destination Address: 198.51.100.1
   Destination Port: 22
   Translation Address: 192.168.1.231

   

Filter Forward

1. In this case, only the filter rule needs to be created

   Filter rule

   Screenshot

   Filter rule
   Protocol: TCP
   IP Version: IPv4
   Inbound interface: 9.1010
   Destination address: 192.168.1.231
   Destination port: 22
   Target: Accept

   

Hairpin for Port Forwarding

Two NAT rules need to be configured to achieve NAT hairpin.

1. Create a DNAT (prerouting) rule to translate the public IP to LAN IP address of the 192.168.1.231 host.

   Prerouting Rule

   Screenshot

   Prerouting Rule
   Chain Name: Prerouting
   Protocol: TCP
   IP Version: IPv4
   Inbound Interface: br0
   Source Address: 192.168.1.0/24
   Destination Address: 198.51.100.1
   Destination Port: 22
   Translation Address: 192.168.1.231

   

2. The second rule is a Postrouting masquerade to achieve symmetric routing. This ensures that return traffic is sent to the proper destination IP address.

   Postrouting Rule

   Screenshot

   Postrouting Rule
   Chain Name: Postrouting
   Protocol: All protocols
   IP Version: IPv4
   Source Address: 192.168.1.0/24
   Outbound Interface: br0
   Target: Masquerade

   

Source NAT (Postrouting) with multiple public IPs

Note: For this configuration to function properly, these specific rules must be placed above the default masquerade rule.

LAN whole subnet SNAT

Example configuration:

Subnet: 192.168.1.0/24
Public IP Range: 198.51.100.1 - 198.51.100.7
Desired Public IP Address: 198.51.100.7

1. One postrouting rule must be created

   Postrouting Rule

   Screenshot

   Postrouting Rule
   Chain Name: Postrouting
   Protocol: All protocols
   IP Version: IPv4
   Source Address: 192.168.1.0/24
   Outbound Interface: 9.1010
   Target: SNAT
   Translation Address: 198.51.100.7

   

LAN single host SNAT

Example configuration:
LAN Host: 192.168.1.231
Public IP Range: 198.51.100.1 - 198.51.100.7
Desired Public IP Address: 198.51.100.4

1. One postrouting rule must be created

   Filter rule

   Screenshot

   Postrouting Rule
   Chain Name: Postrouting
   Protocol: All protocols
   IP Version: IPv4
   Source Address: 192.168.1.231
   Outbound Interface: 9.1010
   Target: SNAT
   Translation Address: 198.51.100.4

   

LAN isolation

Note that in this example, port 1 is the WAN.

1. Create FWD_IN_LAN ruleset. This matches forwarding traffic entering from all non-WAN ports.

   Filter rule

   Screenshot

   Ruleset
   Default action: DROP
   Interface !1 Direction FORWARD IN

   

2. Add an exception for internet traffic.

   Filter rule

   Screenshot

   Firewall rule
   Ruleset FWD_IN_LAN
   Action ACCEPT
   Protocol All
   Outbound interface 1

   

3. Create FWD_OUT_LAN ruleset. This matches forwarding traffic exiting to all non-WAN ports.

   Ruleset
   Default action: DROP
   Interface !1 Direction FORWARD OUT

4. Add an exception for internet traffic. Modify the connection state as required by your use case.

   Firewall rule
   Ruleset FWD_OUT_LAN
   Action ACCEPT
   Protocol All
   Inbound interface 1
   Connection State Established or Related