Network Objects/Groups

[Chris11891]

I have been playing around with Untangle 9 and thinking about switching but there is one feature of my current firewall that I am not seeing on Untangle. The curent feature is Network Objects which allow me to assign names to single IP addresses, groups of IP addresses or ranges of IP addresses. I use this to allow certain people access to specific resources. This makes it much easier to update an external IP when it IP changes becuase it is a dynamic address.

I like everythign that I've seen to this point but it seems like this might be a deal breaker as I've only seen IP address ranges in firewall policies and there doesn't appear to be any naming association.

I just wanted to be certain this was not hiding anywhere before I invested more time researching. If I need to submit this to feature requests, I would be happy to do so.

[dwasserman]

Each UTM handles this with their own metaphors, in Untangle you can do this with the policy manager if I understand well your request.

[hs-admin]

Policy manager will do that for you.
I use it on a school campus with students and teachers getting different online resources. Creating various subnets for locations on campus also helps keep the resource access organized and easy to identify which group (student/teacher) or location (computer lab/library) gets what access rights. Each subnet gets its own "rack" which controls those access rights. Such as teachers have access to you tube student computers do not.
You can set mac address association to be sure each machine gets the IP which corresponds to the proper access rights.
Hope this helps.

[sky-knight]

No, Untangle doesn't have the feature he's requesting... and I really wish it did.

What he wants is the ability to define an IP address, or list of IP addresses to a variable, so that variable can be referenced in a rule set. Some firewalls call this "services".

This would be the same feature that would allow you to define a given external address as "webserver" and another as "mailserver" and instead of forwarding tcp 80 destined to w.x.y.z to the web server's LAN address, you'd forward stuff destined to "webserver". Same deal for TCP 25 to the mail server.

This could be further expanded to allow interfaces to be assigned to a name other than the virtual name already present. So you could create an "alias" of sorts for "dmz" that calls it "Wan2" if you needed.

The Policy Manager + Directory Connector can do this sort of, when it comes to building a list of usernames to IP addresses. So you can make rules based on user name and group name instead of addresses. While this functionality is an alias of sorts, it's dynamically defined and not what is being asked for in the OP.