Firewall setup example

[yuanyudistira]

Dear all

Is there anyone here can share or help me setting up firewall?

I only will allow browsing internet, access email, ftp for some client.
others applications should not go to internet.

And regarding email, only my email server is able to send email.
PC from my network should not send email (probably virus / spyware)

Please help


Thanks

YUAN

[dmorris]

just set to the default rule to block, then add all the ports you would like to pass in a rule.

port 53 for DNS, 80 for web, etc.

[yuanyudistira]

Thanks for your reply,

But do you have a list of common port that I should know?

YUAN

Originally Posted by dmorris

just set to the default rule to block, then add all the ports you would like to pass in a rule.

port 53 for DNS, 80 for web, etc.

[WebFooL]

Hi,

Allow FTP

Enable Rule: Yes
Description: Allow FTP 21 
Action: Pass
Log: Up to you
Rule
Traffic Type: TCP AND UDP
Source Interface: Internal
Destination Interface: External
Source Address: any (or limit by 192.168.10.2,192.168.10.5)
Destination Address: any
Source Port: any
Destination Port: 21

Allow DNS:

Enable Rule: Yes
Description: Allow DNS 53
Action: Pass
Log: Up to you
Rule
Traffic Type: TCP AND UDP
Source Interface: Internal
Destination Interface: External
Source Address: any
Destination Address: any
Source Port: any
Destination Port: 53

HTTP Port 80:

Enable Rule: Yes
Description: Allow Port 80 HTTP
Action: Pass
Log: Up to you
Rule
Traffic Type: TCP AND UDP
Source Interface: Internal
Destination Interface: External
Source Address: any
Destination Address: any
Source Port: any
Destination Port: 80

HTTPS Port 443:

Enable Rule: Yes
Description: Allow Port 443 HTTP
Action: Pass
Log: Up to you
Rule
Traffic Type: TCP AND UDP
Source Interface: Internal
Destination Interface: External
Source Address: any
Destination Address: any
Source Port: any
Destination Port: 443

Read this thread on how to only allow one ip to send SMTP traffic
http://forums.untangle.com/networkin...il-server.html

for port numbers you can use:
http://www.iana.org/assignments/port-numbers

[running]

This is interesting, i was looking for this kind of info to. I have a bit more question

If i select block all and had those rules but i am also running a mail server do i need to put other rules?

Is open VPN in need of something special?

Thank you i advance

[running]

Anyone with an idea?

[3minds]

If i select block all and had those rules but i am also running a mail server do i need to put other rules?

Yes, add the POP and SMTP ports and select it only for your mail server if other computer is not allowed to send mail. Otherwise, accept for the internal source

Yes, for openVPN, you need to set some rules. You can follow this tutorial

http://www.vancocomputing.com/blogs/...configuration/

Good luck

[running]

thank you!

[maxim]

Thank you for this thread. It was very helpful!

[kirkcaine]

keep for notes