Ubiquiti UniFi Security Gateway (USG-3P) WLAN Isolate VLAN
Zur Navigation springen
Zur Suche springen
Allgemeines
Eigentlich war ich davon ausgegangen, dass durch dieses Haekchen WLAN-Clients in verschiedenen Subnetzen nur untereinander im eigenen Subnetz kommunizieren koennen. Dem ist aber nicht so, da der USG-3P mittlerweile als veraltet gilt. Er wird zwar noch fast komplett im Unifi Network 10.1.85 (Dazu muss ich auch noch einen neuen Beitrag machen.) aber die Firewallregel im Network werden nicht im System hinterlegt. Dadurch ist das Haekchen "Isolate" zeigt KEINE Wirkung.
"Isolate Network" verhaelt sich beim USG-3P leider nicht (immer) so, wie der Name vermuten laesst.
Je nach Controller-Version (insbesondere die neueren 9.x/10.x mit einem aelteren USG) gilt:
Network Isolation verhindert primaer den Zugriff von anderen Netzwerken auf dieses Netzwerk bzw. setzt passende Firewall-Regeln.
Es ersetzt keine vollstaendige Inter-VLAN-Firewall in jeder Konstellation. Da der USG ein aelteres Produkt ist und die aktuelle UniFi-Oberflaeche auf neuere Gateways (UXG, UDM, UCG) ausgelegt ist, werden manche Optionen nicht identisch umgesetzt.
Vermutung
Ich vermute, dass die GUI zwar "Isolate Network" anzeigt, der Controller diese Einstellung aber auf dem USG nicht oder nicht vollstaendig in Firewall-Regeln umsetzt. Das ist bei aelteren USG-Modellen ein bekanntes Verhalten, da neue Controllerfunktionen nicht immer vollstaendig von der alten USG-Firmware unterstuetzt werden.
Die Option "Isolate Network" ist in Network 10.x zwar vorhanden, die vollstaendige automatische Umsetzung ist aber in erster Linie fuer die neueren UniFi-Gateways (UXG, UCG, UDM usw.) vorgesehen. Auf aelteren USG-Geraeten werden neue Funktionen teilweise nicht oder nicht vollstaendig unterstuetzt. Das wird auch von Anwendern mit USG-3P berichtet. [1]
Firewall-Status
Um die aktuellen Firewallregel im USG-3P zu sehen muss man sich mit ssh auf dem Geraet anmelden.
Welcome to EdgeOS
By logging in, accessing, or using the Ubiquiti product, you
acknowledge that you have read and understood the Ubiquiti
License Agreement (available in the Web UI at, by default,
http://192.168.1.1) and agree to be bound by its terms.
Tibb@192.168.178.1's password:
Linux USG-3P 3.10.107-UBNT #1 SMP Thu Jan 12 08:28:15 UTC 2023 mips64
___ ___ .__________.__
| | |____ |__\_ ____/__|
| | / \| || __) | | (c) 2010-2023
| | | | \ || \ | | Ubiquiti, Inc.
|______|___| /__||__/ |__|
|_/ https://www.ui.com
Welcome to EdgeOS on UniFi Security Gateway!
********************************* NOTICE **********************************
* By logging in to, accessing, or using any Ubiquiti product, you are *
* signifying that you have read our Terms of Service (ToS) and End User *
* License Agreement (EULA), understand their terms, and agree to be *
* fully bound to them. The use of CLI (Command Line Interface) can *
* potentially harm Ubiquiti devices and result in lost access to them and *
* their data. By proceeding, you acknowledge that the use of CLI to *
* modify device(s) outside of their normal operational scope, or in any *
* manner inconsistent with the ToS or EULA, will permanently and *
* irrevocably void any applicable warranty. *
***************************************************************************
********************** WARNING! ******************************
* Configuration changes made here are not persistent. *
* They will be overwritten by the UniFi Network Application *
* instance managing this device on next provision. *
* *
* Configuration MUST BE DONE in UniFi Network Application. *
****************************************************************
Die Firewallregeln sieht man dann mit:
Tibb@USG-3P:~$ show firewall
--------------------------------------------------------------------------------
IPv4 Firewall "AUTHORIZED_GUESTS":
Inactive - Not applied to any interfaces, zones or for content-inspection.
rule action proto packets bytes
---- ------ ----- ------- -----
10000 drop all 0 0
--------------------------------------------------------------------------------
IPv4 Firewall "GUEST_IN":
Active on (eth1.2,IN)
rule action proto packets bytes
---- ------ ----- ------- -----
3001 accept tcp_udp 0 0
condition - tcp dpt:domain
3002 accept tcp 0 0
condition - tcp dpt:https match-set captive_portal_subnets dst
3003 accept all 0 0
condition - match-set guest_pre_allow dst
3004 drop all 81 4932
condition - match-set guest_restricted dst
3005 drop all 0 0
condition - match-set corporate_network dst
3006 drop all 0 0
condition - match-set remote_user_vpn_network dst
3007 drop all 0 0
condition - match-set authorized_guests dst
6001 accept all 46480 26747790
condition - saddr 192.168.2.0/24
10000 accept all 0 0
--------------------------------------------------------------------------------
IPv4 Firewall "GUEST_LOCAL":
Active on (eth1.2,LOCAL)
rule action proto packets bytes
---- ------ ----- ------- -----
3001 accept tcp_udp 9101 596868
condition - tcp dpt:domain
3002 accept icmp 20 3410
3003 accept udp 64 21742
condition - udp spt:bootpc dpt:bootps
10000 drop all 33747 4123084
--------------------------------------------------------------------------------
IPv4 Firewall "GUEST_OUT":
Active on (eth1.2,OUT)
rule action proto packets bytes
---- ------ ----- ------- -----
6001 accept all 49527 7851741
condition - daddr 192.168.2.0/24
10000 accept all 0 0
--------------------------------------------------------------------------------
IPv4 Firewall "LAN_IN":
Active on (eth1,IN) (eth1.3,IN) (eth1.4,IN) (eth1.5,IN) (eth1.148,IN)
rule action proto packets bytes
---- ------ ----- ------- -----
6001 accept all 2201405 287372547
condition - saddr 192.168.178.0/24
6002 accept all 23593 1446864
condition - saddr 192.168.148.0/24
6003 accept all 259330 34563208
condition - saddr 192.168.46.0/24
6004 accept all 709735 128420752
condition - saddr 192.168.47.0/24
6005 accept all 0 0
condition - saddr 192.168.48.0/24
10000 accept all 12 520
--------------------------------------------------------------------------------
IPv4 Firewall "LAN_LOCAL":
Active on (eth1,LOCAL) (eth1.3,LOCAL) (eth1.4,LOCAL) (eth1.5,LOCAL) (eth1.148,LOCAL)
rule action proto packets bytes
---- ------ ----- ------- -----
10000 accept all 1286556 97820849
--------------------------------------------------------------------------------
IPv4 Firewall "LAN_OUT":
Active on (eth1,OUT) (eth1.3,OUT) (eth1.4,OUT) (eth1.5,OUT) (eth1.148,OUT)
rule action proto packets bytes
---- ------ ----- ------- -----
6001 accept all 2060177 194197463
condition - daddr 192.168.178.0/24
6002 accept all 23468 1438338
condition - daddr 192.168.148.0/24
6003 accept all 236238 55342991
condition - daddr 192.168.46.0/24
6004 accept all 571907 98234067
condition - daddr 192.168.47.0/24
6005 accept all 0 0
condition - daddr 192.168.48.0/24
10000 accept all 0 0
--------------------------------------------------------------------------------
IPv4 Firewall "WAN_IN":
Active on (eth0,IN) (eth2,IN)
rule action proto packets bytes
---- ------ ----- ------- -----
2000 accept tcp 0 0
condition - match-set 65c891680444a9310b5e20e4 dst
3001 accept all 2926181 356194625
condition - state RELATED,ESTABLISHED
3002 drop all 0 0
condition - state INVALID
3003 accept tcp 2150 127100
condition - daddr unifi tcp dpt:4443 LOG enabled
10000 drop all 0 0
--------------------------------------------------------------------------------
IPv4 Firewall "WAN_LOCAL":
Active on (eth0,LOCAL) (eth2,LOCAL)
rule action proto packets bytes
---- ------ ----- ------- -----
3001 accept all 1008284 155244003
condition - state RELATED,ESTABLISHED
3002 drop all 14099 733072
condition - state INVALID
10000 drop all 274916 22257204
--------------------------------------------------------------------------------
IPv4 Firewall "WAN_OUT":
Active on (eth0,OUT) (eth2,OUT)
rule action proto packets bytes
---- ------ ----- ------- -----
10000 accept all 3227650 477820843
--------------------------------------------------------------------------------
IPv4 Modify Firewall "LOAD_BALANCE":
Active on (eth1,IN) (eth1.2,IN) (eth1.3,IN) (eth1.4,IN) (eth1.5,IN) (eth1.148,IN)
rule action proto packets bytes
---- ------ ----- ------- -----
3001 accept all 1904 99161
condition - match-set NETv4_eth0 dst
3002 accept all 1872 142272
condition - match-set NETv4_eth2 dst
3003 accept all 1168561 83886222
condition - match-SRC-NTWRK-GROUP corporate_network match-set corporate_networ
k dst
3004 accept all 0 0
condition - match-SRC-NTWRK-GROUP corporate_network match-set remote_user_vpn_
network dst
3005 accept all 0 0
condition - match-SRC-NTWRK-GROUP corporate_network match-set remote_site_vpn_
network dst
3006 accept all 0 0
condition - match-SRC-NTWRK-GROUP corporate_network match-set remote_client_vp
n_network dst
3007 accept all 1757 93454
condition - match-SRC-NTWRK-GROUP corporate_network match-set guest_network ds
t
3008 accept all 70 4140
condition - match-SRC-NTWRK-GROUP guest_network match-set corporate_network ds
t
3009 accept all 0 0
condition - match-SRC-NTWRK-GROUP guest_network match-set remote_user_vpn_netw
ork dst
3010 accept all 0 0
condition - match-SRC-NTWRK-GROUP guest_network match-set remote_site_vpn_netw
ork dst
3011 accept all 0 0
condition - match-SRC-NTWRK-GROUP guest_network match-set remote_client_vpn_ne
twork dst
3012 accept all 9414 628636
condition - match-SRC-NTWRK-GROUP guest_network match-set guest_network dst
3013 accept all 0 0
condition - match-SRC-NTWRK-GROUP remote_user_vpn_network match-set corporate_
network dst
3014 accept all 0 0
condition - match-SRC-NTWRK-GROUP remote_user_vpn_network match-set remote_sit
e_vpn_network dst
3015 accept all 0 0
condition - match-SRC-NTWRK-GROUP remote_user_vpn_network match-set remote_use
r_vpn_network dst
3016 accept all 0 0
condition - match-SRC-NTWRK-GROUP remote_user_vpn_network match-set remote_cli
ent_vpn_network dst
3017 accept all 0 0
condition - match-SRC-NTWRK-GROUP remote_user_vpn_network match-set guest_netw
ork dst
3018 modify all 4098811 633462135
10000 accept all 4098812 633462197
--------------------------------------------------------------------------------
IPv6 Firewall "AUTHORIZED_GUESTSv6":
Inactive - Not applied to any interfaces, zones or for content-inspection.
rule action proto packets bytes
---- ------ ----- ------- -----
10000 drop all 0 0
--------------------------------------------------------------------------------
IPv6 Firewall "GUESTv6_IN":
Active on (eth1.2,IN)
rule action proto packets bytes
---- ------ ----- ------- -----
3001 drop all 0 0
condition - match-set corporate_networkv6 dst
10000 accept all 0 0
--------------------------------------------------------------------------------
IPv6 Firewall "GUESTv6_LOCAL":
Active on (eth1.2,LOCAL)
rule action proto packets bytes
---- ------ ----- ------- -----
3001 accept udp 0 0
condition - udp dpt:domain
3002 accept icmp 0 0
10000 drop all 155 8936
--------------------------------------------------------------------------------
IPv6 Firewall "GUESTv6_OUT":
Active on (eth1.2,OUT)
rule action proto packets bytes
---- ------ ----- ------- -----
10000 accept all 0 0
--------------------------------------------------------------------------------
IPv6 Firewall "LANv6_IN":
Active on (eth1,IN) (eth1.3,IN) (eth1.4,IN) (eth1.5,IN) (eth1.148,IN)
rule action proto packets bytes
---- ------ ----- ------- -----
10000 accept all 0 0
--------------------------------------------------------------------------------
IPv6 Firewall "LANv6_LOCAL":
Active on (eth1,LOCAL) (eth1.3,LOCAL) (eth1.4,LOCAL) (eth1.5,LOCAL) (eth1.148,LOCAL)
rule action proto packets bytes
---- ------ ----- ------- -----
10000 accept all 16989 1006856
--------------------------------------------------------------------------------
IPv6 Firewall "LANv6_OUT":
Active on (eth1,OUT) (eth1.3,OUT) (eth1.4,OUT) (eth1.5,OUT) (eth1.148,OUT)
rule action proto packets bytes
---- ------ ----- ------- -----
10000 accept all 0 0
--------------------------------------------------------------------------------
IPv6 Firewall "WANv6_IN":
Active on (eth0,IN) (eth2,IN)
rule action proto packets bytes
---- ------ ----- ------- -----
3001 accept all 0 0
condition - state RELATED,ESTABLISHED
3002 drop all 0 0
condition - state INVALID
10000 drop all 0 0
--------------------------------------------------------------------------------
IPv6 Firewall "WANv6_LOCAL":
Active on (eth0,LOCAL) (eth2,LOCAL)
rule action proto packets bytes
---- ------ ----- ------- -----
3001 accept ipv6-icmp 10 720
condition - ipv6-icmp neighbour-advertisement
3002 accept ipv6-icmp 0 0
condition - ipv6-icmp neighbour-solicitation
3003 accept all 0 0
condition - state RELATED,ESTABLISHED
3004 drop all 0 0
condition - state INVALID
10000 drop all 35373 7011052
--------------------------------------------------------------------------------
IPv6 Firewall "WANv6_OUT":
Active on (eth0,OUT) (eth2,OUT)
rule action proto packets bytes
---- ------ ----- ------- -----
10000 accept all 0 0
ChatGPT ist bei der Analyse eine grosze Hilfe.
Die Kommandos, die zum Setzen der Regeln ausgefuehrt werden, sieht man mit folgendem Kommando.
ibb@USG-3P:~$ show configuration commands | match firewall name LAN_IN set firewall all-ping enable set firewall broadcast-ping disable set firewall group address-group authorized_guests description 'authorized guests MAC addresses' set firewall group address-group guest_allow_dns_servers description 'allow dns servers for guests' set firewall group address-group guest_portal_address description 'guest portal address' set firewall group address-group guest_pre_allow description 'allow addresses for guests' set firewall group address-group guest_restricted address 192.168.0.0/16 set firewall group address-group guest_restricted address 10.0.0.0/8 set firewall group address-group guest_restricted address 172.16.0.0/12 set firewall group address-group guest_restricted description 'restricted addresses for guests' set firewall group address-group unifi_controller_addresses address 192.168.178.12 set firewall group address-group unifi_controller_addresses description 'UniFi addresses' set firewall group ipv6-network-group corporate_networkv6 description 'IPv6 corporate subnets' set firewall group ipv6-network-group guest_networkv6 description 'IPv6 guest subnets' set firewall group network-group captive_portal_subnets description 'captive portal subnets' set firewall group network-group corporate_network description 'corporate subnets' set firewall group network-group corporate_network network 192.168.178.0/24 set firewall group network-group corporate_network network 192.168.148.0/24 set firewall group network-group corporate_network network 192.168.46.0/24 set firewall group network-group corporate_network network 192.168.47.0/24 set firewall group network-group corporate_network network 192.168.48.0/24 set firewall group network-group guest_network description 'guest subnets' set firewall group network-group guest_network network 192.168.2.0/24 set firewall group network-group remote_client_vpn_network description 'remote client VPN subnets' set firewall group network-group remote_site_vpn_network description 'remote site VPN subnets' set firewall group network-group remote_user_vpn_network description 'Remote User VPN subnets' set firewall group port-group 65c891680444a9310b5e20e4 description customized-SSH set firewall group port-group 65c891680444a9310b5e20e4 port 22 set firewall group port-group guest_portal_ports description 'guest portal ports' set firewall group port-group guest_portal_redirector_ports description 'guest portal redirector ports' set firewall group port-group guest_portal_redirector_ports port 39080 set firewall group port-group guest_portal_redirector_ports port 39443 set firewall group port-group unifi_controller_ports-tcp description 'unifi tcp ports' set firewall group port-group unifi_controller_ports-tcp port 8080 set firewall group port-group unifi_controller_ports-udp description 'unifi udp ports' set firewall group port-group unifi_controller_ports-udp port 3478 set firewall ipv6-name AUTHORIZED_GUESTSv6 default-action drop set firewall ipv6-name AUTHORIZED_GUESTSv6 description 'authorization check packets from guest network' set firewall ipv6-name GUESTv6_IN default-action accept set firewall ipv6-name GUESTv6_IN description 'packets from guest network' set firewall ipv6-name GUESTv6_IN rule 3001 action drop set firewall ipv6-name GUESTv6_IN rule 3001 description 'Block Virtual Network Traffic' set firewall ipv6-name GUESTv6_IN rule 3001 destination group ipv6-network-group corporate_networkv6 set firewall ipv6-name GUESTv6_LOCAL default-action drop set firewall ipv6-name GUESTv6_LOCAL description 'packets from guest network to gateway' set firewall ipv6-name GUESTv6_LOCAL rule 3001 action accept set firewall ipv6-name GUESTv6_LOCAL rule 3001 description 'allow DNS' set firewall ipv6-name GUESTv6_LOCAL rule 3001 destination port 53 set firewall ipv6-name GUESTv6_LOCAL rule 3001 protocol udp set firewall ipv6-name GUESTv6_LOCAL rule 3002 action accept set firewall ipv6-name GUESTv6_LOCAL rule 3002 description 'allow ICMP' set firewall ipv6-name GUESTv6_LOCAL rule 3002 protocol icmp set firewall ipv6-name GUESTv6_OUT default-action accept set firewall ipv6-name GUESTv6_OUT description 'packets forward to guest network' set firewall ipv6-name LANv6_IN default-action accept set firewall ipv6-name LANv6_IN description 'packets from intranet' set firewall ipv6-name LANv6_LOCAL default-action accept set firewall ipv6-name LANv6_LOCAL description 'packets from intranet to gateway' set firewall ipv6-name LANv6_OUT default-action accept set firewall ipv6-name LANv6_OUT description 'packets forward to intranet' set firewall ipv6-name WANv6_IN default-action drop set firewall ipv6-name WANv6_IN description 'packets from internet to intranet' set firewall ipv6-name WANv6_IN rule 3001 action accept set firewall ipv6-name WANv6_IN rule 3001 description 'allow established/related sessions' set firewall ipv6-name WANv6_IN rule 3001 state established enable set firewall ipv6-name WANv6_IN rule 3001 state invalid disable set firewall ipv6-name WANv6_IN rule 3001 state new disable set firewall ipv6-name WANv6_IN rule 3001 state related enable set firewall ipv6-name WANv6_IN rule 3002 action drop set firewall ipv6-name WANv6_IN rule 3002 description 'drop invalid state' set firewall ipv6-name WANv6_IN rule 3002 state established disable set firewall ipv6-name WANv6_IN rule 3002 state invalid enable set firewall ipv6-name WANv6_IN rule 3002 state new disable set firewall ipv6-name WANv6_IN rule 3002 state related disable set firewall ipv6-name WANv6_LOCAL default-action drop set firewall ipv6-name WANv6_LOCAL description 'packets from internet to gateway' set firewall ipv6-name WANv6_LOCAL rule 3001 action accept set firewall ipv6-name WANv6_LOCAL rule 3001 description 'Allow neighbor advertisements' set firewall ipv6-name WANv6_LOCAL rule 3001 icmpv6 type neighbor-advertisement set firewall ipv6-name WANv6_LOCAL rule 3001 protocol ipv6-icmp set firewall ipv6-name WANv6_LOCAL rule 3002 action accept set firewall ipv6-name WANv6_LOCAL rule 3002 description 'Allow Neighbor Solicitations' set firewall ipv6-name WANv6_LOCAL rule 3002 icmpv6 type neighbor-solicitation set firewall ipv6-name WANv6_LOCAL rule 3002 protocol ipv6-icmp set firewall ipv6-name WANv6_LOCAL rule 3003 action accept set firewall ipv6-name WANv6_LOCAL rule 3003 description 'allow established/related sessions' set firewall ipv6-name WANv6_LOCAL rule 3003 state established enable set firewall ipv6-name WANv6_LOCAL rule 3003 state invalid disable set firewall ipv6-name WANv6_LOCAL rule 3003 state new disable set firewall ipv6-name WANv6_LOCAL rule 3003 state related enable set firewall ipv6-name WANv6_LOCAL rule 3004 action drop set firewall ipv6-name WANv6_LOCAL rule 3004 description 'drop invalid state' set firewall ipv6-name WANv6_LOCAL rule 3004 state established disable set firewall ipv6-name WANv6_LOCAL rule 3004 state invalid enable set firewall ipv6-name WANv6_LOCAL rule 3004 state new disable set firewall ipv6-name WANv6_LOCAL rule 3004 state related disable set firewall ipv6-name WANv6_OUT default-action accept set firewall ipv6-name WANv6_OUT description 'packets to internet' set firewall ipv6-receive-redirects disable set firewall ipv6-src-route disable set firewall ip-src-route disable set firewall log-martians enable set firewall modify LOAD_BALANCE description LOAD_BALANCE set firewall modify LOAD_BALANCE rule 3001 action accept set firewall modify LOAD_BALANCE rule 3001 destination group address-group NETv4_eth0 set firewall modify LOAD_BALANCE rule 3002 action accept set firewall modify LOAD_BALANCE rule 3002 destination group address-group NETv4_eth2 set firewall modify LOAD_BALANCE rule 3003 action accept set firewall modify LOAD_BALANCE rule 3003 destination group network-group corporate_network set firewall modify LOAD_BALANCE rule 3003 source group network-group corporate_network set firewall modify LOAD_BALANCE rule 3004 action accept set firewall modify LOAD_BALANCE rule 3004 destination group network-group remote_user_vpn_network set firewall modify LOAD_BALANCE rule 3004 source group network-group corporate_network set firewall modify LOAD_BALANCE rule 3005 action accept set firewall modify LOAD_BALANCE rule 3005 destination group network-group remote_site_vpn_network set firewall modify LOAD_BALANCE rule 3005 source group network-group corporate_network set firewall modify LOAD_BALANCE rule 3006 action accept set firewall modify LOAD_BALANCE rule 3006 destination group network-group remote_client_vpn_network set firewall modify LOAD_BALANCE rule 3006 source group network-group corporate_network set firewall modify LOAD_BALANCE rule 3007 action accept set firewall modify LOAD_BALANCE rule 3007 destination group network-group guest_network set firewall modify LOAD_BALANCE rule 3007 source group network-group corporate_network set firewall modify LOAD_BALANCE rule 3008 action accept set firewall modify LOAD_BALANCE rule 3008 destination group network-group corporate_network set firewall modify LOAD_BALANCE rule 3008 source group network-group guest_network set firewall modify LOAD_BALANCE rule 3009 action accept set firewall modify LOAD_BALANCE rule 3009 destination group network-group remote_user_vpn_network set firewall modify LOAD_BALANCE rule 3009 source group network-group guest_network set firewall modify LOAD_BALANCE rule 3010 action accept set firewall modify LOAD_BALANCE rule 3010 destination group network-group remote_site_vpn_network set firewall modify LOAD_BALANCE rule 3010 source group network-group guest_network set firewall modify LOAD_BALANCE rule 3011 action accept set firewall modify LOAD_BALANCE rule 3011 destination group network-group remote_client_vpn_network set firewall modify LOAD_BALANCE rule 3011 source group network-group guest_network set firewall modify LOAD_BALANCE rule 3012 action accept set firewall modify LOAD_BALANCE rule 3012 destination group network-group guest_network set firewall modify LOAD_BALANCE rule 3012 source group network-group guest_network set firewall modify LOAD_BALANCE rule 3013 action accept set firewall modify LOAD_BALANCE rule 3013 destination group network-group corporate_network set firewall modify LOAD_BALANCE rule 3013 source group network-group remote_user_vpn_network set firewall modify LOAD_BALANCE rule 3014 action accept set firewall modify LOAD_BALANCE rule 3014 destination group network-group remote_site_vpn_network set firewall modify LOAD_BALANCE rule 3014 source group network-group remote_user_vpn_network set firewall modify LOAD_BALANCE rule 3015 action accept set firewall modify LOAD_BALANCE rule 3015 destination group network-group remote_user_vpn_network set firewall modify LOAD_BALANCE rule 3015 source group network-group remote_user_vpn_network set firewall modify LOAD_BALANCE rule 3016 action accept set firewall modify LOAD_BALANCE rule 3016 destination group network-group remote_client_vpn_network set firewall modify LOAD_BALANCE rule 3016 source group network-group remote_user_vpn_network set firewall modify LOAD_BALANCE rule 3017 action accept set firewall modify LOAD_BALANCE rule 3017 destination group network-group guest_network set firewall modify LOAD_BALANCE rule 3017 source group network-group remote_user_vpn_network set firewall modify LOAD_BALANCE rule 3018 action modify set firewall modify LOAD_BALANCE rule 3018 modify lb-group wan_failover set firewall name AUTHORIZED_GUESTS default-action drop set firewall name AUTHORIZED_GUESTS description 'authorization check packets from guest network' set firewall name GUEST_IN default-action accept set firewall name GUEST_IN description 'packets from guest network' set firewall name GUEST_IN rule 3001 action accept set firewall name GUEST_IN rule 3001 description 'Allow Public DNS' set firewall name GUEST_IN rule 3001 destination port 53 set firewall name GUEST_IN rule 3001 protocol tcp_udp set firewall name GUEST_IN rule 3002 action accept set firewall name GUEST_IN rule 3002 description 'Allow Hotspot Portal' set firewall name GUEST_IN rule 3002 destination group network-group captive_portal_subnets set firewall name GUEST_IN rule 3002 destination port 443 set firewall name GUEST_IN rule 3002 protocol tcp set firewall name GUEST_IN rule 3003 action accept set firewall name GUEST_IN rule 3003 description 'allow packets to allow subnets' set firewall name GUEST_IN rule 3003 destination group address-group guest_pre_allow set firewall name GUEST_IN rule 3004 action drop set firewall name GUEST_IN rule 3004 description 'Block Restricted Traffic' set firewall name GUEST_IN rule 3004 destination group address-group guest_restricted set firewall name GUEST_IN rule 3005 action drop set firewall name GUEST_IN rule 3005 description 'Block Virtual Network Traffic' set firewall name GUEST_IN rule 3005 destination group network-group corporate_network set firewall name GUEST_IN rule 3006 action drop set firewall name GUEST_IN rule 3006 description 'Block Traffic To VPN Servers' set firewall name GUEST_IN rule 3006 destination group network-group remote_user_vpn_network set firewall name GUEST_IN rule 3007 action drop set firewall name GUEST_IN rule 3007 description 'Block Unauthorized Traffic' set firewall name GUEST_IN rule 3007 destination group address-group authorized_guests set firewall name GUEST_IN rule 6001 action accept set firewall name GUEST_IN rule 6001 description 'Allow Network 192.168.2.0/24 Traffic' set firewall name GUEST_IN rule 6001 source address 192.168.2.0/24 set firewall name GUEST_LOCAL default-action drop set firewall name GUEST_LOCAL description 'packets from guest network to gateway' set firewall name GUEST_LOCAL rule 3001 action accept set firewall name GUEST_LOCAL rule 3001 description 'allow DNS' set firewall name GUEST_LOCAL rule 3001 destination port 53 set firewall name GUEST_LOCAL rule 3001 protocol tcp_udp set firewall name GUEST_LOCAL rule 3002 action accept set firewall name GUEST_LOCAL rule 3002 description 'allow ICMP' set firewall name GUEST_LOCAL rule 3002 protocol icmp set firewall name GUEST_LOCAL rule 3003 action accept set firewall name GUEST_LOCAL rule 3003 description 'Allow DHCP' set firewall name GUEST_LOCAL rule 3003 destination port 67 set firewall name GUEST_LOCAL rule 3003 protocol udp set firewall name GUEST_LOCAL rule 3003 source port 68 set firewall name GUEST_OUT default-action accept set firewall name GUEST_OUT description 'packets forward to guest network' set firewall name GUEST_OUT rule 6001 action accept set firewall name GUEST_OUT rule 6001 description 'Allow Network 192.168.2.0/24 Traffic' set firewall name GUEST_OUT rule 6001 destination address 192.168.2.0/24 set firewall name LAN_IN default-action accept set firewall name LAN_IN description 'packets from intranet' set firewall name LAN_IN rule 6001 action accept set firewall name LAN_IN rule 6001 description 'Allow Network 192.168.178.0/24 Traffic' set firewall name LAN_IN rule 6001 source address 192.168.178.0/24 set firewall name LAN_IN rule 6002 action accept set firewall name LAN_IN rule 6002 description 'Allow Network 192.168.148.0/24 Traffic' set firewall name LAN_IN rule 6002 source address 192.168.148.0/24 set firewall name LAN_IN rule 6003 action accept set firewall name LAN_IN rule 6003 description 'Allow Network 192.168.46.0/24 Traffic' set firewall name LAN_IN rule 6003 source address 192.168.46.0/24 set firewall name LAN_IN rule 6004 action accept set firewall name LAN_IN rule 6004 description 'Allow Network 192.168.47.0/24 Traffic' set firewall name LAN_IN rule 6004 source address 192.168.47.0/24 set firewall name LAN_IN rule 6005 action accept set firewall name LAN_IN rule 6005 description 'Allow Network 192.168.48.0/24 Traffic' set firewall name LAN_IN rule 6005 source address 192.168.48.0/24 set firewall name LAN_LOCAL default-action accept set firewall name LAN_LOCAL description 'packets from intranet to gateway' set firewall name LAN_OUT default-action accept set firewall name LAN_OUT description 'packets forward to intranet' set firewall name LAN_OUT rule 6001 action accept set firewall name LAN_OUT rule 6001 description 'Allow Network 192.168.178.0/24 Traffic' set firewall name LAN_OUT rule 6001 destination address 192.168.178.0/24 set firewall name LAN_OUT rule 6002 action accept set firewall name LAN_OUT rule 6002 description 'Allow Network 192.168.148.0/24 Traffic' set firewall name LAN_OUT rule 6002 destination address 192.168.148.0/24 set firewall name LAN_OUT rule 6003 action accept set firewall name LAN_OUT rule 6003 description 'Allow Network 192.168.46.0/24 Traffic' set firewall name LAN_OUT rule 6003 destination address 192.168.46.0/24 set firewall name LAN_OUT rule 6004 action accept set firewall name LAN_OUT rule 6004 description 'Allow Network 192.168.47.0/24 Traffic' set firewall name LAN_OUT rule 6004 destination address 192.168.47.0/24 set firewall name LAN_OUT rule 6005 action accept set firewall name LAN_OUT rule 6005 description 'Allow Network 192.168.48.0/24 Traffic' set firewall name LAN_OUT rule 6005 destination address 192.168.48.0/24 set firewall name WAN_IN default-action drop set firewall name WAN_IN description 'packets from internet to intranet' set firewall name WAN_IN rule 2000 action accept set firewall name WAN_IN rule 2000 description SSH set firewall name WAN_IN rule 2000 destination group port-group 65c891680444a9310b5e20e4 set firewall name WAN_IN rule 2000 protocol tcp set firewall name WAN_IN rule 3001 action accept set firewall name WAN_IN rule 3001 description 'allow established/related sessions' set firewall name WAN_IN rule 3001 state established enable set firewall name WAN_IN rule 3001 state invalid disable set firewall name WAN_IN rule 3001 state new disable set firewall name WAN_IN rule 3001 state related enable set firewall name WAN_IN rule 3002 action drop set firewall name WAN_IN rule 3002 description 'drop invalid state' set firewall name WAN_IN rule 3002 state established disable set firewall name WAN_IN rule 3002 state invalid enable set firewall name WAN_IN rule 3002 state new disable set firewall name WAN_IN rule 3002 state related disable set firewall name WAN_IN rule 3003 action accept set firewall name WAN_IN rule 3003 description 'PortForward [Smarthome]' set firewall name WAN_IN rule 3003 destination address 192.168.178.12 set firewall name WAN_IN rule 3003 destination port 4443 set firewall name WAN_IN rule 3003 log enable set firewall name WAN_IN rule 3003 protocol tcp set firewall name WAN_LOCAL default-action drop set firewall name WAN_LOCAL description 'packets from internet to gateway' set firewall name WAN_LOCAL rule 3001 action accept set firewall name WAN_LOCAL rule 3001 description 'allow established/related sessions' set firewall name WAN_LOCAL rule 3001 state established enable set firewall name WAN_LOCAL rule 3001 state invalid disable set firewall name WAN_LOCAL rule 3001 state new disable set firewall name WAN_LOCAL rule 3001 state related enable set firewall name WAN_LOCAL rule 3002 action drop set firewall name WAN_LOCAL rule 3002 description 'drop invalid state' set firewall name WAN_LOCAL rule 3002 state established disable set firewall name WAN_LOCAL rule 3002 state invalid enable set firewall name WAN_LOCAL rule 3002 state new disable set firewall name WAN_LOCAL rule 3002 state related disable set firewall name WAN_OUT default-action accept set firewall name WAN_OUT description 'packets to internet' set firewall options mss-clamp interface-type pppoe set firewall options mss-clamp interface-type pptp set firewall options mss-clamp interface-type vti set firewall options mss-clamp mss 1452 set firewall options mss-clamp6 interface-type pppoe set firewall options mss-clamp6 interface-type pptp set firewall options mss-clamp6 mss 1432 set firewall receive-redirects disable set firewall send-redirects enable set firewall source-validation disable set firewall syn-cookies enable set interfaces ethernet eth0 firewall in ipv6-name WANv6_IN set interfaces ethernet eth0 firewall in name WAN_IN set interfaces ethernet eth0 firewall local ipv6-name WANv6_LOCAL set interfaces ethernet eth0 firewall local name WAN_LOCAL set interfaces ethernet eth0 firewall out ipv6-name WANv6_OUT set interfaces ethernet eth0 firewall out name WAN_OUT set interfaces ethernet eth1 firewall in ipv6-name LANv6_IN set interfaces ethernet eth1 firewall in modify LOAD_BALANCE set interfaces ethernet eth1 firewall in name LAN_IN set interfaces ethernet eth1 firewall local ipv6-name LANv6_LOCAL set interfaces ethernet eth1 firewall local name LAN_LOCAL set interfaces ethernet eth1 firewall out ipv6-name LANv6_OUT set interfaces ethernet eth1 firewall out name LAN_OUT set interfaces ethernet eth1 vif 2 firewall in ipv6-name GUESTv6_IN set interfaces ethernet eth1 vif 2 firewall in modify LOAD_BALANCE set interfaces ethernet eth1 vif 2 firewall in name GUEST_IN set interfaces ethernet eth1 vif 2 firewall local ipv6-name GUESTv6_LOCAL set interfaces ethernet eth1 vif 2 firewall local name GUEST_LOCAL set interfaces ethernet eth1 vif 2 firewall out ipv6-name GUESTv6_OUT set interfaces ethernet eth1 vif 2 firewall out name GUEST_OUT set interfaces ethernet eth1 vif 3 firewall in ipv6-name LANv6_IN set interfaces ethernet eth1 vif 3 firewall in modify LOAD_BALANCE set interfaces ethernet eth1 vif 3 firewall in name LAN_IN set interfaces ethernet eth1 vif 3 firewall local ipv6-name LANv6_LOCAL set interfaces ethernet eth1 vif 3 firewall local name LAN_LOCAL set interfaces ethernet eth1 vif 3 firewall out ipv6-name LANv6_OUT set interfaces ethernet eth1 vif 3 firewall out name LAN_OUT set interfaces ethernet eth1 vif 4 firewall in ipv6-name LANv6_IN set interfaces ethernet eth1 vif 4 firewall in modify LOAD_BALANCE set interfaces ethernet eth1 vif 4 firewall in name LAN_IN set interfaces ethernet eth1 vif 4 firewall local ipv6-name LANv6_LOCAL set interfaces ethernet eth1 vif 4 firewall local name LAN_LOCAL set interfaces ethernet eth1 vif 4 firewall out ipv6-name LANv6_OUT set interfaces ethernet eth1 vif 4 firewall out name LAN_OUT set interfaces ethernet eth1 vif 5 firewall in ipv6-name LANv6_IN set interfaces ethernet eth1 vif 5 firewall in modify LOAD_BALANCE set interfaces ethernet eth1 vif 5 firewall in name LAN_IN set interfaces ethernet eth1 vif 5 firewall local ipv6-name LANv6_LOCAL set interfaces ethernet eth1 vif 5 firewall local name LAN_LOCAL set interfaces ethernet eth1 vif 5 firewall out ipv6-name LANv6_OUT set interfaces ethernet eth1 vif 5 firewall out name LAN_OUT set interfaces ethernet eth1 vif 148 firewall in ipv6-name LANv6_IN set interfaces ethernet eth1 vif 148 firewall in modify LOAD_BALANCE set interfaces ethernet eth1 vif 148 firewall in name LAN_IN set interfaces ethernet eth1 vif 148 firewall local ipv6-name LANv6_LOCAL set interfaces ethernet eth1 vif 148 firewall local name LAN_LOCAL set interfaces ethernet eth1 vif 148 firewall out ipv6-name LANv6_OUT set interfaces ethernet eth1 vif 148 firewall out name LAN_OUT set interfaces ethernet eth2 firewall in ipv6-name WANv6_IN set interfaces ethernet eth2 firewall in name WAN_IN set interfaces ethernet eth2 firewall local ipv6-name WANv6_LOCAL set interfaces ethernet eth2 firewall local name WAN_LOCAL set interfaces ethernet eth2 firewall out ipv6-name WANv6_OUT set interfaces ethernet eth2 firewall out name WAN_OUT set port-forward auto-firewall disable Tibb@USG-3P:~$
Beim Gast-WLAN funktioniert die Isolierung, siehe "set firewall name GUEST_LOCAL default-action drop".
Workaround
Als erstes legt man Netzwerklisten an von allen Subnetzen die ein Subnetz nicht erreichen darf. Leider habe ich kein NOT gefunden. Grrrr! Das haette die Sache deutchlich vereinfacht. Das zu isolierende Subnetz ausgewaehlt, NOT davor und fertig. So muss man tatsaechlich alle nicht vom Subnetz zu erreichenden Subnetze auflisten.
Im Anschluss kann man dann die Drop-Regeln fuer jedes Subnetz anlegen.
Regel Name: Block VLANXXX Einstellung Wert Type LAN IN Action Drop Protocol All Source Network 192.168.xxx.0/24 Destination Network Group <NameausNetwerkliste> Logging optional Reihenfolge vor den Accept-Regeln
Dadurch konnte ich mir (vorerst) die Anschaffung eines neuen und kompatiblen Produktes, wie UXG, UDM, UCG, ersparen.
Request for Comments
Loading comments...