Description:
The following document describes how to set up your router's firewall using pre-defined scripts.
Requirements:
Strategies for configuring the firewall
Firewalls are interfaces between networks and restrict the exchange of data, to a greater or lesser extent. The purpose of a firewall is thus diametrically opposed to that of the network to which it belongs: Networks are supposed to connect computers, firewalls aim to prevent connections.
This contradiction indicates the dilemma of the responsible administrators who, as a result, have developed various strategies as a solution.
Allow-All
The allow-all strategy prioritizes the unobstructed communication between network users before security. It basically allows any communication and the LAN is open to intruders. The LAN only becomes more secure when the administrator successively configures new rules that restrict or prevent elements of the communication.
Deny-All
The deny-all strategy starts with a "block everything" approach with the firewall blocking all communication between the network and the rest of the world. As a second step the administrator then opens up address ranges or ports that are required for day-to-day communication with the Internet, etc.
This approach is better for the security of the LAN than the allow-all strategy but often leads to difficulties for users in the initial phase. Some things may simply not work in the same way after the deny-all firewall is activated and some computers may not be reachable, etc.
Developing an explicit "deny-all" strategy
In order to achieve the maximum degree of security and control over data traffic, we recommend that you initially block all data transfers through the firewall. Subsequently, only those functions and communication paths that are really required are selectively activated. This provides protection for example from so-called 'trojan horses' or e-mail viruses that actively establish an outgoing connection via certain ports.
Some typical applications are described below as firewall rules and can be transferred simply and easily using scripts, irrespective of device type and
software version.
Deny-All: The most important rule in a firewall
The deny-all rule is by far the most important rule for the protection of your LAN. With this rule the firewall acts in accordance with the following principle: "Anything not explicitly allowed is forbidden". This is the only strategy with which the administrator can be really sure that no possibility of access has been "forgotten" – only those points of access that have been explicitly allowed are available.
Name | Beschreibung | Skript-Datei |
Deny-ALL |