Understand virtual firewall rule phases and action types for effective network security configuration.
Technically termed 'Destination Network Address Translation', or 'DNAT', the redirection phase is used if you wish to change the destination of network traffic entering or leaving a zone. The default behaviour of the firewall when there are no matching rules in this phase is to not perform any translation.
There are three types of action you can specify for a rule in the redirection phase:
The destination address of traffic matching a 'redirect' rule is changed to the specified target address and it is then passed on to the Filtering phase.
Traffic that matches a 'do not redirect' rule is passed unaltered to the filtering phase. This is also the default action if no rules are matched. A 'do not redirect' rule only needs to be explicitly given if you have a more general 'redirect' rule that you wish to override for a specific case.
Traffic matching a 'drop' rule is silently discarded.
Normally, all 'drop' rules are placed in the Filtering phase. The only circumstance where 'drop' rules should be placed in the Redirection phase is where you need to block a specific case of traffic that would otherwise match a more general 'redirect' rule, and need to specify it on the basis of its original destination address.
The filtering phase is the most important phase, and must be populated with rules for the firewall to permit any traffic through it. This phase is where you normally specify what network traffic should be permitted and what traffic should be discarded. The default behaviour of the firewall when there are no matching filtering rules is to silently discard the traffic.
The filtering actions are:
Traffic matching this rule is passed onto the next firewall phase.
Traffic matching this rule is discarded, and an ICMP destination unreachable message is sent back to the source of it.
Traffic matching this rule is silently discarded.
Technically termed 'Source Network Address Translation', or 'SNAT', the masquerading phase is used if you wish to change the source address of network traffic entering or leaving a zone. The default behaviour of the firewall when there are no matching rules in this phase is to not perform any translation.
There are three types of action you can specify for a rule in the masquerading phase:
The source address of traffic matching a 'masquerade' rule is translated to the specified address.
An 'auto-masquerade' rule acts like a manual 'masquerade' rule, but you do not need to specify an address. An address appropriate to the interface on which the traffic leaves the firewall is automatically chosen.
Traffic that matches a 'do not masquerade' rule leaves the firewall unaltered. This is also the default action if no rules are matched. A 'do not masquerade' rule only needs to be explicitly given if you have a more general 'masquerade' or 'auto-masquerade' rule that you wish to override for a specific case.
Index | Previous chapter: Stateful Packet Inspection and Firewall Rules | Next chapter: Using the Firewall Control Panel