network fw-rule

The network fw-rule command manages the firewall rules to be applied to the traffic that passes through an interface. Every rule consists of an action (allow, block, NAT) and the source, target and port matches. Its panel equivalent is the firewall screen in the network configuration.

Command Summary

TR7 WEB-CLI · network fw-rule

# Tab after the command

admin@TR7LBWAF01> network fw-rule

add delete list show update

 

admin@TR7LBWAF01> network fw-rule list v-device <device> # list them all

admin@TR7LBWAF01> network fw-rule show v-device <device> <id> # show one

admin@TR7LBWAF01> network fw-rule add v-device <device> namespace <table> …

admin@TR7LBWAF01> network fw-rule update v-device <device> id <id> … # change

admin@TR7LBWAF01> network fw-rule delete v-device <device> <id> # delete

admin@TR7LBWAF01>  

Required Fields

Order	Field	Status	What it does	What is written after it
1	v-device	Required	Selects to which virtual device the rule will be written	The virtual device
2	namespace	Required	Selects in which routing table the rule will be valid	A network namespace record
3	interface	Required	Selects on which interface the rule will be applied	An interface record or null (independent of the interface)
4	rule	Required	Selects what the rule will do	allow · deny · forward · notForward · snat · dnat
5	snatIp.type	Conditionally required	Only rule snat; selects where the address to be used in the source address translation will be taken from	deviceIp the address of the device · manual the manually written address
6	snatIp.deviceIp	Conditionally required	Only rule snat and snatIp.type deviceIp; the device address to be used in the translation	The device address
5	dnatIp	Conditionally required	Only rule dnat; the address to which the packet will be forwarded	The IP address
6 · 7	srcIp.type	Required	Selects the form of the source match (in the snat and dnat rules it is asked for after the NAT fields)	$all all of them · null the manually written address · country the country · mac the MAC address
7 · 8	dstIp.type	Required	Selects the form of the target match	$all all of them · null the manually written address · country the country · deviceIp the address of the device

The first four fields and the two match types are always written without a prefix. The NAT fields are asked for only in their own actions: if there is a field that starts with -- on the line, they are written in the --snatIp.deviceIp and --dnatIp form.

The Source Match

Field	What it does	What is written after it
srcIp.type	Selects how the source will be matched	$all · the manually written address · country · mac
--srcIp.manualContent	Determines the manually written source address	The IP address; it opens when the type is manual writing
--srcIp.country	Determines the country of the source	The country value; it opens while srcIp.type country
--srcIp.mac	Determines the MAC address of the source	The MAC address; it opens while srcIp.type mac
--srcIp.negate	Negates the match: the rule is applied to the sources outside the stated one	true · false (the default is false). It does not open when srcIp.type $all is selected

The Target Match

Field	What it does	What is written after it
dstIp.type	Selects how the target will be matched	$all · the manually written address · country · deviceIp
--dstIp.manualContent	Determines the manually written target address	The IP address
--dstIp.country	Determines the country of the target	The country value; it opens while dstIp.type country
--dstIp.deviceIp	Selects which address of the device will count as the target	The device address; it opens while dstIp.type deviceIp
--dstIp.negate	Negates the match	true · false (the default is false). It does not open when dstIp.type $all is selected

The Port and the Protocol

Field	What it does	What is written after it
--protocol	Selects to which protocol the rule will be applied	The protocol value; Tab lists them
--dstPort.type	Selects how the target port will be matched	$all all of them · the manually written port. It opens only when --protocol tcp is selected
--dstPort.manualContent	Determines the manually written target port	The port number. It opens only when --protocol tcp is selected
--dstPort.negate	Negates the port match	true · false (the default is false). It does not open when dstPort.type $all is selected. It opens only when --protocol tcp is selected

NAT and the Other Fields

Field	What it does	What is written after it
--dnatIp	Determines the address to which the packet will be forwarded in the target address translation	The IP address; it is required when rule dnat is selected (see The Required Fields)
--snatIp.deviceIp	Selects the device address to be used in the source address translation	The device address; it is required while rule snat and snatIp.type deviceIp (see The Required Fields)
--snatIp.manualContent	Determines the manually written address in the source address translation	The IP address
--status	Determines whether the rule is enabled or not	true (the default) · false
--desc	Writes an explanation for the rule	Free text

Negating means "the ones outside this"

When --srcIp.negate true is written, the rule is applied to the traffic that does not fit the stated source. All three of the match fields have their own negation switch and none of them opens when $all is selected — the negation of a match that covers all of them would be an empty set.

Examples

TR7 WEB-CLI · A) Allowing a certain network

admin@TR7LBWAF01> network fw-rule add v-device Host namespace DEFAULT interface <interface> \

rule allow srcIp.type null dstIp.type $all \

--srcIp.manualContent 10.0.1.0 --protocol tcp --dstPort.type null --dstPort.manualContent 443 \

--desc "management access"

admin@TR7LBWAF01>  

TR7 WEB-CLI · B) A rule for the sources outside a country

# with negate, "everywhere outside this country"

admin@TR7LBWAF01> network fw-rule add v-device Host namespace DEFAULT interface <interface> \

rule deny srcIp.type country dstIp.type $all \

--srcIp.country <country> --srcIp.negate true

admin@TR7LBWAF01>  

TR7 WEB-CLI · C) Target address translation and turning the rule off

admin@TR7LBWAF01> network fw-rule add v-device Host namespace DEFAULT interface <interface> \

rule dnat srcIp.type $all dstIp.type deviceIp \

--dstIp.deviceIp <address> --dnatIp 10.0.10.21

 

admin@TR7LBWAF01> network fw-rule update v-device Host id <id> --status false

admin@TR7LBWAF01> network fw-rule delete v-device Host <id>

admin@TR7LBWAF01>  

Things to Know

• The required fields are written without a prefix and in order. The virtual device, the routing table, the interface, the action and the two match types are always without a prefix; the CLI does not accept a field that starts with -- before these are completed.
• The NAT fields depend on the action. The snatIp.type is asked for only when rule snat and the dnatIp only when rule dnat is selected; in the other actions they are not written.
• The interface can be null. If the rule will be valid in the whole of the routing table without being bound to a certain interface, null is written in the interface field.
• Negating cannot be used together with $all. None of the three negate fields appears in the completion list when the related type is $all.
• Turning the rule off does not delete it. The --status false leaves the rule in the configuration, it only stops it from being applied.
• The DNAT address is asked for only in the DNAT action. The --dnatIp does not open in the other actions.