Firewall configuration using available scripts

Description:

The following document describes how to set up your router's firewall using pre-defined scripts.

Requirements:

• LCOS as of version 7.60 (download latest version)
• LANtools as of version 7.60 (download latest version)

Strategies for configuring the firewall

Firewalls are interfaces between networks and restrict the exchange of data, to a greater or lesser extent. The purpose of a firewall is thus diametrically opposed to that of the network to which it belongs: Networks are supposed to connect computers, firewalls aim to prevent connections.
This contradiction indicates the dilemma of the responsible administrators who, as a result, have developed various strategies as a solution.

Allow-All
The allow-all strategy prioritizes the unobstructed communication between network users before security. It basically allows any communication and the LAN is open to intruders. The LAN only becomes more secure when the administrator successively configures new rules that restrict or prevent elements of the communication.

Deny-All
The deny-all strategy starts with a "block everything" approach with the firewall blocking all communication between the network and the rest of the world. As a second step the administrator then opens up address ranges or ports that are required for day-to-day communication with the Internet, etc.
This approach is better for the security of the LAN than the allow-all strategy but often leads to difficulties for users in the initial phase. Some things may simply not work in the same way after the deny-all firewall is activated and some computers may not be reachable, etc.

Developing an explicit "deny-all" strategy

In order to achieve the maximum degree of security and control over data traffic, we recommend that you initially block all data transfers through the firewall. Subsequently, only those functions and communication paths that are really required are selectively activated. This provides protection for example from so-called 'trojan horses' or e-mail viruses that actively establish an outgoing connection via certain ports.

Some typical applications are described below as firewall rules and can be transferred simply and easily using scripts, irrespective of device type and
software version.

Deny-All: The most important rule in a firewall
The deny-all rule is by far the most important rule for the protection of your LAN. With this rule the firewall acts in accordance with the following principle: "Anything not explicitly allowed is forbidden". This is the only strategy with which the administrator can be really sure that no possibility of access has been "forgotten" – only those points of access that have been explicitly allowed are available.

Notice:
We recommend that you set the deny-all rule before attaching the LAN to the Internet via a LANCOM device. You can then use the logging table (that can be launched from LANmonitor) to easily see which connections have been blocked by the firewall. Using this information you can then successively add "allow-rules" to the firewall.

Developing an explicit "allow-all" strategy

The LANCOM firewall's default configuration is based on an "allow-all" strategy" and all communication is allowed. Undesired functions and communication paths over the firewall should then be selectively blocked.

Some typical applications are described below as firewall rules and can be transferred simply and easily using scripts, irrespective of device type and
software version.

Procedure:

• The scripts can be imported using LANconfig.
• Highlight the device to be configured, from the context menu (right mouse button) select the menu item Configuration Management → Restore script from file.
• Select one script file and confirm the import with Open. After the script has been loaded you will find the newly created rule in LANconfig under Firewall/QoS → IPv4-Rules → Rules.
• Repeat the above steps to import additional rules.