Outgoing Firewall

In here you have the option, to control the connections from the inside (LAN and from IPFire) to the outside ( WAN ). It is possible to allow, to prohibit and to regulate both. The “Outgoing Firewall” of the Webgui offers 3 different modes to adjust your outgoing network traffic. First, it is important to consider which mode you used:

• Mode 0 : “All is allowed”, all traffic coming from the LAN and from the IPFire to the Internet are allowed. In this mode no rules can be edited and the p2p-block (see below) is not available.

• Mode 1 : “Everything is forbidden which is not allowed”, prohibits all traffic coming from the LAN and from the IPFire to the Internet, with the exception of the rules that you created (Allow rules). Indicated by the green hook.

• Mode 2 : “Everything is allowed which is not forbidden”, allows all traffic coming from the LAN and the IPFire to the Internet, with the exception of the rules that you created (Deny rules). Indicated by the white cross in a red circle.

In Mode 1 or 2, two different areas will be opened by a click on the button “Add Rule”, in here the IPTables rules can be edited or added:

In the first menu “add rule” you can specify your custom IPTable rules via the GUI of the webinterface, in here it is also possible to modify created rules subsequently.

Grafical example of Mode 2 (Deny Rule):

• Description = The name of the rule should describe the rule but it is arbitrary.
• Protocol = The agreement on the way in which data are exchanged.
• Source = Regulates the outbound LAN traffic from green, blue, orange zones and also the OpenVPN interface over a specifiedIP, MAC addresse or predefined IP/MAC groups ( see firewall groups ) and also of complete subnets. The “Internet IP” controls the outgoing trafic of the red IP address and thus the internal IPFire processes like for example the Webproxy (see example below “If the clients shall surf only through the webproxy”).

• Logging = In here the event logging that are associated with the rule can be switched on or off. It may be advisable to switch off the logging for some rules to prevent a high, unnecessary traffic in the log. But for an overview or a eventual troubleshooting the logging can also be very helpful. The logging can generally be enabled under the created rules in the last row with On and disable with Off, a click on the floppy disk icon stores the new settings.

• Destination IP or Net = Specifies a possible target in the Internet and is optionally, (by no entry all addresses are allowed). It is the same syntax as under “Source”.
• Destination port(s) = Certain services uses by the IANA defined port numbers for communication, in here you can specify this ports or whole port ranges as well as individual selected ports. The address range is 16 bit large, which means it goes from 0-65535.

*Time = The rules can be activated during a specific time (From To), but also to different days a week. From 0:00 to 0:00 is around the clock

Since there are 65535 ports, and each service uses special ports with different protocols, it is not always easy to have all the specifications in mind. In IPFire the main IPTable rules are predefined and deposited. Over the “quick add” menu the rules can be modified with a lesser extent as under the above explained “add rule” menu (but subsequently re-editable over “add rule” if necessary) and by clicking on the red pin under “Action” the rule is already added.

Shortened extract from quick add:

In addition to this you even can use the options to block well known p2p (filesharing) connections. This is very useful if you want to …

let your neighbor use your wireless connection, but you don’t want him to do some illegal filesharing, thereby wasting your bandwidth!

One could use the following services:

• Surf the Internet from LAN & Wireless (/ / Port 80,443,53 / /)

• Retrieve emails from the LAN (/ / Port 110,995,25 / /)

• FTP connections from the LAN to the Internet (/ / Port 20,21,115 / /)

• Synchronize the time of the clients from the LAN & WLAN (/ / Port 123 / /)

• Chat on the IRC (/ / Port 194,6667 / /)

• SSH and telnet connections from the LAN to the Internet (/ / Port 22,23 / /)

• Assign Dhcp to the clients on the LAN (/ / port 68 / /)

• From SSH and HTTPS on remote IPFire Systems (/ / Port 222,444 / /) from LAN

A graphic example of a possible basic configuration:

If it should be prevented that the clients bypass the proxy and therefore the proxy logs, the following rules should be created:

As “Source” the “Internet IP” (Network → red) have to be selected.

• Port 80 (http) tcp
• Port 443 (https) tcp
• Port 53 (DNS) udp und tcp –> (If IPFire establish the DNS connection)
• Port 123 (NTP time server) udp –> (if the clients get the time from IPFire)

Grafical example for a possible minimal configuration:

If there is the need for special outgoing services (ports) for example the usage of a RDP (remote desktop protocol) connection, it is possible to create a allow rule for port 3389/tcp and the source “All” (the service is usable from every zone, Source IP, Source MAC, etc). If the service should only be accessible from one zone (for example green), or a specific IP, MAC addres, specify this over “Add rule” and the pull down menu “Source” in the outgoing firewall.