Firewall settings - are they good?

[shiro]

Hello, I would like to consult if my firewall settings are okay, and if I understand how firewall works correctly.
The goals are:
- allow access from my home network and remotely from PC at work
- allow access just from my country, to minimize attacks from internet (login attempts, etc.)
- allow access to services which needs full access into internet (torrent, VPN, etc.)
- block everything else I dont need.

192.168.xxx.xxx is my home network.
62.xxx.xxx.xxx is public IP of my computer at work - to allow access remotely when I need it. (I dont know if there are needed to set something up in firewall when I use QC or DDNS too.)

I am setting up rules just in LAN1 interface, because everything else what is not allowed, is blocked by default.
There are no rules in "all interfaces" or any other interface than LAN1.

If I understand how firewall works correctly, when packet come, firewall will start matching it against rules. It stops matching when it find the rule that match. And if it dont, it will block it. Is that true?

Here are my firewall rules. Are they OK, or do you have some recommendations please? Thanks.

 

[Rusty]

And if it dont, it will block it. Is that true?

correct

I did notice that the Windows file server is on the list. While it's fine to have it allowed on the FW list, I do hope you will not open this port (445/TCP) towards the internet on your router. That will be highly dangerous.

Rest is fine.

 

[shiro]

No, the port is closed on router. Its just for my home network. I assume that without Windows file server allowed, I cant access NAS through SMB.

 

[Rusty]

No, the port is closed on router. Its just for my home network. I assume that without Windows file server allowed, I cant access NAS through SMB.

Well, try first. Local communication will not be blocked unless there is an FW in effect at some level. Still, if your Windows client has an FW active you might also need to open it on that side as well.

 

[shiro]

Thanks, I will try.

 

[fredbert]

Given that the firewall rules are tested top to bottom and stop at the first match, you have three unnecessary rules:

• Rule 5 (SMB access to LAN) is already covered by Rule 1 (always allow LAN access).
• Slovakia access (allow to all services) is covered by Rule 3 and that means Rule 4 (mgmt access) and Rule 9 (FTP) are never used.

You can disable Rules 4, 5, and 9 if you don't want to delete them.

While limiting access from countries can be by-passed by Internet clients that use in-country VPN breakout services, there's no harm in using country rules as this will stop some unwanted access attempts.

 

[Telos]

I would disable all but the first 3 rules. Then open additional rules, only as necessary.

 

[WST16]

Hi,

My suggestions…
I’d use the first 3 and refine rule no. 3 and limit it to what’s needed (instead of ”all”).
Place an All, All, Deny at the end (although it says it’s going to default to that (for peace of mind).
Consider using a reverse proxy.
BT traffic should go over a “trusted” VPN.

A side note: there’s no need to mask the 192.168.x.x addresses, they’re local and not routed externally.

 

[Gerard]

Hi,

My suggestions…
I’d use the first 3 and refine rule no. 3 and limit it to what’s needed (instead of ”all”).
Place an All, All, Deny at the end (although it says it’s going to default to that (for peace of mind).
Consider using a reverse proxy.
BT traffic should go over a “trusted” VPN.

A side note: there’s no need to mask the 192.168.x.x addresses, they’re local and not routed externally.

Agreed

-- post merged: 29. Jul 2022 --

View attachment 10287

Also what county is the IP address in rule 2? If it’s a Slovakia ip address then it’s not needed since it would be covered in rule 3.

 

[shiro]

Rule 2 IP is from Slovakia also. I just specified it there to secure my access to NAS even if geolocation get wacky or so

Thanks you all for suggestions.

-- post merged: 4. Aug 2022 --

Hi,

A side note: there’s no need to mask the 192.168.x.x addresses, they’re local and not routed externally.

So the NAS's firewall does not apply anything to packets coming from LAN?

 

[fredbert]

So the NAS's firewall does not apply anything to packets coming from LAN?

That's not what was meant. The NAS's firewall applies to connections from anywhere and doesn't differentiate between public IP networks and RFC 1918 reserved subnets. The comment was regarding you obscuring the LAN IPs in the screen shot. It's a personal decision whether to divulge the LAN subnets that you are using, or not, and is debatable whether it reveals usable information about your LAN. Any IP in the RFC 1918 reserved subnets cannot be directly accessed across the Internet as these are excluded from routing tables (plus which of the millions of 192.168.1.N is the one you are targeting ). My preference is to obscure or remove my LAN IPs from screen shots/command outputs that I post.

 

[WST16]

So the NAS's firewall does not apply anything to packets coming from LAN?

What @fredbert said.

The firewall will examine any inbound packets. In fact, if you didn’t allow your subnet (your first rule), you would’ve been locked out.

 

[shiro]

Thanks for clarification