Optional Services

As an edge device, FortiWAN provides other functions except the major traffic load balancing and fault tolerance. These optional functions are helpful to manage the network in all the ways.

Firewall

This section introduces how to set up the firewall. Unlimited number of rules can be added to the firewall rule list. The rules are prioritized from top to bottom that is rules at the top of the table will be given higher precedence over lower ranked ones. [IPv4 Rules] and [IPv6 Rules] are for configurations of IPv4 and IPv6 respectively.

FortiWAN provides mechanisms to record, notify and analysis on events refer to the Firewall service, see “Log” and “Reports: Firewall”.

Default rules

By default, FortiWAN’s firewall enables the following IPv4/IPv6 rules to deny some accesses coming from the Internet, which might cause general security issues:

1. When=All-Time & Source=WAN & Destination=Localhost & Service=HTTP(80) & Action=Deny
2. When=All-Time & Source=WAN & Destination=Localhost & Service=HTTPS(443) & Action=Deny
3. When=All-Time & Source=WAN & Destination=Localhost & Service=SSH(22) & Action=Deny
4. When=All-Time & Source=WAN & Destination=Localhost & Service=SNMP(61) & Action=Deny

Firewall

5. When=All-Time & Source=WAN & Destination=Localhost & Service=RIP(520) & Action=Deny
6. When=All-Time & Source=WAN & Destination=Any Address & Service=TCP@139 & Action=Deny
7. When=All-Time & Source=WAN & Destination=Any Address & Service=TCP@445 & Action=Deny
8. When=All-Time & Source=WAN & Destination=Localhost & Service=TCP@5432 & Action=Deny
9. When=All-Time & Source=Any Address & Destination=Any Address & Service=Any & Action=Accept

The ninth rule is fixed to be the last rule at the bottom for evaluation. Packets that do not match any other rule will match this rule and be accepted. This rule is unmodifiable. The second rule denies any HTTPS access to FortiWAN’s localhost from the Internet, which means it is unable to access to the Web UI through any WAN port. You can disable this rule or change Action to Accept to allow Web UI accessing throught WAN ports if no security issues are concerned. The sixth, seventh and eighth rules deny any access (coming from the Internet) of NetBIOS, Microsoft-DS Active Directory, Windows shares and Microsoft-DS SMB file sharing, and the Postgre SQL database system that FortiWAN uses for Reports.

Example 1

Rules for Filtering Packets l The users from the internet (WAN) can only access FTP Server 211.21.48.195 through port 21.

• The users from LAN can access all servers and hosts on the internet (WAN) through port 25 (SMTP), port 80 (HTTP), port 21 (FTP), and port 110 (POP3).
• All other packets are blocked.

The rules table for the example will look like this:

Firewall

Example 2

Rules for Filtering Packets l The users from the internet (WAN) can access server 211.21.48.195 inside DMZ through TCP port 7000. l The hosts 192.168.0.100 – 192.168.0.150 in the LAN can access the Internet (WAN) but the others cannot.

• Users from the Internet (WAN) cannot connect to the port 443 on FortiWAN (i.e. Web Administration on FortiWAN). Note: “Localhost” represents the address of FortiWAN host machine. l Users from LAN can access FTP server 192.192.10.1 through port 21.
• Users from the internet cannot ping FortiWAN . Note: To intercept ping messages, users can deny “ICMP” protocol in service type because ping is a type of “ICMP”. l Users from the LAN cannot access DMZ. l Users from the internet (WAN) cannot access LAN and DMZ.

The rules table for the example will look like this:

See also

l Busyhour Settings l Using the web UI l Reports: Firewall