Symantec Endpoint Protection Firewall Rule Set

Thank you. jhalapradeep

I was able to create a host rule in Firewall and specify an IP range to allow for port 80 access. When specifying local/remote port (in this case 80), I understand that the local port should be 80 since thats where the sevice is running on. What should I specify for remote port?


Also this rule does allow access to that port , now my firewall restrictions are pretty loose it seems as it will allow access to the service running on port 80 with/or without these rule. How can I specify a rule that will BLOCK all port 80 traffic thats not from the ip range specified?

Hi Anti-Mhz,

For this rule both local and remote ports will remain as 80.

Now First: Create a host rule with the desired IP range to allow port 80 traffic.
-Create another host rule and provide the remaining IP range where we do not need to allow port 80 traffic.  
-Place the rule 1 on top of the list ( to provide top priority)
-Place rule 2 (to block) at second position after rule 1.
-Make sure the action chosen for Rule 2 is Block.
-The firewall rules work on the priority basis.

Please let me know the result, if you need further assistance, I will test the rule and update you on the same.

Regards,
pradeep.

Hi,

Ok this can be much more simpler...
You just need to create one host rule.... no need for 2
-Create a host rule and specify the IP range that you want to DENY the access through port 80.
-Here the local and remote both port will be 80.
-So the action for this rule will be BLOCK.
-Now by default the remaining IPs will be allowed the access through port 80, and only the mentioned in rule will be blocked.

I hope this will help you creating the desired rule.

id like to DENY the INTERNETS - maybe 10 ips . so u proposing blocking 1.1.1.1- 255.255.255.255 in the ips? sounds good.

I would really appreciate if you can explain this scenario in details.  It seems we are confusing something over here.
-If you want to allow a specific range of IP for incoming access on port 80,  are these remote computers of your network?
-Please explain the complete scenario that you wish to implement.

There are remote computers on another network,. about 7-10 diferent ips  + localhost for local
the firewall is symantec endpoint rpotection
the service is apache, now running at port 81

Id like to deny all external access but these 7-10 different ips mentioned above

Hi,
Sorry for the Delay.

Ok here you will need to create 2 rules.
 1) Priority 1:
Create a host rule with local and remote port as 80 and mention the IPs that you want to ALLOW.

2) Priority 2:
Create another rule and mention the local and remote port as 80 and under action select Block.

So this rules will block all the traffic from internet BUT the allowed IPs.  on port 80.

Please let me know if this works after testing it.

Regards,

Pradeep