Getting ready for Black Hat next week? Kick things off with the WatchGuard Badge Challenge and test your puzzle and cipher skills. Do you have what it takes to earn our limited edition Firebox Badge? Get started today - https://crimsonthorn.net
Course Of The Month
Become a Premium Member and unlock a new, free course in leading technologies each month.
Solved
Draytek Filter Problems
Posted on 2014-04-12
Hi folks,
I was wondering if someone with some experience with Draytek Data Filters could assist me for a moment as I have been struggling trying to block and allow certain ports and IP addresses and its now doing my head in, I am not sure what I am doing wrong.
I am basically trying to create a firewall rule to block all WindowsXP computers from accessing the external internet traffic unless specifically permitted. All XP computers are on the range 192.168.100.190-196 and I have setup the following Block All rule:
Rule Name: WinXP Block
Direction: LAN -> WAN
Source IP: 192.168.100.190-196
Destination IP: Any
Service Type: Any
Filter: Block Immediatley
This rule works fine. Above this I then define the allow rules which are:
Rule Name: Email
Direction: WAN - LAN
Source IP: Any
Destination IP: Any
Service Type: TCP 25
Filter: Block Pass Immediatley
Rule Name: Remote Access
Direction: LAN -> WAN
Source IP: Remote Access Server IP
Destination IP: Any
Service Type: TCP Port ranges
Filter: Block Pass Immediatley
For some reason when I then check the syslog for the Draytek, I still see the above access rule and a few other rules still being blocked when they have been defined to be permitted.
Can someone tell me why this may be occurring?
Thanks
I was wondering if someone with some experience with Draytek Data Filters could assist me for a moment as I have been struggling trying to block and allow certain ports and IP addresses and its now doing my head in, I am not sure what I am doing wrong.
I am basically trying to create a firewall rule to block all WindowsXP computers from accessing the external internet traffic unless specifically permitted. All XP computers are on the range 192.168.100.190-196 and I have setup the following Block All rule:
Rule Name: WinXP Block
Direction: LAN -> WAN
Source IP: 192.168.100.190-196
Destination IP: Any
Service Type: Any
Filter: Block Immediatley
This rule works fine. Above this I then define the allow rules which are:
Rule Name: Email
Direction: WAN - LAN
Source IP: Any
Destination IP: Any
Service Type: TCP 25
Filter: Block Pass Immediatley
Rule Name: Remote Access
Direction: LAN -> WAN
Source IP: Remote Access Server IP
Destination IP: Any
Service Type: TCP Port ranges
Filter: Block Pass Immediatley
For some reason when I then check the syslog for the Draytek, I still see the above access rule and a few other rules still being blocked when they have been defined to be permitted.
Can someone tell me why this may be occurring?
Thanks
[X]
Welcome to Experts Exchange
Add your voice to the tech community where 5M+ people just like you are talking about what matters.
- Help others & share knowledge
- Earn cash & points
- Learn & ask questions
-
8
5
13 Comments
Active today
You're sure it's
Filter: Block Pass Immediately ?
I would expect
Filter: Pass Immediately
Filter: Block Pass Immediately ?
I would expect
Filter: Pass Immediately
Active today
I would do it like this:
Rule 1:
Rule Name: WinXP Block
Direction: LAN -> WAN
Source IP: 192.168.100.190-196
Destination IP: Any
Service Type: Any
Filter: Block if no further match
Rule 2:
Rule Name: Email
Direction: WAN -> LAN //you're sure you want this? You have an internal mail server?
Source IP: Any // or are your XP boxes connecting to an external SMTP?
Destination IP: Any
Service Type: TCP 25
Filter: Pass Immediately
Rule 3:
Rule Name: Remote Access
Direction: LAN -> WAN
Source IP: Remote Access Server IP
Destination IP: Any
Service Type: TCP Port ranges
Filter: Pass Immediately
BTW, rule no 3 will allow your Remote Access server to connect out, not for outside connections to it. If you need to connect to it from outside your LAN, you'll need something like:
Rule 4:
Rule Name: Remote Access wan-lan
Direction: WAN -> LAN
Source IP: Any (or a set of predetermined IP addresses)
Destination IP: Remote Access Server IP
Service Type: TCP Port ranges
Filter: Pass Immediately
Rule 1:
Rule Name: WinXP Block
Direction: LAN -> WAN
Source IP: 192.168.100.190-196
Destination IP: Any
Service Type: Any
Filter: Block if no further match
Rule 2:
Rule Name: Email
Direction: WAN -> LAN //you're sure you want this? You have an internal mail server?
Source IP: Any // or are your XP boxes connecting to an external SMTP?
Destination IP: Any
Service Type: TCP 25
Filter: Pass Immediately
Rule 3:
Rule Name: Remote Access
Direction: LAN -> WAN
Source IP: Remote Access Server IP
Destination IP: Any
Service Type: TCP Port ranges
Filter: Pass Immediately
BTW, rule no 3 will allow your Remote Access server to connect out, not for outside connections to it. If you need to connect to it from outside your LAN, you'll need something like:
Rule 4:
Rule Name: Remote Access wan-lan
Direction: WAN -> LAN
Source IP: Any (or a set of predetermined IP addresses)
Destination IP: Remote Access Server IP
Service Type: TCP Port ranges
Filter: Pass Immediately
Active 5 days ago
Hi Dan,
Tried that and it seems to block everything and not allow anything else through the permit rules.
Tried that and it seems to block everything and not allow anything else through the permit rules.
Active today
OK, that rule says "Block if no further match", which means the firewall found no other matches and chose to block.
What traffic have you tried and was blocked?
What traffic have you tried and was blocked?
Active 5 days ago
We use a remote access program like Logmein and it works on TCP port 8040-8041 but even with both LAN-WAN / WAN -LAN rules in place it wont allow this traffic.
Active 5 days ago
Could it be because its Rule 1 and is set to block everything that could be the problem and its not allowing the rules below because its matching any?
Active today
First, remove Rule no 1 and see if Logmein can connect.
If it can't connect, then you have other rules that deny it. Fix those.
If it can connect without Rule no1, but not with it, this means Logmein traffic does not match any of the rules 2 to 4. Post them here (I think screenshots are faster than manually copying), maybe we can spot the problem.
If it can't connect, then you have other rules that deny it. Fix those.
If it can connect without Rule no1, but not with it, this means Logmein traffic does not match any of the rules 2 to 4. Post them here (I think screenshots are faster than manually copying), maybe we can spot the problem.
Active 5 days ago
Hi Dan,
I have managed to get it to work, it did not like the fact I was allowing certain ports so I have had to allow the full IP address unfortunately otherwise it fails. This is not really a problem as various services should be allowed and should be safe from those 3 IP addresses.
Thanks for all the help.
I have managed to get it to work, it did not like the fact I was allowing certain ports so I have had to allow the full IP address unfortunately otherwise it fails. This is not really a problem as various services should be allowed and should be safe from those 3 IP addresses.
Thanks for all the help.
Featured Post
It's inevitable. People leave organizations creating a gap in your service. That's where Percona comes in.
See how Pepper.com relies on Percona to:
-Manage their database
-Guarantee data safety and protection
-Provide database expertise that is available for any situation
Question has a verified solution.
If you are experiencing a similar issue, please ask a related question
When posting a question about a Cisco ASA, Cisco Router or Cisco Switch, it can aid diagnosis if a suitably sanitised copy of the config is provided. It is much better to leave as much of the configuration as original as possible, as it could be tha…
Before I go to far, let's explain HA (High Availability) and why you should consider it.  High availability is the mechanism used to provide redundancy to any service at the same site and appears as a single service to the users of that service.  As…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Suggested Courses
Earn Certification
HTML5 Specialist - Certification
Free withPremium
Course of the Month7 days, 4 hours left to enroll
622 members asked questions and received personalized solutions in the past 7 days.
Join the community of 500,000 technology professionals and ask your questions.