Rules, NAT, and aliases

The Security tab's Rules group has four sections:

The Activity tab adds the Live log and History. See How changes work for the settings and permissions behind every change.

#Firewall rules

Firewall rules shows the firewall's filter rules one interface at a time, with Floating first. Rules are checked top to bottom, and the first match wins.

Each rule shows its action (Pass, Block, Reject, or Match), direction, source and destination, and how many packets and connections it has matched since the rules were last loaded. Badges mark rules that are Disabled, Automatic, or Logged. Last match marks a rule that isn't "quick": a later rule that also matches takes precedence.

Click Details on a rule for a plain-English explanation: what it does and why, where it sits in the order, who set it, and its counters. ReadyView also warns about rules that are wide open, such as one that allows anything arriving on an interface, including connections to the firewall itself.

Show automatic rules reveals the rules the firewall makes for itself, such as anti-lockout.

#Add a rule

1. Open Security > Firewall rules, choose the interface tab, and click Add rule.
2. Choose the Action: Pass, Block, or Reject. Block drops the traffic silently; Reject also tells the sender.
3. Check the Interfaces, Direction (usually In (arriving)), IP version, and Protocol.
4. Set the Source and Destination. Each takes one address, network, interface network, or alias, plus a port or port range for TCP and UDP. Tick Match everything except this to invert it.
5. Add a Description so others know why the rule is there.
6. Optionally tick Log packets that match this rule to see its matches in the live log.
7. Click Save. The rule goes to the firewall straight away.

A new rule starts as Pass, on the current interface, In, IPv4, any protocol, from any to any, without logging.

Each of your rules also has Edit, Disable or Enable, Log matches or Stop logging, Move up, Move down, and Delete.

#Reorder rules

1. Click Reorder rules on the interface.
2. Drag rules by their handle, or use the arrows.
3. Click Save order.

The firewall makes every move at once or none. Up to 50 moves fit in one save; for more, save part of the new order first. Rules made outside ReadyView keep their place.

#Rules you can't edit here

• Automatic rules are built into the firewall.
• Rules made on one of the firewall's older pages can only be changed on the firewall itself.
• Rules a ReadyView feature keeps show "Managed by …, so it can only be changed there." with a link to that feature, such as the region filter, blocklists, group policies, uplinks, or a VPN.

#Port forwards and NAT

Port forwards and NAT shows all four kinds of NAT on the firewall, each explained in plain English: Port forwards, Outbound NAT (with its mode: Automatic, Hybrid, Manual, or Disabled), 1:1 NAT, and NPTv6. Only port forwards can be changed here. The others are changed on the firewall itself.

#Add a port forward

A port forward sends traffic that arrives on the firewall's internet address to a device inside, such as a camera recorder or a game server.

1. Open Security > Port forwards and NAT and click Add port forward.
2. Choose where it Arrives on, usually WAN, and optionally limit From to the addresses allowed to use it.
3. Leave Addressed to as the WAN address, and choose the protocol and port.
4. Under Send to, enter the Host inside, for example 192.168.1.20, and its port, or Same port.
5. Under Let it in with, choose:
   • A rule the firewall adds (the default): the firewall adds a pass rule and keeps it in step with the port forward.
   • Pass, without a rule: the traffic is let in as it's forwarded, and no filter rule sees it.
   • Rules of your own: nothing gets in until you add a filter rule for it.
6. Click Save.

#Aliases

An alias is a named list of addresses, networks, or ports that rules can use. Change the alias, and every rule that uses it follows.

The Aliases section lists each alias with what it's defined as, what it holds right now, and how much traffic it has blocked and passed. The firewall's own aliases are behind Show the firewall's own aliases. Aliases a ReadyView feature keeps, such as the region filter's, link to that feature.

#Add an alias

1. Open Security > Aliases and click Add alias.
2. Enter a Name: letters, digits, and underscores, up to 32 characters, not starting with a digit. It can't be changed later.
3. Choose a Type: Hosts, Networks, Ports, or Network group.
4. Enter the Entries, one per line. Start an entry with ! to leave it out.
5. Click Save.

Only these four types can be changed in ReadyView. URL tables, GeoIP, and other types are changed on the firewall. An alias that a rule or another alias still uses can't be deleted until you change those first.

To copy aliases to other firewalls, use Fleet templates.

#Group policies

A group policy gives a group of devices or networks their own internet rules:

• keep them off the internet all the time, or on a schedule, such as school devices overnight;
• block DNS categories for them only;
• give them a speed limit.

#Create a policy

1. Open Security > Group policies and click Add policy.
2. Enter a Name and leave Policy is on ticked.
3. Under Members, pick Devices from the firewall's client list, tick Whole networks, or type Addresses, one per line.
4. Under Internet access, choose:
   • Always blocked;
   • Blocked on a schedule, then set the Days, From, and To for each time window;
   • Allowed.
5. Optionally tick categories under DNS filter for these members. This needs Unbound DNS on the firewall.
6. Optionally set a Speed limit for Download and Upload.
7. Click Create policy.

Schedules follow the firewall's clock, which the section shows with its time zone. A schedule can run past midnight.

To block one device quickly, open the firewall's client list, for example in Network > Leases and ARP, and choose Policies > Block this device. ReadyView makes a policy for it.

#What a policy does and doesn't do

• A policy only blocks the internet. Members can still reach the firewall and your local networks.
• The firewall's own traffic is never blocked.
• The site-wide DNS filter still applies on top of a policy.
• A device's own limit under Speed limits comes first. A device in more than one policy gets the lowest limit.
• Policies follow devices by address. When a member's address changes, the firewall updates the policy within about 5 minutes.

A firewall can have up to 20 policies, each with up to 100 members and 8 time windows.

#Live log

Activity > Live log streams the firewall's filter log while you watch. Nothing is stored. It needs plugin 1.8.

The live log shows packets matched by rules that have logging on, plus the default deny when the firewall logs it. If nothing shows, turn on Log matches for the rule you're interested in.

• Pause and Resume hold the view. New lines are counted while paused.
• Filter by action (All, Pass, Block), interface, or text such as an address, port, or rule.
• Click a rule name to jump to it, or show only that rule's lines.
• Download saves the lines shown, as filtered, as a CSV file.

The view keeps the last 500 lines and stops after about 30 minutes, so a forgotten tab doesn't keep the firewall busy. Click Keep watching to carry on.

#Allow traffic from a block line

On a Block or Reject line, click Allow. ReadyView drafts a pass rule for exactly that traffic: the interface, source, destination, and port. It places the draft just before the rule that blocked it and turns logging on. Check the draft, then save it.

#History

Activity > History lists firewall rule changes made from ReadyView: who made each one and when, what changed, and how it ended (Applied, Put back by the firewall, Refused by the firewall, Failed on the firewall, or No answer). It covers the firewall's last 100 events.

History shows rule changes only. Changes to every other area, such as port forwards, aliases, networks, uplinks, and VPNs, are in your organization's Logs. Changes made in the firewall's own web interface aren't in either; see Configuration backups.