Firewall tools

The firewall's Tools tab runs diagnostics on the firewall itself, so you can see the network the way the firewall sees it without anyone on site.

Starting an iperf server, ending connections, and capturing packets need permission to change firewalls. The other tools only need access to the site. Every test, capture, and download is recorded in the organization's Logs.

#Ping, traceroute and DNS

1. Open Tools > Ping, traceroute and DNS.
2. Choose a Test: Ping, Traceroute, DNS lookup, or Speed test.
3. Enter the Host or address, for example 1.1.1.1 or example.com. For a DNS lookup, enter the Name or address and choose the Record type. To look up an address's name, choose PTR.
4. Optionally choose the IP version and Source interface. As routed lets the firewall pick, the same as the traffic it forwards. Choose an interface to test from a particular network or WAN.
5. Click Run. Stop ends the test early.

Ping shows the packets sent, received, and lost, and the minimum, average, and maximum times. Traceroute shows each hop. DNS shows the records found, and you can ask particular DNS servers instead of the firewall's own resolvers.

The firewall runs at most three tests at a time.

#Speed test

The speed test measures the firewall's internet connection against speed.cloudflare.com.

1. Choose Speed test as the Test.
2. Choose what to Measure: Download and upload, Download only, or Upload only.
3. Optionally change Seconds each way (5 to 15, default 10) and Connections (1 to 8, default 4).
4. To test one WAN of several, choose it as the Source interface.
5. Click Run.

Results show download and upload speed, idle latency, and latency and jitter under load. The test fills the connection while it runs, so anyone using it will notice.

Each WAN on the site's dashboard has a one-click version of the same test. See Monitoring.

#iperf server

The iperf server measures throughput between a device and the firewall, for example to tell whether a slow Wi-Fi client is limited by the wireless or the wired network. The firewall runs an iperf3 server for a set time, and you run any iperf3 client on the device.

1. Open Tools > iperf server.
2. Choose the Interface the device is on, the IP version, and the Port (default 5201).
3. Choose how long it Runs for: 5, 15, 30, or 60 minutes.
4. Optionally list up to 8 addresses or networks under Allow from. Leave it empty for anyone on that network.
5. Click Start server.
6. Copy one of the commands shown and run it on the device:
   • Upload: the device sends to the firewall;
   • Download: the firewall sends to the device;
   • Both ways at once;
   • UDP at 100 Mbit/s, for jitter and loss.

Each test appears under Tests with its speeds to and from the firewall. The server stops at its time, or when you click Stop server. Only one iperf server runs at a time.

If ReadyView says iperf3 isn't installed, reinstall the ReadyView plugin on the firewall, which installs it again.

#Connections

Connections reads the firewall's state table when you ask: every connection through it, the interfaces it came in and went out on, its NAT, and the rule that let it in.

1. Open Tools > Connections.
2. Optionally type a Filter, such as an address, port, interface, or rule, and click Show.
3. Optionally narrow by Interface and Protocol, and choose Sort by: Most data, Most packets, Oldest first, or Expiring soonest.
4. Tick Read again every 10 s to keep it updated.

Reading connections changes nothing on the firewall.

#End connections

With Allow rule changes from ReadyView on, you can end connections:

• End on a row ends one connection.
• End every connection of an address ends all of that device's connections.

A device still using a connection usually opens it again. Ending connections is most useful after you add a block rule: connections already open don't see new rules until they end, and once ended, a blocked connection stays closed.

#Packet capture

Packet capture records the packets crossing one of the firewall's interfaces into a pcap file you open in Wireshark.

1. Open Tools > Packet capture and choose the Interface.
2. Optionally enter a Filter in tcpdump syntax, for example host 192.168.1.10, port 53, or vlan 20.
3. Set the limits: Packets (default 1,000), Seconds (default 60, at most 300), and Bytes per packet. Fewer bytes per packet keeps only the headers. Every capture stops at 8 MB.
4. Click Start capture.
5. Click Stop and download, or wait for a limit.
6. Click Download.

Neither the firewall nor ReadyView keeps the file, so download it before you leave the page. Only one capture runs at a time.

#Log files

Log files downloads a whole day of the firewall's filter log, as kept on its disk.

1. Open Tools > Log files and choose a Day.
2. Choose a Format: CSV (spreadsheet) or Raw (as the firewall wrote it).
3. Click Download.

A file stops at 8 MB compressed, or after two minutes of reading on a busy day; ReadyView says when that happens. ReadyView doesn't keep the file.

If ReadyView says the firewall keeps no filter log on its disk, turn on local logging under System > Settings > Logging on the firewall. For a live view of rule matches, use the live log.