En este articulo aprenderemos como crear una regla de firewall, se pueden utilizar los comandos set o edit (ambos métodos se describen a continuación). Además, utilizaremos los comandos compare, discard, up, top, copy y rename.
Para crear una regla de firewall utilizaremos la sintaxis:
ubnt@ubnt:~$ configure
[edit]
ubnt@ubnt# set firewall name TEST default-action drop
[edit]
ubnt@ubnt# set firewall name TEST enable-default-log
[edit]
ubnt@ubnt# set firewall name TEST rule 10 description “allow icmp”
[edit]
ubnt@ubnt# set firewall name TEST rule 10 action accept
[edit]
ubnt@ubnt# set firewall name TEST rule 10 protocol icmp
[edit]
Para mostrar cambios no confirmados, utilice el comando compare:
ubnt@ubnt# compare
[edit firewall]
+name TEST {
+ default-action drop
+ enable-default-log
+ rule 10 {
+ action accept
+ description “allow icmp”
+ protocol icmp
+ }
+}
[edit]
Para deshacer los cambios no confirmados, utilizar el comando discard:
ubnt@ubnt# discard
Changes have been discarded
[edit]
ubnt@ubnt# compare
No changes between working and active configurations
[edit]
Para crear la misma regla de firewall y reducir la cantidad de repeticiones en la sintaxis completa, utilice el comando edit:
ubnt@ubnt# edit firewall name TEST
[edit firewall name TEST]
ubnt@ubnt#set default-action drop
[edit firewall name TEST]
ubnt@ubnt# set enable-default-log
[edit firewall name TEST]
ubnt@ubnt#edit rule 10
[edit firewall name TEST rule 10]
Presione el ? o tecla de tab para mostrar opciones para el nivel de edición especificado:
ubnt@ubnt# set
action disable ipsec p2p source time
description fragment limit protocol state
destination icmp log recent tcp
[edit firewall name TEST rule 10]
ubnt@ubnt# set description “allow icmp”
[edit firewall name TEST rule 10]
ubnt@ubnt# set action accept
[edit firewall name TEST rule 10]
ubnt@ubnt# set protocol icmp
[edit firewall name TEST rule 10]
Para mostrar los cambios dentro del nivel de edición, utilice el comando compare:
ubnt@ubnt# compare
[edit firewall name TEST rule 10]
+action accept
+description “allow icmp”
+protocol icmp
[edit firewall name TEST rule 10]
Para subir un nivel de edición, utilice el comando up:
ubnt@ubnt#up
[edit firewall name TEST]
ubnt@ubnt# compare
[edit firewall name TEST]
+default-action drop
+enable-default-log
+rule 10 {
+ action accept
+ description “allow icmp”
+ protocol icmp
+}
[edit firewall name TEST]
ubnt@ubnt# up
[edit firewall]
ubnt@ubnt# compare
[edit firewall]
+name TEST {
+ default-action drop
+ enable-default-log
+ rule 10 {
+ action accept
+ description “allow icmp”
+ protocol icmp
+ }
+}
[edit firewall]
Para volver al nivel de edición superior, utilice el comando top:
ubnt@ubnt# top
[edit]
ubnt@ubnt# compare
[edit firewall]
+name TEST{
+ default-action drop
+ enable-default-log
+ rule 10 {
+ action accept
+ description “allow icmp”
+ protocol icmp
+ }
+}
[edit]
Para mostrar la regla de firewall existente, use el comando show firewall:
ubnt@ubnt# show firewall
name WAN1_LOCAL {
default-action drop
rule 10 {
action accept
state {
established enable
related enable
}
}
rule 20 {
action drop
state {
invalid enable
}
}
rule 30 {
action accept
destination {
port 22
}
protocol tcp
}
}
[edit]
Para crear una nueva regla de firewall de una regla de firewall existente, utilice el comando copy:
ubnt@ubnt# edit firewall
[edit firewall]
ubnt@ubnt# copy name WAN1_LOCAL to name WAN2_LOCAL
[edit firewall]
ubnt@ubnt# commit
[edit firewall]
ubnt@ubnt#top
[edit]
ubnt@ubnt#show firewall
name WAN1_LOCAL {
default-action drop
rule 10 {
action accept
state {
established enable
related enable
}
}
rule 20 {
action drop
state {
invalid enable
}
}
rule 30 {
action accept
destination {
port 22
}
protocol tcp
}
}
name WAN2_LOCAL {
default-action drop
rule 10 {
action accept
state {
established enable
related enable
}
}
rule 20 {
action drop
state {
invalid enable
}
}
rule 30 {
action accept
destination {
port 22
}
protocol tcp
}
}
[edit]
Para cambiar el nombre de la nueva regla de firewall, use el comando rename:
ubnt@ubnt# edit firewall
[edit firewall]
ubnt@ubnt# rename name W[TAB]
WAN1_LOCAL WAN2_LOCAL
[edit firewall]
ubnt@ubnt# rename name WAN2_LOCAL to name WAN2_IN
[edit firewall]
ubnt@ubnt# commit
[edit firewall]
ubnt@ubnt#top
[edit]
ubnt@ubnt# show firewall name
name WAN1_LOCAL {
default-action drop
rule 10 {
action accept
state {
established enable
related enable
}
}
rule 20 {
action drop
state {
invalid enable
}
}
rule 30 {
action accept
destination {
port 22
}
protocol tcp
}
}
name WAN2_IN {
default-action drop
rule 10 {
action accept
state {
established enable
related enable
}
}
rule 20 {
action drop
state {
invalid enable
}
}
rule 30 {
action accept
destination {
port 22
}
protocol tcp
}
}
[edit]
ubnt@ubnt#