[7.890][FEATURE][CLOSED] Use "any" in the Packet Filter rules also for the ASG itself

Hi,

Stupid thing, probably in the product since ages, but I stumbled upon it today for the first time:

If one creates an Any-Any-allow rule the "Any" is only applied to non-ASG IP's and interfaces.

The packet filter rule is only created in the USR_FORWARD chain, not in the USR_INPUT or USR_OUTPUT chains.

If one wants to scp from the ASG to another box or send any other outgoing traffic from the ASG the packets get dropped despite the fact that there is a "any-any-allow" rule in the GUI.

This could lead to some confusion, as it did with me.

So, if we could change this behaviour for the upcoming releases, it would be nice (however this is probably something that one could argue about for ages).

Christian

0 anonymous_02 over 15 years ago

This is wanted behaviour.
To prevent users from opening their firewall accidentally, you have to make explicit rules for input/output rules.
Just use the Interface (Address) networks as source/destination.

Regards,
Daniel
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

0 Astaro Beta Bot over 15 years ago

Astaro Beta Report
--------------------------------
Version: 7.890
Type: FEATURE
State: CLOSED
Reporter: christianlouis
Contributor:  
MantisID: 
Target version: 
Fixed in version: 
--------------------------------

0 Billybob over 15 years ago in reply to anonymous_02

This is wanted behaviour.
To prevent users from opening their firewall accidentally, you have to make explicit rules for input/output rules.
Just use the Interface (Address) networks as source/destination.

Regards,
Daniel

I agree. If you are smart enough to run special software on astaro console, you are capable of a little extra tweaking on firewall rules. But for the vast majority of people opening any any -->any shouldn't expose all the daemons on the firewall itself to the internet for their own protection.[:)]
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel