Rule #3, Binding An Interface To A Host Definition

Yes, a little more clarification is welcome here too.

I think if you bind a host to an interface you get a little gain of security. So no other device could, by spoofing for example, look like this host on another, maybe untrusted, interface.

I am not sure if this will help you in kind of routing issues. For example if you had a DNS which is only reachable via specific interface, one would use a multipathing rule. Maybe this should work too?

Maybe someone has a use case for us.

Best

Alex

If you need to reconfigure, such as to fail around a bad NIC, it is much easier if the only bound item is the interface addtess.

Beyond that, I do not know.

One of the underlying technologies is iptables.  If a Network object is bound to an Interface, NAT and Firewall rules will apply to the INPUT chain - see the images at the bottom of the Rulz post.

#3 and #4 work together - using the "External (Address)" object as the target of incoming traffic is necessary to have a DNAT rule apply to the INPUT chain.  Could you instead use a separate network definition bound to the External interface?  Yes, but why create confusion by not doing things in the "accepted" fashion?

Remember that WebAdmin is a GUI that manipulates databases of objects and settings.  A single change there can cause the Configuration Daemon to rewrite hundreds of lines of the code used to run the UTM.  If you were assembling rules at the command line like you might have done in the past with a Cisco router, you could have had reason to bind something to an interface (anti-spoofing), but WebAdmin creates a configuration where that's not necessary.

Cheers - Bob

One of the underlying technologies is iptables.  If a Network object is bound to an Interface, NAT and Firewall rules will apply to the INPUT chain - see the images at the bottom of the Rulz post.

#3 and #4 work together - using the "External (Address)" object as the target of incoming traffic is necessary to have a DNAT rule apply to the INPUT chain.  Could you instead use a separate network definition bound to the External interface?  Yes, but why create confusion by not doing things in the "accepted" fashion?

Remember that WebAdmin is a GUI that manipulates databases of objects and settings.  A single change there can cause the Configuration Daemon to rewrite hundreds of lines of the code used to run the UTM.  If you were assembling rules at the command line like you might have done in the past with a Cisco router, you could have had reason to bind something to an interface (anti-spoofing), but WebAdmin creates a configuration where that's not necessary.

Cheers - Bob