Westermo RedFox Series User Manual
Page 687
Westermo OS Management Guide
Version 4.17.0-0
– Port Forwarding: With port forwarding (
) it is possible
to map incoming data to a given destination IP and (UDP/TCP) port
to another destination IP/port when forwarding the packet. As shown
in
this mapping is conducted at the pre-routing stage of the
packet processing. For every configured port forwarding rule, a filter
rule is implicitly added to the forwarding filter to allow the packet to
pass through the router. This is hinted by a dashed arrow in
– NAT: Network address translation (
) involves ”translation
operations” both in the pre-routing (”1-TO-1 NAT”) and in the post-
routing post-routing stage (”1-TO-1 NAT” and ”NAPT”) as shown in
For every configured NAT rule, an associated filter rule can be added to
the forwarding filter to allow the packet to pass through the router. This
is hinted by a dashed arrow in
Note
The user can choose if an associated filter rule should be added for
each NAT rule or not. If disabled, the user needs to configure own
filter rule(s) to make the data packets to pass through the firewall.
See
and
for more information.
– Services: Filter rules are implicitly added to to the input filter to allow
packets for enabled services to enter the unit. This includes config-
urable services such as DHCP Server (
), etc., where allow rules are added matching
TCP/UDP port numbers, IP protocols, and/or incoming interfaces appro-
priate for the configured services. As the WeOS unit acts as a DNS
forwarder, implicit allow rules to accept incoming DNS requests are also
added.
❼ Management interface: The WeOS management interface feature
) utilises firewall functionality to control which network inter-
faces the unit can be managed through.
❼ Other filter rules:
– Connection tracking (related/established): The WeOS firewall will allow
all packets associated with established connections, as well as packets
related to established connections. This means that an a rule allowing
traffic to pass through the firewall in one direction, will implicitly allow
traffic of established connections (and traffic of related connections)
to also pass in the reverse direction. Application level gateway (ALG)
➞ 2015 Westermo Teleindustri AB
687