Firewall rules, groups - confusing!

Hi all,
I am trying to setup firewall on my Macmini server 10.6.7. Hope you could help me clarify below issues:
- By default I got "any group", "10-net group", "129.168-net group" and "192.168.1-net group". Should I delete all and just keep 192.168.1-net group? if keep, which check box I have to tick to enable services?
- Is it a right way when I tick all "Deny rule" in Advance tab and then open service by service in Services tab?
Thanks and looking forward to your respond!

Those are IP subnets, and those groups select the originating IP address for the incoming connection.
Your network looks to be using the 192.168.1.x/24 subnet. Which is common. Unfortunately, the common subnets are also very bad choices if you decide to use VPNs in the future.
Ok, your "10-net group", "129.168-net group" and "192.168.1-net group" should probably be "10-net group", "192.168-net group" and "192.168.1-net group" (typo in there), and you'll find that is the 10.0.0.0/8 subnet, and the 192.168.0.0/16 block, and the 192.168.1.0/24 block.
Here are the three private IP address blocks:
10.0.0.0 to 10.255.255.255, also called 10.0.0.0/8
172.16.0.0 to 172.31.255.255, also known as 172.16.0.0/12
192.168.0.0 to 192.168.255.255, also known as 192.168.0.0/16
You'll generally have a subnet within these blocks, but we'll skip the IP subnet introduction for now and point to the use of "10-net group" to point to any incoming address in 10.0.0.0/8; connections from addresses 10.0.0.1 to 10.255.255.254. "192.168-net group" is 192.168.0.1 to 192.168.255.254, and "192.168.1-net group" is 192.168.1.1 to 192.168.1.254.
You can read the Wikipedia article on this IP addressing stuff but (and I've been tussling with IP for a very long time) it's surprisingly dense reading. (It's entirely correct, but it's written for IP nerds and not really for IP newbies.) If you don't bother reading that (and I would not blame you), then just remember you can't use the .0 and .255 addresses within any particular subnet; the ranges I show above reflect that, though technically the .0 and .255 addresses are within the ranges, and you probably want to configure your network out of the 192.168.0.1 to 192.168.0.254 and 192.168.1.1 to 192.168.1.254 subnets if you might ever need to use VPNs.
Now these private addresses should generally not be active on the public internet and should not be passing default router configurations, and so these should be LAN local. There are cases of ISPs using these blocks and issuing addresses from here for all private LANs managed by that ISP, so there's no solid rule of what you might see; there are various ISP schemes and even more local LAN schemes and permutations.
So the answer to your question is... Do you know what IP addresses will be referencing and reaching your server? If so, then yes, you can delete those groups that you are not using. But I'd probably leave the groups alone (at least for now), and just select the services within each (that your network is not using) for no traffic. Which is the "don't delete" answer.
I also typically recommend acquiring and installing an external gateway firewall box and not running a Mac as a gateway, as that makes networking (far) easier, and (if you purchase a gateway firewall with server-oriented features, or use one of the available open-source options with server-oriented features) you can connect via external VPN to your firewall to allow remote (in-bound) access into your network. That also means you have less traffic hitting your server-local firewalls.
I'd suggest some introductory reading on IP networking and DNS services, as they're essential to operating a server.

Similar Messages

0x8007000e (E_OUTOFMEMORY) while adding a firewall rule using the windows firewall COM API

Hello,
Configuration: Windows Embedded 8 64-bit.
I'm using the Windows Firewall with Advanced Security COM API. The program uses the INetFwRules interface. Basically, I'm using the following code (Form the code sample available here : http://msdn.microsoft.com/en-us/library/windows/desktop/dd339604%28v=vs.85%29.aspx.)
I get the error when performing "hr = pFwRules->Add(pFwRule);".
We can also encounter the problem when removing a rule (using pFwRules->Remove(ruleName);)
HRESULT hrComInit = S_OK;
HRESULT hr = S_OK;
INetFwPolicy2 *pNetFwPolicy2 = NULL;
INetFwRules *pFwRules = NULL;
INetFwRule *pFwRule = NULL;
long CurrentProfilesBitMask = 0;
BSTR bstrRuleName = SysAllocString(L"SERVICE_RULE");
BSTR bstrRuleDescription = SysAllocString(L"Allow incoming network traffic to myservice");
BSTR bstrRuleGroup = SysAllocString(L"Sample Rule Group");
BSTR bstrRuleApplication = SysAllocString(L"%systemroot%\\system32\\myservice.exe");
BSTR bstrRuleService = SysAllocString(L"myservicename");
BSTR bstrRuleLPorts = SysAllocString(L"135");
// Initialize COM.
hrComInit = CoInitializeEx(
0,
COINIT_APARTMENTTHREADED
// Ignore RPC_E_CHANGED_MODE; this just means that COM has already been
// initialized with a different mode. Since we don't care what the mode is,
// we'll just use the existing mode.
if (hrComInit != RPC_E_CHANGED_MODE)
if (FAILED(hrComInit))
printf("CoInitializeEx failed: 0x%08lx\n", hrComInit);
goto Cleanup;
// Retrieve INetFwPolicy2
hr = WFCOMInitialize(&pNetFwPolicy2);
if (FAILED(hr))
goto Cleanup;
// Retrieve INetFwRules
hr = pNetFwPolicy2->get_Rules(&pFwRules);
if (FAILED(hr))
printf("get_Rules failed: 0x%08lx\n", hr);
goto Cleanup;
// Create a new Firewall Rule object.
hr = CoCreateInstance(
__uuidof(NetFwRule),
NULL,
CLSCTX_INPROC_SERVER,
__uuidof(INetFwRule),
(void**)&pFwRule);
if (FAILED(hr))
printf("CoCreateInstance for Firewall Rule failed: 0x%08lx\n", hr);
goto Cleanup;
// Populate the Firewall Rule object
pFwRule->put_Name(bstrRuleName);
pFwRule->put_Description(bstrRuleDescription);
pFwRule->put_ApplicationName(bstrRuleApplication);
pFwRule->put_ServiceName(bstrRuleService);
pFwRule->put_Protocol(NET_FW_IP_PROTOCOL_TCP);
pFwRule->put_LocalPorts(bstrRuleLPorts);
pFwRule->put_Grouping(bstrRuleGroup);
pFwRule->put_Profiles(CurrentProfilesBitMask);
pFwRule->put_Action(NET_FW_ACTION_ALLOW);
pFwRule->put_Enabled(VARIANT_TRUE);
// Add the Firewall Rule
hr = pFwRules->Add(pFwRule);
if (FAILED(hr))
printf("Firewall Rule Add failed: 0x%08lx\n", hr);
goto Cleanup;
This works pretty well but, sometimes, at system startup, adding a rule ends up with the error 0x8007000e (E_OUTOFMEMORY) ! At startup, the system is always loaded cause several applications starts at the same time. But nothing abnormal. This is quite a random
issue.
According MSDN documentation, this error indicates that the system "failed to allocate the necessary memory".
I'm not convinced that we ran out of memory.
Has someone experienced such an issue? How to avoid this?
Thank you in advance.
Regards, -Ruben-

Does Windows 8 desktop have the same issue? Are you building a custom WE8S image, or are you using a full WE8S image? The reason I ask is to make sure you have the modules in the image to support the operation.
Is Windows Embedded 8.1 industry an option?
www.annabooks.com / www.seanliming.com / Book Author - Pro Guide to WE8S, Pro Guide to WES 7, Pro Guide to POS for .NET

ISE 1.1.1 firewall rules distributed deployment

My question is in reference to the following link:
http://www.cisco.com/en/US/docs/security/ise/1.1.1/installation_guide/ise_app_e-ports.html
Basically I am struggling in some areas to work out my firewall rules for a distributed deployment. The referenced documentation is not entirely clear in my opinion. In some instances it is easy to work out what ports need to be opened eg Admin node TCP 22,80,443 for management from administrator hosts/ranges. In other instances it difficult to work out eg TCP 1521 Database listener and AQ is this for ISE nodes only or for access devices aswell
My question is whether there is a better document that details these requirements. What rules are meant to be ISE node - ISE node communications and which rules are for access device - ISE, or ISE - access device. One of the rules I am pretty confused about is the PSN CoA ports. SHould the rule be WLC - PSN on 1700 and 3799 or is it the otherway round or unidirectional?
I am pretty sure that the ports are meant to be ISE-ISE in most instances barring the PSN for Radius and CoA.

Try this for size.
In answer to the specific CoA question, I see no need for the WLC to send CoA to PSN, so just PSN to WLC as far as I can see.
You might be able to cut this list down, and you might have to add to it for any specific requirements.
From PSN to AD (potentially all AD nodes):
TCP 389, 3268, 445, 88, 464
UDP 389, 3268
From PSN to Monitoring nodes:
TCP 443
UDP 20514
PSN to Admin Nodes (2Way):
TCP 443, 1521
ICMP echo and reply (heartbeat)
WLC to PSN:
TCP 443, 8443, 80, 8080
UDP 1645, 1646, 1812, 1813, 1700, 3799, 161, 162, 9993, 67
PSN to other PSN’s (2 way)
UDP 30514, 45588, 45990
Endpoint (Laptop) to PSN (Guest laptops just need to get to external PSN’s, internal users just to internal PSN’s)
TCP 8443, 8905
UDP 8905
Admin/Sponsor to all ISE nodes:
TCP 22, 80, 443, 8080, 8443
UDP 161
PSN access to DNS servers:
TCP/UDP 53
PSN access to NTP servers:
UDP 123

[Solved] Windows Firewall rule that allows Windows Update

Can anyone kindly give me a Windows Firewall rule that allows Windows Update? Assume I'm running MMC's "Windows Firewall with Advanced Security" snap-in as Administrator. Note that a "solution" that takes down the outbound firewall is
not acceptable.
Thank You.
===== Solution =====
Suppose that, as the default, you've set the outbound firewall to block (see
To close the outbound firewall, below). In order for Windows Update to check whether an update is available and then to download the update files, you first need an outbound firewall
allow-rule that allows the Windows Update service to pass through the outbound firewall.
Prerequisite: Knowledge of the Microsoft Management Console (MMC) and its "Windows Firewall with Advanced Security" plug-in.
What you will do: You will use the "Windows Firewall with Advanced Security" MMC plug-in to create an outbound firewall rule that
allows '%SystemRoot%\System32\svchost.exe' (the generic service driver) to pass through the outbound firewall on behalf of 'wuauserv' (the name of the specific service that performs the update).
Warning: If you don't know what I'm writing about, get help.
Name: Allow Windows Update (...or any name you prefer - it doesn't matter)
Group:
Profile: Public
Enabled: Yes
Action: Allow
Program: %SystemRoot%\System32\svchost.exe
Local Address: Any
Remote Address: Any
Protocol: Any
Local Port: Any
Remote Port: Any
Allowed Computers: Any
Status: OK
Service: wuauserv
Rule Source: Local Setting
Interface Type: All interface types
Excepted Computers: None
Description:
To open the outbound firewall:
More accurate wording would be
Outbound connections are allowed unless explicitly blocked by a rule.
If you look at the standard rules you will find no block-rules. That means that nothing is blocked, everything is allowed, and the outbound firewall is wide open.
To close the outbound firewall:
More accurate wording would be
Outbound connections are blocked unless explicitly allowed by a rule.
If you look at the standard rules you will find only allow-rules that have been crafted to allow the vital Windows connections to pass through the outbound firewall. To an informed observer it's obvious that the firewall engineers crafted these
allow-rules so that users who closed the outbound firewall wouldn't have to write them. But the firewall engineers left out Windows Update.

Hi mark,
Thanks for sharing, it will help other users who have similar issue.
Regards

Server 2008 r2 setting up firewall rule that just doesn't work!

I have allocated static ip addresses to a group of PCs, then gone to Server 2008 r2 and gone to Windows firewall with advanced security and written a new custom rule. Am blocking internet explorer, have browsed to where it is lodged on PCs, added the ip
addresses for blocking, in fact followed a detailed set of instructions but it just doesn't work! I am at a loss as to why, can anyone help please, driving me mad now! Thanks.

Are you applying ADV firewall rules through GPO. If not then you need to create block rules on the clients i think. but I would create a block rule in GPO and link to these PC's OU.

WSUS Firewall rules do not use names nor groupnames

Hi everyone,
Today I've been playing around with PowerShell Workflows and the firewall cmdlets on my test environment. (Great stuff, Thanks
Scripting Guys)
After working out a little workflow I noticed that the firewall rules that were made by the WSUS feature installation had no Name nor DisplayGroup, only the DisplayName.
My test environment is made up from tree Server 2012 R2 servers with a domain.
The script I made :
workflow Get-AllFirewalls
Parallel{
InlineScript{
Get-NetFirewallRule -Enabled True -Action Allow |?{
$_.Profile -match "Any|Domain"
} | select Name,DisplayName,direction,DisplayGroup,
@{n='Port';e={($_|Get-NetFirewallPortFilter).LocalPort}},
@{n='Protocol';e={($_|Get-NetFirewallPortFilter).Protocol}},
@{n='Program';e={($_|Get-NetFirewallApplicationFilter).Program}}
$output = Get-AllFirewalls -PSComputerName (Get-ADComputer -Filter 'OperatingSystem -like "Windows Server*"').name
$output |Sort-Object DisplayGroup |Format-Table PSComputerName,Name,DisplayName,Direction,Port,Protocol,Program -GroupBy DisplayGroup -AutoSize
Now this is just for testing and I could get around the fact there are no proper names but I think it's sloppy not to fill the naming attributes.
Am I the only one with these results or is it just WSUS?

There are only two rules created, one for HTTP on port 8530 one for HTTPS on port 8531, and the latter isn't even used in most WSUS installations.
There is no Group Name, because this is not a GROUP of rules, it is two individual rules. One is always enabled; the second is optionally enabled WHEN the WSUS Server is configured to use SSL, and it's enabled by an administrative script provided in the
WSUS toolset.
Ergo, a server administrator never has to mess with these two rules at all, so, no, I think it's insignificant that these rules may be missing a couple of generally irrelevant attributes.
Lawrence Garvin, M.S., MCSA, MCITP:EA, MCDBA
SolarWinds Head Geek
Microsoft MVP - Software Packaging, Deployment & Servicing (2005-2014)
My MVP Profile: http://mvp.microsoft.com/en-us/mvp/Lawrence%20R%20Garvin-32101
http://www.solarwinds.com/gotmicrosoft
The views expressed on this post are mine and do not necessarily reflect the views of SolarWinds.

What Specific Firewall Rules are Needed for the DPM Server?

Hello,
We want to confirm which firewall ports need to be opened on the DPM server (not protected servers) for all DPM processes, so that we can set these rules in group policy. Below are what we
think are the needed rules. Note that we have rules for both new DPM 2012 installs and upgrades from DPM 2010 to 2012, since these use different program paths.
Rule Name
Program Path
Protocol
Local Port
DPM 2012 DCOM Port
Any
TCP
135
DPM 2012 AM Port
Any
TCP
6075
DPM 2012 RTM Agent Coordinator
C:\Windows\Microsoft Data Protection Manager\DPM\ProtectionAgents\AC\4.0.1908.0\dpmac.exe
Any
Any
DPM 2012 SP1 Agent Coordinator
C:\Windows\Microsoft Data Protection Manager\DPM\ProtectionAgents\AC\4.1.3313.0\dpmac.exe
Any
Any
DPM 2012 R2 Agent Coordinator
C:\Windows\Microsoft Data Protection Manager\DPM\ProtectionAgents\AC\4.2.1205.0\dpmac.exe
Any
Any
DPM 2012 AM Service Host (New Install
%ProgramFiles%\Microsoft System Center 2012\DPM\DPM\bin\AMSvcHost.exe
Any
Any
DPM 2012 AM Service Host (Upgrade Install)
%ProgramFiles%\Microsoft DPM\DPM\bin\AMSvcHost.exe
Any
Any
DPM 2012 DPM AM Service (New Install)
%ProgramFiles%\Microsoft System Center 2012\DPM\DPM\bin\DPMAMService.exe
Any
Any
DPM 2012 DPM AM Service (Upgrade Install)
%ProgramFiles%\Microsoft DPM\DPM\bin\DPMAMService.exe
Any
Any
DPM 2012 MSDPM (New Install)
%ProgramFiles%\Microsoft System Center 2012\DPM\DPM\bin\msdpm.exe
Any
Any
DPM 2012 MSDPM (Upgrade Install)
%ProgramFiles%\Microsoft DPM\DPM\bin\msdpm.exe
Any
Any
DPM 2012 DPMRA (New Install)
%ProgramFiles%\Microsoft System Center 2012\DPM\DPM\bin\DPMRA.exe
Any
Any
DPM 2012 DPMRA (Upgrade Install)
%ProgramFiles%\Microsoft DPM\DPM\bin\DPMRA.exe
Any
Any
Questions:
Are any of these rules not needed?
We know the Agent Coordinator rules are needed on protected servers. Are they also needed on the DPM server (including if we use secondary DPM servers)?
The DPM Configuring Firewalls TechNet page says DCOM uses TCP 135 and the RPC Dynamic ports. Does that mean we also need a rule that opens all TCP RPC Dynamic ports for
any program? Or is this not necessary since we have rules for msdpm.exe and dpmra.exe? Reference:
http://technet.microsoft.com/en-us/library/hh757794
What other rules may be missing, if any?
Note that we do not include rules for ports 53 (DNS), 88 (Kerberos), 389 (LDAP), 137-139 & 445 (NetBIOS) because we already open these ports in other group policy objects.
Also, the below forums post says two exceptions for SQL Server are needed on the DPM server to allow the Remote Administrator console to work. Is there any documentation in the DPM TechNet site on these rules?
http://social.technet.microsoft.com/Forums/en-US/aa88fd00-6836-46d3-8a93-edb487109118/dpm-2012-remote-administration?forum=dataprotectionmanager
Thanks,
-Taylorbox

Does anyone have any comments on this post? We would especially appreciate some input from Microsoft reps to help us ensure we're setting up the correct firewall rules.
Thanks,
-Taylorbox

Ensure that the firewall rules are activated every time you restart

I'm trying to set up a server and the Getting Started guide recommends doing this but it doesn't have Arch-specific instructions. How do I go about doing this?
The Debian/Ubuntu way which seems simple to me is :
sudo nano /etc/network/if-pre-up.d/firewall
and then copy this into the file :
#!/bin/sh
/sbin/iptables-restore < /etc/iptables.firewall.rules
And then making it executable for the current user/group.
Will this work on Arch? I'm just trying to be cautious.
What's the Arch way for re-instating rules upon a complete reboot of the system?

Well, there's iptables-save and there's
$ cat /usr/lib/systemd/system/iptables.service [~]
[Unit]
Description=Packet Filtering Framework
[Service]
Type=oneshot
ExecStart=/usr/bin/iptables-restore /etc/iptables/iptables.rules
ExecReload=/usr/bin/iptables-restore /etc/iptables/iptables.rules
ExecStop=/usr/lib/systemd/scripts/iptables-flush
RemainAfterExit=yes
[Install]
WantedBy=multi-user.target
Last edited by lucke (2015-01-20 21:42:59)

ASDM Firewall Rules getting unchecked

Has anyone seen where ASDM will uncheck firewall rules?
I am using ASDM 7.1(1)52 on an ASA5520 running 8.2(2)17
but I have seen this behaviour on earlier versions of code.

Hi,
The only thing that would be common and expected behavior would be the access-group command getting deleted which would uncheck all the access rules on the ASDM.
Thanks and Regards,
Vibhor Amrodia

How to reload firewall rules from command line on firewall ?

Hi all,
I am trying to create script that controls firewall on server. OS version is OS X Server 10.5.6.
Part of firewall rules is created using firewall admin tools, part of Server Admin Tools. My first question is where are those rules stored permanently ? As far as I understood it should be set of ipfw rules but they are not stored in /etc/ipfilter/ipfw.conf.
Idea of script is this:
I have set of rules that should be controlled by Server Admin Tools.
Also, I have some dynamic rules.
Whenever some change occurs, I created script that does following:
/sbin/ipfw -f flush - to flush all existing rules
/sbin/serveradmin stop ipfilter - to stop existing firewall
/sbin/serveradmin start ipfilter - to restart firewall and reload permanent rules
Add my set of rules...
After flushing all rules and issuing stop and start ipfilter none of rules set through Server Admin Tools are not reloaded. So how should I reload them ? How to save them permanently in the first place ?
Please note that I do not have access to server (for security reasons). I am developing script on my Mac, sending to client and he tests it. So I cannot do a lot of testing.
Thank you in advance.
Best regards,
Dusan

Unix and Terminal queries are best posted to the Unix forum under OS X Technologies where those mavens frolic.

Is it possible to filter the data in a rule group ?

Hi !
I'm using 3 rule groups in a sales transformation to differentiate commands, bills, and deliveries.
I would like to know if it is possible to filter for each rule group the data by BWVORG for example ?
Thx in advance .
Guillaume

As per my understanding filter at rule group is not possible.
You can use the same at the start routine.

Error while creating a Rule Group

Hi All,
We are upgrading from 11.5.8 to 11.5.10.
We had some customizations in 11.5.8 which we have to do in 11.5.10 as well.
In 11.5.8, we had a custom form, which was used to add lines to already existing contracts.
We were using Okc_Rule_Pub.create_rule_group to create rule group..
We are facing a problem in 11.5.10 when using the same code to add lines in contracts of category "Service Agreement".
The api Okc_Rule_Pub.create_rule_group is erroring out with message
"Rule Groups/Rules are not allowed for this contract category."
Any help in this regard is highly appreciated.
Regards,
Anas.

Hi Anas,
I have a similar problem with a package in which we create new contracts. It's working fine in 11.5.9, but after upgrading to 11.5.10 it does not;
My error is : Rule &VALUE is not allowed for this contract category.
Could be the same problem as yours..
How did you solve it ??
Thanks in advance for your answer.
Regards, Bert

Can't add a new Firewall Rule

I have a very curious issue: I cannot add any new firewall rules at all! Clicking on the New Button does nothing and on the console I get
System Preferences[487] * -[NSCFString objectForKey:]: selector not recognized [self = 0x3f11b0]
I have flushed the firewall with ipfw, deleted the plist file, repaired permissions but the problem ist still there. Any suggestions? (apart from reinstallation)
Adding Firewall Rules through ipfw works...

Whenever I use ipfw I lose the ability to use System Preferences. At first I thought that it compared kernel memory with the plist file and if it found a difference, assumed another firewall was running and disabled itself. But I also deleted the plist file (assuming it would build one from kmem) but that didn't work. Right now I assume there's another file somewhere. It wouldn't make any sense to keep another table in kmem. The weird part is that rules can be the same, but different sequence numbers will cause this problem. There weren't sequence numbers in the plist file, so there's probably another file somewhere.
I think your error is from the missing plist file. A reboot should clear it up.

How to create rule groups strp by step-urgent

Hi All,
Can you please provide me the step by step procedure for creating rule groups.
I have four date fields ina DSO which have to be mapped to a date field in cube.\
Thanks in adavnce

Hi
Check this link with library with steps to create rule groups
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/60e63c88-960b-2a10-9fac-a409a24476c2

Rule group in sap bi

hai to all.
can any one give senario for creation of rule group in transformation.

Hi Ramesh,
Please check the below docs and help file on rule group in SAP BI
http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/d085fa63-f54c-2c10-b5ba-cc4ac231512b?QuickLink=index&overridelayout=true
http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/90754b76-bcf1-2a10-3ba7-b299b2be09f2?QuickLink=index&overridelayout=true
http://help.sap.com/saphelp_nw70/helpdata/en/44/32cfcc613a4965e10000000a11466f/content.htm
Hope it helps.
Regards,
Raghu

Firewall rules, groups - confusing!

Similar Messages

Maybe you are looking for