🚀 go-pugleaf

You have to write deny rules which prohibit those WAN IP addresses from
reaching any of the things that are EXPLICITLY CONFIGURED TO BE ALLOWED
IN.  You have to write a specific rule for each server, because the rule
hierarchy, like you said, sometimes works against you.

The example I give below only applies to things on the LAN.  You would
probably want to write rules locking them out of DMZ servers too.

By default, it blocks all incoming packets to the LAN.  You can
configure exceptions.

Go to ACCESS>Rules.  Examine each rule that allows traffic in for a
server on the LAN: look for other things that look like LAN server
configurations:

  Example shows a typical NAT-enabled example:

rule 1:  allow ping       from <* or WAN> to 192.168.2.1 (LAN)

rule 2:  allow SMTP       from <* or WAN> to 192.168.2.3 (LAN)

rule 3:  allow POP3       from <* or WAN> to 192.168.2.3 (LAN)

rule 4:  allow HTTP       from <* or WAN> to 192.168.2.2 (LAN)

rule 5:  allow PCAnywhere from <* or WAN> to 192.168.2.200 (LAN)

The rules to block certain IP ranges from these servers would look like
this:

   Example shows how to block access to your servers from IP addresses
in the 209.8.7.0 /24 (255.255.255.0) network:

rule 1:  deny ping       from 209.8.7.1-254 <WAN> to 192.168.2.1 (LAN)

rule 2:  deny SMTP       from 209.8.7.1-254 <WAN> to 192.168.2.3 (LAN)

rule 3:  deny POP3       from 209.8.7.1-254 <WAN> to 192.168.2.3 (LAN)

rule 4:  deny HTTP       from 209.8.7.1-254 <WAN> to 192.168.2.2 (LAN)

rule 5:  deny PCAnywhere from 209.8.7.1-254 <WAN> to 192.168.2.200 (LAN)


Analysis:

SonicWall rules are sorted by hierarchy:  general rules on the bottom
and exceptions to those rules on the top.  The deny rules above are
exceptions to the general rules allowing access to servers.  All of the
5 deny rules in the example would appear above all of those 5 allow
rules, when viewed on the ACCESS>Rules screen.

Why doesn't it work if you write a rule that says:

   rule x:  deny default   from 209.8.7.1-254 <WAN> to LAN    ?

Because the rule hierarchy scheme is based on three different criteria:

  range of IP addresses specifed on either source or destinaton side

  range of services or port number ranges referenced in the rule.

Look at the example allow rules again.

This deny default rule wouldn't be honored because the allow rules are
seen as 'exceptions' granted for specific protocols (HTTP, SMTP, POP3,
ping, and PCAnywhere) to be accessible on the LAN for everybody on the
WAN.

Finally, the bottom rule should never be erased.  Make sure you see it
down there:

     deny default from * to LAN

This rule is the heart of the SonicWall's protection against port scans,
etc.  FYI:  The 'Default service' means all TCP, UDP and ICMP traffic.


Sent via Deja.com http://www.deja.com/
Before you buy.