Basic config
-
Ok, thanks, I read about all incoming traffic being blocked by default. I do not want to control any outgoing connection, my aim is to create our own cloud. I will use a Synology NAS for the cloud service and as an LDAP server. So if my install is now ready for basic routing and firewalling then the next step would be to setup VPN services including all associated certificate stuff like a CA and certificates per user. I read that the certificates need to have the same CN as the LDAP user so I think I'm ok. Only need to find out how I can block users accessing any other devices than the NAS.
-
You would setup the rules you want to limit your vpn users to on the vpn tab.
-
Ok, thanks. I'll see how far I can manage on my own, it looks quite easy!
-
It comes ready for the web. Very secure.
But with a LITTLE knowledge, and a lot of work, you can make it unsecure… (-:
Be careful making pass rules and NAT rules.
-
Yeah. I understand what you mean. I think I have at lease basic understanding of NAT en firewalling. It's just that I had to do so little I started to question myself wether I did enough :P
-
I have found log entries that I can't really understand.
Act Time If Source Destination Proto block Dec 22 17:38:15 LAN [fe80::c553:f712:d08e:c24a]:52859 [fec0:0:0:ffff::2]:53 UDP block Dec 22 17:38:15 LAN [fe80::c553:f712:d08e:c24a]:52859 [fec0:0:0:ffff::3]:53 UDP block Dec 22 17:38:15 LAN [fe80::c553:f712:d08e:c24a]:55029 [fec0:0:0:ffff::1]:53 UDP block Dec 22 17:38:15 LAN [fe80::c553:f712:d08e:c24a]:50661 [fec0:0:0:ffff::2]:53 UDP block Dec 22 17:38:16 LAN [fe80::c553:f712:d08e:c24a]:55029 [fec0:0:0:ffff::3]:53 UDP block Dec 22 17:38:17 LAN [fe80::c553:f712:d08e:c24a]:55029 [fec0:0:0:ffff::2]:53 UDP block Dec 22 17:38:17 LAN [fe80::c553:f712:d08e:c24a]:50661 [fec0:0:0:ffff::1]:53 UDP block Dec 22 17:38:17 LAN [fe80::c553:f712:d08e:c24a]:50661 [fec0:0:0:ffff::2]:53 UDP block Dec 22 17:38:17 LAN [fe80::c553:f712:d08e:c24a]:50661 [fec0:0:0:ffff::3]:53 UDP block Dec 22 17:38:19 LAN [fe80::c553:f712:d08e:c24a]:60143 [fec0:0:0:ffff::1]:53 UDP block Dec 22 17:38:19 LAN [fe80::c553:f712:d08e:c24a]:60143 [fec0:0:0:ffff::2]:53 UDP block Dec 22 17:38:19 LAN [fe80::c553:f712:d08e:c24a]:60143 [fec0:0:0:ffff::3]:53 UDP block Dec 22 17:38:19 LAN [fe80::c553:f712:d08e:c24a]:52859 [fec0:0:0:ffff::1]:53 UDP block Dec 22 17:38:19 LAN [fe80::c553:f712:d08e:c24a]:52859 [fec0:0:0:ffff::2]:53 UDP block Dec 22 17:38:19 LAN [fe80::c553:f712:d08e:c24a]:52859 [fec0:0:0:ffff::3]:53 UDP block Dec 22 17:38:19 LAN [fe80::c553:f712:d08e:c24a]:55029 [fec0:0:0:ffff::1]:53 UDP block Dec 22 17:38:19 LAN [fe80::c553:f712:d08e:c24a]:55029 [fec0:0:0:ffff::2]:53 UDP block Dec 22 17:38:19 LAN [fe80::c553:f712:d08e:c24a]:55029 [fec0:0:0:ffff::3]:53 UDP block Dec 22 17:38:21 LAN [fe80::c553:f712:d08e:c24a]:50661 [fec0:0:0:ffff::1]:53 UDP block Dec 22 17:38:21 LAN [fe80::c553:f712:d08e:c24a]:50661 [fec0:0:0:ffff::2]:53 UDP block Dec 22 17:38:21 LAN [fe80::c553:f712:d08e:c24a]:50661 [fec0:0:0:ffff::3]:53 UDP block Dec 22 17:38:23 LAN [fe80::c553:f712:d08e:c24a]:53189 [fec0:0:0:ffff::2]:53 UDP block Dec 22 17:38:23 LAN [fe80::c553:f712:d08e:c24a]:49836 [fec0:0:0:ffff::2]:53 UDP block Dec 22 17:38:23 LAN [fe80::c553:f712:d08e:c24a]:55029 [fec0:0:0:ffff::1]:53 UDP block Dec 22 17:38:23 LAN [fe80::c553:f712:d08e:c24a]:55029 [fec0:0:0:ffff::2]:53 UDP block Dec 22 17:38:23 LAN [fe80::c553:f712:d08e:c24a]:55029 [fec0:0:0:ffff::3]:53 UDP block Dec 22 17:38:24 LAN [fe80::c553:f712:d08e:c24a]:53189 [fec0:0:0:ffff::1]:53 UDP block Dec 22 17:38:24 LAN [fe80::c553:f712:d08e:c24a]:49836 [fec0:0:0:ffff::1]:53 UDP block Dec 22 17:38:25 LAN [fe80::c553:f712:d08e:c24a]:53189 [fec0:0:0:ffff::3]:53 UDP block Dec 22 17:38:25 LAN [fe80::c553:f712:d08e:c24a]:49836 [fec0:0:0:ffff::3]:53 UDP block Dec 22 17:38:27 LAN [fe80::c553:f712:d08e:c24a]:53189 [fec0:0:0:ffff::1]:53 UDP block Dec 22 17:38:27 LAN [fe80::c553:f712:d08e:c24a]:53189 [fec0:0:0:ffff::2]:53 UDP block Dec 22 17:38:27 LAN [fe80::c553:f712:d08e:c24a]:53189 [fec0:0:0:ffff::3]:53 UDP block Dec 22 17:38:27 LAN [fe80::c553:f712:d08e:c24a]:49836 [fec0:0:0:ffff::1]:53 UDP block Dec 22 17:38:27 LAN [fe80::c553:f712:d08e:c24a]:49836 [fec0:0:0:ffff::2]:53 UDP block Dec 22 17:38:27 LAN [fe80::c553:f712:d08e:c24a]:49836 [fec0:0:0:ffff::3]:53 UDP block Dec 22 17:38:27 LAN [fe80::c553:f712:d08e:c24a]:59761 [fec0:0:0:ffff::2]:53 UDP block Dec 22 17:38:27 LAN [fe80::c553:f712:d08e:c24a]:55885 [fec0:0:0:ffff::2]:53 UDP block Dec 22 17:38:28 LAN [fe80::c553:f712:d08e:c24a]:59761 [fec0:0:0:ffff::1]:53 UDP block Dec 22 17:38:28 LAN [fe80::c553:f712:d08e:c24a]:55885 [fec0:0:0:ffff::1]:53 UDP block Dec 22 17:38:29 LAN [fe80::c553:f712:d08e:c24a]:59761 [fec0:0:0:ffff::3]:53 UDP block Dec 22 17:38:29 LAN [fe80::c553:f712:d08e:c24a]:55885 [fec0:0:0:ffff::3]:53 UDP
These all seem to be IPv6 adresses. My guess would be that this is a portscan of some sort. But then I don't understand why if says "LAN" instead of "WAN"?
-
I'm clueless about IPv6 addresses so I'm no help on them but port 53 and UDP sounds like an attempted DNS lookup to me.
-
That is a client using IPv6 looking hard for a DNS server:
A set of three well-known site-local IPv6 addresses are reserved
for autodiscovery of DNS servers. These addresses may be used as
unicast addresses, assigned to different servers, or as anycast
addresses with one of them being assigned to all DNS servers in
the site, or any combination of anycast and unicast addresses. In
any case, host routes are propagated in the site's routing tables.
This document proposes that these three addresses be
fec0:0:0:ffff::1, fec0:0:0:ffff::2, and fec0:0:0:ffff::3. This
list of three addresses may be hardcoded into a host.from: http://www.ietf.org/proceedings/52/I-D/draft-ietf-ipngwg-dns-discovery-03.txt
(and I suspect there are later versions of that draft standard) -
Learned something new today guys, awesome. Thanks. Kind of weird that it is being blocked; I have no rules prohibiting any traffic inside the lan. I do not want to put up any restrictions inside the network. Should I create a firewall rule that says allow LAN <-> LAN?
-
You might need to go to System->Advnced, Networking tab, and check "Allow IPv6". Otherwise there is a block all IPv6 rule put in by the firewall that is probably the reason for that blocking.
-
Gonna take a look at that when I'm at the location again, thanks. I think I might just disable ipv6 inside the network completely; I'm guessing it has no added value whatsoever but the adresses are harder to remember :D