Configure packet filtering

Required configuration items

Additional configuration requirements

To configure a packet filtering rule:

 



  1. Log into Digi Remote Manager, or log into the local Web UI as a user with full Admin access rights.
  2. Access the device configuration:

    1. Locate your device as described in Use Digi Remote Manager to view and manage your device.
    2. Click the Device ID.
    3. Click Settings.
    4. Click to expand Config.

    1. On the menu, click System. Under Configuration, click Device Configuration.

      The Configuration window is displayed.

  3. Click Firewall > Packet filtering.
    • To create a new packet filtering rule, for Add packet filter, click .

    • To edit the default packet filtering rule or another existing packet filtering rule, click to expand the rule.

    The packet filtering rule configuration window is displayed.

    Packet filters are enabled by default. To disable, toggle off Enable.

  4. (Optional) Type a Label that will be used to identify the rule.
  5. For Action, select one of:
    • Accept: Allows matching network connections.

    • Reject: Blocks matching network connections, and sends an ICMP error if appropriate.

    • Drop: Blocks matching network connections, and does not send a reply.

  6. Select the IP version.
  7. Select the Protocol.
  8. For Source zone, select the firewall zone that will be monitored by this rule for incoming connections from network interfaces that are a member of this zone.

    See Firewall configuration for more information about firewall zones.

  9. For Destination zone, select the firewall zone. Packets destined for network interfaces that are members of this zone will either be accepted, rejected or dropped by this rule.

    See Firewall configuration for more information about firewall zones.

  10. Click Apply to save the configuration and apply the change.
  1. Select the device in Remote Manager and click Actions > Open Console, or log into the Connect EZ local command line as a user with full Admin access rights.

    Depending on your device configuration, you may be presented with an Access selection menu. Type admin to access the Admin CLI.

  2. At the command line, type config to enter configuration mode:

    > config
(config)>

    1. Determine the index number of the appropriate packet filtering rule:
      (config)> show firewall filter
0
    action accept
    dst_zone any
    enable true
    ip_version any
    label Allow all outgoing traffic
    protocol any
    src_zone internal
1
    action drop
    dst_zone internal
    enable true
    ip_version any
    label myfilter
    protocol any
    src_zone external
(config)>
    2. Select the appropriate rule by using its index number:
      (config)> firewall filter 1
(config firewall filter 1)> 
    (config)> add firewall filter end
(config firewall filter 1)>

    Packet filtering rules are enabled by default. To disable the rule:

    (config firewall filter 1)> enable false
(config firewall filter 1)>

  3. (Optional) Set the label for the rule.
    (config firewall filter 1)> label "My filter rule"
(config firewall filter 1)>
  4. Set the action to be performed by the filter rule. 
    (config firewall filter 1)> action value
(config firewall filter 1)>

    where value is one of:

    • accept: Allows matching network connections.
    • reject: Blocks matching network connections, and sends an ICMP error if appropriate.
    • drop: Blocks matching network connections, and does not send a reply.

  5. Set the firewall zone that will be monitored by this rule for incoming connections from network interfaces that are a member of this zone:

    See Firewall configuration for more information about firewall zones.

    (config firewall filter 1)> src_zone my_zone
(config firewall filter 1)>
  6. Set the destination firewall zone. Packets destined for network interfaces that are members of this zone will either be accepted, rejected or dropped by this rule.

    See Firewall configuration for more information about firewall zones.

    (config firewall filter 1)> dst_zone my_zone
(config firewall filter 1)>
  7. Set the IP version. 
    (config firewall filter 1)> ip_version value
(config firewall filter 1)>

    where value is one of:

    • any
    • ipv4
    • ipv6
    • The default is any.
  8. Set the protocol. 
    (config firewall filter 1)> protocol value
(config firewall filter 1)>

    where value is one of:

    • any
    • icmp
    • icmpv6
    • tcp
    • upd

    The default is any.

  9. Save the configuration and apply the change.
    (config)> save
Configuration saved.
>
  10. Type exit to exit the Admin CLI.

    Depending on your device configuration, you may be presented with an Access selection menu. Type quit to disconnect from the device.