The default access rules on this box allow incoming IP from "any" to "any less-secure network". plus a global (outgoing?) "any to any", with no rule for the WAN connection. That's enough to let all my devices reach the outside world, and for more-secure networks to ping less-secure networks -- basic isolated router behavior.
Now I'm starting to try to control permissions between my networks, so development can access the production net but not vice versa. I'm willing to do it from the command line if I must, but I'd like to better understand how to manage it through ADSM. I don't currently have any Security Groups set up.
1) There doesn't seem to be a way to specify "any less-secure network" or multiple networks when entering our own rules in ADSM. And we can't simply modify the default rules which use that shortcut. It looks like we can have single rules that cover multiple sources. True? (I'm a bit surprised that this was implemented as "any to any-less-secure" rather than "any-more-secure to any"... or "to here".)
Those work for outgoing to the WAN, and allow ping among my LANs, but not SSH. My uneducated guess was that this meant I needed to add TCP and UDP to the protocols permitted by the rules, with the hope that these implied the protocols based upon them so I didn't need to spell everything out before I wanted that finer control. Unfortunately the default rules vanish when I try to add explicit rules, so I'd need to re-specify what the defaults have been providing.
2) There's a protocol listing for "tcp-udp", whose icon suggests that it's supposed to mean "either". When I tried using it in a rule, though, I got the error
--------------------------------
[OK] object-group protocol DM_INLINE_PROTOCOL_1
object-group protocol DM_INLINE_PROTOCOL_1
[ERROR] protocol-object tcp-udp
protocol-object tcp-udp
^
ERROR: % Invalid input detected at '^' marker.
[OK] object-group protocol DM_INLINE_PROTOCOL_2
object-group protocol DM_INLINE_PROTOCOL_2
[ERROR] protocol-object tcp-udp
protocol-object tcp-udp
^
ERROR: % Invalid input detected at '^' marker.
[OK] object-group protocol DM_INLINE_PROTOCOL_3
object-group protocol DM_INLINE_PROTOCOL_3
[ERROR] protocol-object tcp-udp
protocol-object tcp-udp
^
ERROR: % Invalid input detected at '^' marker.
[OK] object-group protocol DM_INLINE_PROTOCOL_1
object-group protocol DM_INLINE_PROTOCOL_1
[OK] no protocol-object tcp
[OK] no protocol-object udp
--------------------------------
So I went back to "ip, tcp, udp", and that seemed to be accepted.
3) But when I apply that approach -- incoming rules set to allow ip,tcp,udp from nets I consider more secure -- I lose connectivity rather than improving it. Applying that to "inside" (the lan port this machine is connected to) results in my losing web connectivity, presumably plus other things. I've backed it out so I can post this request for help...
I'm presumably misunderstanding something obvious. Could someone hit me with a clue-by-four, please?
adTHANKS!vance
(PS: Just for clarification, what's the difference between specifying "inside-network/24" versus "inside"? Is the former strictly an address test while the latter tests the network port the packet is being routed from/to? If so, "inside" would appear more secure, since theoretically a machine could be plugged into one of the other ports but be configured with an address in Inside-network's expected range...? Or is that misunderstanding the reason my attempted configuration failed?)
