Advertisement
Guest User

Untitled

a guest
Apr 10th, 2012
101
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 1.39 KB | None | 0 0
  1. There is a bug in the firewall of the DSM when using multiple ports at the same time (LAN1 and LAN2).
  2.  
  3. Instead of using a different CHAIN for the 2 network ports they both share the INPUT chain, which means you cannot allow a certain port on the IP of LAN1 but block it on LAN2 (different IP).
  4.  
  5. On top of that, if you set the firewall to "If no rules are matched Deny Access" on LAN1 the "DROP ALL -- rule is INSERTED before the rules from LAN2, resulting in all the rules for LAN2 beeing useless since traffic is already dropped before they reach them.
  6.  
  7. I suggest this is solved by giving LAN1 and LAN2 their own chain, that way you can set specific ports for specific ip's (if you have different ips for lan1 and land2) and also it would be possible to properly use the drop all.
  8.  
  9. Clarification, i want all my web/public services running on a external IP on LAN1 thus blocking SSH etc etc on that port, and on LAN2 is a different external IP used for backend services like SSH etc.
  10.  
  11. Above creates a security risk since if you want the rules for LAN2 to be properly working you will have to set the LAN1 to "allow everything if no rules match" which will again be inserted before the rules from LAN2, basicly setting the whole system wide open.
  12.  
  13. For now im using a BOND on LAN1&2 but this is just a temp solution to minimise the security risk.
  14.  
  15. Please have this fixed as soon as possible.
  16.  
  17. Thank you
  18.  
  19. Regards,
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement