ICMP Echo - Enable ONLY For a Subset

[JBHorner]

Greetings. I am in the midst of evaluating Untangle NGFW. This will be my second round of this. (A prior client considered it a non-starter for their home-based employees due to the lack of MDNS.) I have a very specific set of requirements against which I am evaluating this solution. They're pretty standard.

Putting the unnecessary complexity aside (on a personal level, I think that having to go to multiple places for simple routing rules is nuts), I came across a very interesting problem that I am convinced must be my lack of in-depth knowledge of this solution. It's such a simple requirement, my initial thought when I read it was, "of course it can do this."

The client wants to exclude the majority of active hosts from having an ability to ping. What I did to solve this seemed pretty straight-forward until I read more about Untangle. I can easily build this rule by using /config/network/advanced/access rules and then "allowing" only clients with a specific tag to access ICMP. This works. But I read that access rules should only be used as a last resort. This makes sense to me.

So, I removed that rule, disabled the ICMP allow rule in access rules, and then added an equivalent to config/network/filter rules. This does not work. When enabled, ICMP is not allowed. I left that rule there and then added an equivalent rule to apps/firewall/rules. This also did not work.

What am I missing here?

Thanks in advance!

[jcoffin]

Access rules are to the NGFW itself. You want to use Filter rules for Layer 3 blocking through the NGFW.

[JBHorner]

Access rules are to the NGFW itself. You want to use Filter rules for Layer 3 blocking through the NGFW.

Hi, thank you for the reply. I tried it there and found that it wasn't working there. It turns out that I'd erroneously concluded that a specific piece of functionality works, only to find it does not. I'm specifically talking about client tagging. In the example I gave above, I was using a client tag to refer to a list of allowed computers to ping. It turns out that tags are not reliable in the filter rules section. (Despite their availability as a criterion.) As soon as I removed that and instead added one of the clients' MAC address, the rule worked. With that said, adding 10 allow rules for ten computers just isn't going to happen; client tags was the only workable solution--and it doesn't work. (Not consistently anyway.)

[jcoffin]

That is correct. Tagging is a Layer 7 function of networking (aka user space), Filter Rules work at Layer 3 (kernel space) which does not have user-defined marks so it fails to match. Unfortunately your use case is a mix of Layer 3 (ping/ICMP) and Layer 7 (traffic tagging) so this is not possible.

https://en.wikipedia.org/wiki/OSI_model

[romiana]

It's possible that the reason your rule is not working is that the ICMP traffic is being blocked by another rule before it reaches your rule in the filter rules or firewall rules.

In Untangle NGFW, the filter rules are evaluated before the firewall rules, and both are evaluated before the access rules. Therefore, if there is a filter rule or firewall rule that is blocking the ICMP traffic before it reaches your rule, your rule will not have any effect.

To troubleshoot this issue, you can try moving your ICMP rule to the top of the filter rules or firewall rules list, and see if that allows the traffic to pass through. Alternatively, you can check the logs to see if there are any other rules that are blocking the traffic.

It's also worth noting that while access rules should be used sparingly, they are not necessarily a last resort. Access rules are specifically designed to control access to specific protocols, services, or applications, and can be a more efficient and targeted way to control access than filter rules or firewall rules. However, it's always a good idea to use the right tool for the job, food and to keep your rule set as simple and organized as possible.