Management access

Protect the firewall itself

Lesson 10 of 20 · 11 min · Module 3: Zones and policies

The firewall has an administration page and an SSH service. Whoever can reach them is one password away from rewriting every rule in this course.

Start this lesson →

Free. No installation: you write and run the code in your browser, and it is checked automatically.

By the end, you’ll be able to…

Separate traffic to the firewall from traffic through it
Limit management to an administrator address
Keep management closed on the outside address

The idea

Traffic to the firewall is separate from traffic through it. The management services should accept connections from the administrator's machine only, never from the whole office, and never from the internet.

allow tcp from 10.0.5.7 to fw port 443
allow icmp from 10.0.5.0/24 to fw

01Find the management services

A firewall typically offers HTTPS (tcp 443) for its web interface and SSH (tcp 22) for the command line. In this lab fw is the firewall's inside address and fw-outside is its address on the internet.

02Allow the administrator, not the office

A rule from the whole trust zone to fw gives every desk the login page. Limit the source to the administrator's address. Ping (icmp) from the office to the firewall is harmless and useful for troubleshooting, so it can stay open on its own rule.

03Management access on real devices

Real firewalls handle traffic to themselves with separate settings, apart from the forwarding policy.

# FortiGate: restrict where an administrator may log in from
config system admin
    edit "admin"
        set trusthost1 10.0.1.50 255.255.255.255
    next
end

# Huawei USG: choose the services an interface answers
interface GigabitEthernet0/0/1
 service-manage ssh permit
 service-manage https permit

# nftables: the input chain is traffic to the firewall itself
nft add rule inet filter input ip saddr 10.0.1.50 tcp dport { 22, 443 } accept

Your turn

The current rule lets every device in the office open the firewall's administration page. Replace it: only admin may reach fw on tcp 22 and 443, and trust may ping (icmp) fw. Nothing from the internet may reach the management services.

What the checks look for

The administrator can manage the firewall
Other office devices cannot open the management services
The office can still ping the firewall
Nothing from the internet reaches management

Try it in the editor →

Take this with you

Treat access to the firewall as its own policy: administrators only, from known addresses, and never from the internet.

Go a little further

Remove the icmp rule and think about what the help desk loses when "can you ping the gateway?" no longer has an answer.