Skip to content

Firewall

The Firewall tab of Security policy holds the device's packet filter rules. The portal turns them into an OpenBSD pf.conf.

The rules table

Rules are grouped into sections, in the order pf evaluates them:

Section What it holds
System baseline, IPv6, management — default deny, loopback, IPv6 neighbour discovery, stateful outbound, management access. Collapsed, and not editable.
Quick Rules common presets you switch on and off. See Quick rules.
One section per integration Rules an integration created, headed by the name you gave it, with its port and subnet.
Rules The rules you wrote. See Firewall rules.

In Simple view, integration sections are summarised into one line. Switch to Advanced to see and edit them.

Warnings on the page

  • passes everything — a tag on a rule that passes all inbound traffic from the internet, or on one port, so the default deny below it refuses nothing there. Hover it for the detail.
  • This device is missing {count} of the current system rules — the device is running an older set of system rules. Saving any change adds them. If one of them opens traffic the device refuses today, the banner says so, so you can apply it on purpose.

Next