Firewall and port forwarding
The FELIXXRT firewall is zone-based. Interfaces are placed in zones, and traffic handling is set per zone and per pair of zones.
Default settings
After the first setup the firewall looks like this:
| Zone | Input | Intra-zone forward | Masquerade |
|---|---|---|---|
| wan | Drop | Drop | Enabled |
| lan | Accept | Accept | Disabled |
The only inter-zone forwarding set to Accept is lan → wan. LAN devices can reach the internet; nothing from the internet can reach the router or the LAN (reply traffic is allowed).
Configure zones
Use Zones on SECURITY › Firewall.
- For each zone, choose Input and Intra-zone forward.
- When Input is not Accept, select the services to let through under Allowed services.
- Enable Masquerade on the internet-side zone.
Saved changes become pending changes. Click Review changes at the top of the screen, apply them, and click Confirm within 5 minutes (see Applying changes).
To add a zone, enter a Zone name (e.g. iot) and click + Add. A new zone starts with Input and Intra-zone forward set to Drop and Allowed services set to DHCP, DNS and Ping. Put interfaces into the new zone on NETWORK › Interfaces.
If you set Input to Drop or Reject on the zone you manage the router from (usually lan), select Web UI under Allowed services. Otherwise you lose access to the web UI as soon as the change is applied. If that happens, wait 5 minutes and the change is reverted.
| Field | Description |
|---|---|
| Input | Traffic from this zone to the router itself (web UI, DNS, etc.) |
| Intra-zone forward | Traffic between interfaces in the same zone |
| Allowed services | Services accepted even when Input is not Accept. Not selectable when Input is Accept |
| Masquerade | Rewrites the source of IPv4 traffic leaving to this zone to the router's address. Usually enabled on wan |
There are three actions:
| Action | Description |
|---|---|
| Accept | Let it through |
| Reject | Discard it and notify the sender |
| Drop | Discard it silently |
Services available under Allowed services:
| Service | Ports |
|---|---|
| DHCP | UDP 67 |
| DNS | TCP/UDP 53 |
| Ping | ICMP |
| NTP | UDP 123 |
| SSH | TCP 22 (CLI) |
| Web UI | TCP 443 and 80 (80 only redirects to https) |
The wan zone cannot be deleted. Zones used by an interface, a rule, a port forward or a VPN group cannot be deleted either.
Listen ports of enabled VPNs and queries from allowed monitoring servers are accepted regardless of the zone settings (see Remote access VPN and Monitoring).
Inter-zone forwarding
Inter-zone forwarding is a table with source zones as rows and destination zones as columns. Choose Accept, Reject or Drop in each cell. The default is Drop.
For example, to let a guest zone reach only the internet, set → wan in the guest row to Accept and leave → lan at Drop.
The diagonal cells (a zone to itself) show that zone's Intra-zone forward setting. Change it in the Zones table.
Rules
Use rules for finer control than the zone settings. Rules are evaluated top to bottom and the first match wins. They take precedence over the zone settings and inter-zone forwarding.
- Click + Add under Rules.
- Fill in the fields below and click Save.
- Change the order with ↑ and ↓. To pause a rule, click Disable.
| Field | Description |
|---|---|
| Name | Letters, digits and -, e.g. block-iot |
| Source zone | The zone the traffic comes from |
| Source address (optional) | IP addresses, networks or MAC addresses, separated by commas. Empty matches the whole zone |
| Destination | All forwarded traffic, This router, or a zone |
| Destination address (optional) | IP address or network. Empty matches any destination |
| Protocol | Any, TCP, UDP, TCP/UDP or ICMP (Ping, etc.) |
| Ports (optional) | Destination ports for TCP or UDP, e.g. 80,443,1000-2000 |
| Action | Accept, Reject or Drop |
Example: to keep the device 192.168.1.50 off the internet, set the source zone to lan, the source address to 192.168.1.50, the destination to the wan zone and the action to Drop.
Port forwarding
Port forwarding passes traffic arriving from the internet to a device on the LAN. Configure it on SECURITY › Port forwarding.
- Click + Add.
- Fill in the fields below and click Save.
The firewall permission for forwarded traffic is added automatically. You do not need an extra rule.
| Field | Description |
|---|---|
| Name | Letters, digits and -, e.g. ssh-nas |
| Protocol | TCP, UDP or TCP/UDP |
| External port | Port opened on the internet side. Ranges are allowed, e.g. 2222 or 8000-8010 |
| Internal IP address | The receiving device. Must be inside a LAN-side subnet. Use a DHCP static lease so it does not change |
| Internal port (optional) | Empty uses the same number as the external port. Not available when the external port is a range |
| Incoming zone | Shown only when there are two or more zones other than lan. Usually wan |
Two port forwards in the same zone cannot share external ports for the same protocol.
If the WAN uses MAP-E, keep the external port inside Available ports on NETWORK › WAN. Otherwise the change cannot be applied (see WAN (Internet connection)).
Connections
SECURITY › Connections lists the connections the router is currently tracking. Filter by IP address or port, and click Refresh to reload. When there are many, only the first ones are shown.
| Column | Description |
|---|---|
| Protocol | TCP, UDP, etc. |
| Source / Destination | Address and port |
| NAT | The translated address: the forward target for port forwarding, or the rewritten source for masquerade |
| State | TCP connection state, e.g. ESTABLISHED (active) or TIME_WAIT (closing) |
| Bytes | Bytes transferred on this connection |
Permissions
Zones, inter-zone forwarding and rules belong to the Firewall area, port forwards to Port forwarding, and the connections list to Status. The built-in Operator role can edit port forwards but can only view the firewall (see Admin users and roles).