Cloud Firewall

• Filtering of source and destination IP address, IP protocol, source and destination port for TCP and UDP traffic
• Ability to limit simultaneous connections through custom rules
• Ability to log traffic that matches each rule
• Ability to create IP groups to simplify configuration and maintenance tasks
• Transparent Layer 2 filtering. Ability to bridge interfaces and filter traffic between them.
• Router mode: ability to disable filtering and function solely as a router

The firewall's status table maintains information about open connections.

The size of the table varies depending on the amount of RAM installed, but it can be increased in real time. Each entry occupies approximately 1KB of RAM.

Basic rules

• Limits on simultaneous connections
• State limits per host
• Connection limits per second
• State timeout definition
• Definition of state type

Types of status

• The Keep firewall will create and maintain an entry in the state table for allowed traffic. This is the default setting and the best in most situations.
• Sloppy: A less strict mode designed for asymmetric routing scenarios. There are mechanisms to prevent certain attacks that will not function in this state.
• Synproxy firewall intercepts the negotiation phase when a TCP connection is initiated. It helps prevent SYN flood attacks.
• None The firewall will not maintain the information in the status table.

• Port forwarding
• NAT 1:1 for individual IP addresses or entire subnets
• NAT SALIENTE
  • Automatic NAT is performed automatically from internal interfaces such as LAN to external interfaces such as WAN.
  • Hybrid allows you to add manual rules while also using automatic rules for traffic not covered by manual rules.
  • Manual : Only manually added rules are used. This offers the highest degree of control, at the cost of being more difficult to manage. Any changes to the interfaces used must be taken into account and updated accordingly in the rules.
  • Disabled The firewall disables outbound NAT.

The CARP protocol manages hardware failures. Two or more firewalls can be configured in cluster mode so that if one fails and goes offline, another will take over. The cluster synchronizes the state tables to maintain connections in case of failure.

• CPU usage
• Firewall status
• Total traffic
• Individual traffic for each interface
• Ping response time

In addition to historical data, the firewall has a dashboard to monitor its status in real time.

Network-based intrusion detection system (IDSN).

It includes a rule-building language for defining the patterns used to monitor the system. It also offers a set of predefined rules and filters that can be adjusted during installation and configuration to best suit specific needs.

One of the advantages is that it can operate in sniffer mode (you can see via the console, in real time, what is happening with network traffic), packet logging (it saves the logs to files for later analysis) or normal IDS mode.