Skip to main content

The Firewall Page

The Firewall page lists all of the private rules and public rules you have created, depending on whether you have the Private Network or Public Network tab selected. Each rule in the list includes the following attributes:

  • Name

  • Direction (inbound or outbound)

  • Source addresses from where inbound traffic is allowed (or denied)

  • Destination addresses to which outbound traffic is allowed (or denied)

  • Port numbers or ranges (For example, port 443 provides access for a user to log in to the deployment’s Management Portal.)

  • Protocol (TCP, UDP, or Ping)

  • Application (SSL, Ping, HL7, etc. Filtering by application requires Advanced Security.)

  • Action (Allow or Deny. Deny requires Advanced Security.)

  • Status (Enabled or Disabled)

Note:

If you have a lot of firewall rules, you can sort them by any column in the table or use the search box to narrow down the list of rules. The search term you enter can match the content of any column in the table (except Direction or Application).

Firewall Rule Basics

Working with firewall rules consists of three basic steps:

  1. Create, update, or delete one or more firewall rules.

    The rules now show status indicators for Pending Creation, Pending Update, or Pending Deletion.

  2. Save your changes.

    The rules now show status indicators for Needs Deployment.

  3. Deploy your saved changes.

    All saved changes are now deployed.

This allows you to stage a number of changes and deploy them at a later date or time. This deploys changes to both private and public network rules.

Note:

If you have any old firewall rules from earlier versions of your InterSystems cloud service, they are automatically migrated when you launch the Firewall page. If this process does not occur automatically, click Force Migrate.

Advanced Security

The Advanced Security option provides additional capabilities beyond the default firewall functionality, such as the ability for a rule to:

  • Use fully qualified domain names, in addition to IP addresses.

  • Deny traffic (instead of allowing traffic).

  • Filter traffic by application type (SSL, Ping, HL7, GitHub, NTP, DNS, SMTP, FTP, MS-DS-SMB, MSSQL-DB, Oracle, SSH, Wasabi, web browsing, or Any).

The Advanced Security option also removes the limitations on the number of firewall rules that can be created. The theoretical maximum number of firewall rules without the Advanced Security option is 1,000 inbound and 1,000 outbound.

Note:

Before turning on the Advanced Security option, you must create a InterSystems Network ConnectOpens in a new tab deployment and then attach this deployment to Network Connect.

The Advanced Security option requires additional infrastructure to be deployed manually. Contact InterSystems for information on how to enable this feature. (See Getting HelpOpens in a new tab.)

Manage Private Firewall Rules

Before creating a private firewall rule, you must create a InterSystems Network ConnectOpens in a new tab deployment to create a VPN hub and then connect a VPN gateway device (or private circuit or peer network) and this deployment to Network Connect.

To add a private firewall rule to your deployment:

  1. On the Firewall page, select the Private Network tab, and click Create.

  2. In the Create Firewall Rule dialog box:

    1. In the Rule Name box, type a name to identify the rule.

      This name should be unique to avoid confusion.

    2. In the Direction drop-down list, select either Inbound or Outbound.

    3. For Inbound rules, in the Source Address box, type a single CIDR block or a comma-separated list that defines the source addresses allowed using this rule. If you are using the Advanced Security feature, you can use domain names, in addition to CIDR blocks.

      In the Destination Address box, type a single CIDR block or a comma-separated list that defines the destination addresses allowed using this rule. Or, from the drop-down list, choose a suggested destination address, for example, the deployment’s virtual IP address.

    4. For Outbound rules, in the Source Address box, type a single CIDR block or a comma-separated list that defines the source addresses allowed using this rule. Or, from the drop-down list, choose a suggested source address, for example, the deployment’s NAT address or virtual IP address.

      In the Destination Address box, type a single CIDR block or a comma-separated list that defines the destination addresses allowed using this rule. If you are using the Advanced Security feature, you can use domain names, in addition to CIDR blocks.

    5. In the Port Range box, type the port number(s) or range(s) to use for this rule.

      Use a hyphen to specify a contiguous range of port numbers (for example, 1040-1050). Use commas to separate multiple non-contiguous port numbers (for example, 1040, 1050, 1060).

      For information on what ports you can use for your particular service, see Related Firewall Information.

      Leave this field blank if the Protocol is Ping.

    6. In the Protocol drop-down, select TCP, UDP, or Ping, depending the type of traffic to which this rule applies.

    7. In the Application drop-down, select the types of application to filter by.

      Leave as Any, or choose one or more of the following: SSL, Ping, HL7, GitHub, NTP, DNS, SMTP, FTP, MS-DS-SMB, MSSQL-DB, Oracle, SSH, Wasabi, or web browsing.

      Filtering by application requires the Advanced Security feature.

      Any means that this rule applies to any type of application.

    8. In the Action box, select whether this rule allows or denies traffic to or from the deployment.

      Deny rules require the Advanced Security feature.

    9. Check the Rule Enabled box to enable the rule when it is deployed.

      If you leave the box unchecked, you can enable the rule at a later time.

  3. Click Create.

    The firewall now appears in the list of rules as Pending Creation, however, it is not yet active.

  4. Click Save to save the rule.

    The firewall rule now appears in the list as Needs Deployment.

    This also saves any other rules marked as Pending Creation, Pending Update, or Pending Deletion.

  5. Click Deploy to deploy the rule.

    The firewall rule is now deployed.

    This also deploys any other rules marked as Needs Deployment.

Tip:

Your deployment comes with one outbound firewall rule by default, to allow all outbound traffic to all destinations within the private network. You can modify this rule as needed, for example, to be more restrictive or to allow traffic to destination on the internet.

To manage multiple rules, select the rules and then use the Enable, Disable, or Delete icons above the rules table to mark them to be enabled, disabled, or deleted.

To manage single rules, use the Edit, Enable/Disable, or Delete icons in the Actions column for that rule.

Then click Save to save the changes and then Deploy to deploy them.

Manage Public Firewall Rules

Before creating the first public firewall rule, you must enable Public Access:

  1. On the Firewall page, in the Global Network Settings section, slide the Enable External Connections slider to the right.

    You are redirected to the list of deployments while the deployment is updated. This may take a few minutes.

  2. When the status for your deployment changes from UPDATING back to COMPLETE, click the card and navigate back to the Firewall page.

To add a public firewall rule to your deployment:

  1. On the Firewall page, select the Public Network tab, and click Create.

  2. In the Create Firewall Rule dialog box:

    1. In the Rule Name box, type a name to identify the rule.

      This name should be unique to avoid confusion.

    2. In the Direction drop-down, select either Inbound or Outbound.

    3. For Inbound rules, in the Source Address box, type a single CIDR block or a comma-separated list that defines the source addresses allowed using this rule. If you are using the Advanced Security feature, you can use domain names, in addition to CIDR blocks.

      In the Destination Address box, type a single CIDR block or a comma-separated list that defines the destination addresses allowed using this rule. Or, from the drop-down list, choose a suggested destination address, for example, the deployment’s public IP address (or Message Bank, if using).

    4. For Outbound rules, in the Source Address box, type a single CIDR block or a comma-separated list that defines the source addresses allowed using this rule. Or, from the drop-down list, choose a suggested source address, for example, the deployment’s public IP address.

      In the Destination Address box, type a single CIDR block or a comma-separated list that defines the destination addresses allowed using this rule. If you are using the Advanced Security feature, you can use domain names, in addition to CIDR blocks.

    5. In the Port Range box, type the port number(s) or range(s) to use for this rule.

      Use a hyphen to specify a contiguous range of port numbers (for example, 1040-1050). Use commas to separate multiple non-contiguous port numbers (for example, 1040, 1050, 1060).

      For information on what ports you can use for your particular service, see Related Firewall Information.

      Leave this field blank if the Protocol is Ping.

    6. In the Protocol drop-down, select TCP, UDP, or Ping, depending the type of traffic to which this rule applies.

    7. In the Application drop-down, select the types of application to filter by.

      Leave as Any, or choose one or more of the following: SSL, Ping, HL7, GitHub, NTP, DNS, SMTP, FTP, MS-DS-SMB, MSSQL-DB, Oracle, SSH, Wasabi, or web browsing.

      Filtering by application requires the Advanced Security feature.

      Any means that this rule applies to any type of application.

    8. In the Action box, select whether this rule allows or denies traffic to or from the deployment.

      Deny rules require the Advanced Security feature.

    9. Check the Rule Enabled box to enable the rule when it is deployed.

      If you leave the box unchecked, you can enable the rule at a later time.

  3. Click Create.

    The firewall rule now appears in the list of rules as Pending Creation, however, it is not yet active.

  4. Click Save to save the rule.

    The firewall rule now appears in the list as Needs Deployment.

    This also saves any other rules marked as Pending Creation, Pending Update, or Pending Deletion.

  5. Click Deploy to deploy the rule.

    The firewall rule is now deployed.

    This also deploys any other rules marked as Needs Deployment.

Tip:

To quickly add a rule to allow access from your current public IP address to the Management Portal, click My IP. This creates an inbound public firewall rule to open port 443 to your public IP address.

To manage multiple rules, select the rules and then use the Enable, Disable, or Delete icons above the rules table to mark them to be enabled, disabled, or deleted.

To manage single rules, use the Edit, Enable/Disable, or Delete icons in the Actions column for that rule.

Then click Save to save the changes and then Deploy to deploy them.

If you are no longer using any public firewall rules, slide the Public Access slider to the left to disable all external connections to the deployment. Any existing public rules are hidden on the Firewall page, but they are not deleted and will be displayed again if you re-enable public access.

Important:

If you re-enable public access later, your deployment will receive a new public IP address, and you will need to update any existing firewall rules with the new address. Additionally, connectivity to the deployment can be affected for up to an hour, while the deployment’s DNS changes take effect.

FeedbackOpens in a new tab