Firewall Rules Module Documentation
Table of Contents
- Module Overview (Technical)
- Module Overview (Commercial/Business)
- Module Overview (End User/Administrator)
- Configuration Sections
- Settings Reference
- Common Scenarios & Examples
- Limitations & Important Notes
- Troubleshooting Tips
- Glossary
---
1. Module Overview (Technical)
What Are Firewall Rules?
Firewall Rules is a traffic control module that creates nftables rules for accepting, dropping, or rejecting network traffic. Rules reference Firewall Services and are evaluated in priority order.
Architecture
┌─────────────────────────────────────────────────────────────────┐
│ Firewall Rules Architecture │
├─────────────────────────────────────────────────────────────────┤
│ │
│ Rule Definitions │
│ ┌──────────────────────────────────────────────────────────┐ │
│ │ │ │
│ │ Priority: 10 Priority: 20 │ │
│ │ ┌────────────────────┐ ┌────────────────────┐ │ │
│ │ │ Allow Admin SSH │ │ Allow HTTP │ │ │
│ │ │ Action: Accept │ │ Action: Accept │ │ │
│ │ │ Direction: Input │ │ Direction: Input │ │ │
│ │ │ Service: SSH │ │ Service: HTTP │ │ │
│ │ │ Source: 10.0.0.5 │ │ Source: any │ │ │
│ │ └────────────────────┘ └────────────────────┘ │ │
│ │ │ │
│ │ Priority: 100 Priority: 200 │ │
│ │ ┌────────────────────┐ ┌────────────────────┐ │ │
│ │ │ Allow SIP LAN │ │ Block SSH External │ │ │
│ │ │ Action: Accept │ │ Action: Drop │ │ │
│ │ │ Direction: Input │ │ Direction: Input │ │ │
│ │ │ Service: SIP │ │ Service: SSH │ │ │
│ │ │ Source: 192.168.x │ │ Source: any │ │ │
│ │ └────────────────────┘ └────────────────────┘ │ │
│ │ │ │
│ └──────────────────────────────────────────────────────────┘ │
│ │ │
│ ▼ [Apply Rules] │
│ ┌──────────────────────────────────────────────────────────┐ │
│ │ nftables Configuration │ │
│ │ │ │
│ │ table inet filter { │ │
│ │ chain input { │ │
│ │ # Priority 10: Allow Admin SSH │ │
│ │ ip saddr 10.0.0.5 tcp dport 22 accept │ │
│ │ # Priority 20: Allow HTTP │ │
│ │ tcp dport 80 accept │ │
│ │ # Priority 100: Allow SIP LAN │ │
│ │ ip saddr 192.168.0.0/16 udp dport 5060 accept │ │
│ │ # Priority 200: Block SSH External │ │
│ │ tcp dport 22 drop │ │
│ │ } │ │
│ │ } │ │
│ │ │ │
│ └──────────────────────────────────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────┘
Key Tables
| Table | Purpose |
|---|
public.firewall_rules | Rule definitions |
Key Files
| File | Description |
|---|
modules/firewallRules/ | Frontend module | |
/etc/nftables.conf | Applied rules |
2. Module Overview (Commercial/Business)
Business Value
Firewall Rules provides network traffic control:
| Without Rules | With Rules |
|---|
| Open access | Controlled traffic | |
| No priority | Ordered evaluation | |
| Manual nftables | Web interface | |
| Complex syntax | Simple forms |
Use Cases
- Allow Services
- Web traffic (HTTP/HTTPS)
- SIP/RTP for telephony
- Block Attacks
- Drop external SSH
- Reject scanners
- LAN Access Only
- SIP from internal only
- Admin from VPN only
- Priority Control
- Allow before block
- Specific before general
Feature Highlights
| Feature | Benefit |
|---|
| Accept/Drop/Reject | Flexible actions | |
| Priority Order | Controlled evaluation | |
| Service Reference | Reusable definitions | |
| Source/Dest Filter | IP-based access | |
| Interface Binding | Per-interface rules | |
| Apply Button | Controlled deployment |
3. Module Overview (End User/Administrator)
What Can You Do?
- Create traffic rules
- Allow or block traffic
- Set priority order
- Filter by IP address
- Bind to interfaces
- Apply rules to nftables
- Enable/disable rules
Firewall Rules Interface
┌─────────────────────────────────────────────────────────────────┐
│ Firewall Rules │
├─────────────────────────────────────────────────────────────────┤
│ │
│ Manage firewall rules for nftables (Debian 13) │
│ │
│ [+ Add Rule] [Apply Rules] │
│ │
│ [🔍 Search rules...] │
│ │
│ ┌───────────────────────────────────────────────────────────┐ │
│ │ Name │ Action│ Direction│ Service│ Priority│ St │ │
│ ├───────────────┼───────┼──────────┼────────┼─────────┼────┤ │
│ │ Allow Admin │ Accept│ Input │ SSH │ 10 │ ● │ │
│ │ Allow HTTP │ Accept│ Input │ HTTP │ 20 │ ● │ │
│ │ Allow HTTPS │ Accept│ Input │ HTTPS │ 30 │ ● │ │
│ │ Allow SIP LAN │ Accept│ Input │ SIP │ 100 │ ● │ │
│ │ Allow RTP │ Accept│ Input │ RTP │ 110 │ ● │ │
│ │ Block SSH Ext │ Drop │ Input │ SSH │ 200 │ ● │ │
│ │ Block All │ Drop │ Input │ - │ 9999 │ ○ │ │
│ └───────────────────────────────────────────────────────────┘ │
│ │
│ ⚠️ Click "Apply Rules" after changes │
│ │
└─────────────────────────────────────────────────────────────────┘
Add/Edit Rule
┌─────────────────────────────────────────────────────────────────┐
│ Add Firewall Rule │
├─────────────────────────────────────────────────────────────────┤
│ │
│ Rule Name: [Allow SIP from LAN ] │
│ Descriptive name for the rule (must be unique) │
│ │
│ Action: [Accept ▼] │
│ Accept (allow) | Drop (silent block) | Reject (block+respond)│
│ │
│ Direction: [Input ▼] │
│ Input (to server) | Output (from server) | Forward (routed) │
│ │
│ Service: [SIP ▼] │
│ Associated firewall service (required) │
│ The rule will use the selected service's protocol and port │
│ │
│ Priority: [100 ] │
│ Rule priority (0-9999). Lower numbers are evaluated first │
│ │
│ ──────────────────────────────────────────────────────────────│
│ │
│ Source Address: [192.168.1.0/24 ] │
│ Optional: Source IP address or CIDR network │
│ │
│ Destination Address: [ ] │
│ Optional: Destination IP address or CIDR network │
│ │
│ Interface: [eth0 ] │
│ Optional: Network interface (e.g., eth0, ens33) │
│ │
│ ──────────────────────────────────────────────────────────────│
│ │
│ Enabled: ✓ │
│ Disabled rules will not be applied to nftables │
│ │
│ [Save] [Cancel] │
│ │
└─────────────────────────────────────────────────────────────────┘
Quick Tips
TIP
Priority: Lower numbers execute first. Allow admin access at low priority!
TIP
Apply Rules: Always click after making changes.
CAUTION
Don't Block Yourself: Create allow rule for your IP before blocking!
---
4. Configuration Sections
Rule Fields
| Field | Description |
|---|
| Rule Name | Unique identifier | |
| Action | Accept, Drop, Reject | |
| Direction | Input, Output, Forward | |
| Service | Service reference (required) | |
| Priority | Order (0-9999) | |
| Source Address | Source IP/CIDR (optional) | |
| Destination Address | Dest IP/CIDR (optional) | |
| Interface | Network interface (optional) | |
| Enabled | Active/Inactive |
5. Settings Reference
Actions
| Action | Behavior | Response | Use Case |
|---|
| Accept | Allow traffic | - | Permitted traffic | |
| Drop | Block silently | None | Stealth blocking | |
| Reject | Block with response | ICMP error | Inform sender |
Directions
| Direction | Description | Example |
|---|
| Input | Traffic TO server | Web requests | |
| Output | Traffic FROM server | API calls | |
| Forward | Routed traffic | NAT/routing |
Priority Guidelines
| Priority Range | Use |
|---|
| 1-50 | Critical allows (admin access) | |
| 51-100 | Standard allows (web, API) | |
| 101-200 | Service allows (SIP, RTP) | |
| 201-500 | Specific blocks | |
| 501-9999 | Broad blocks, catch-all |
Priority Examples
Priority 10: Allow Admin SSH (source: admin IP)
Priority 20: Allow HTTP (any source)
Priority 100: Allow SIP LAN (source: 192.168.x)
Priority 200: Block SSH External (any source)
Priority 9999: Block All (catch-all)
---
6. Common Scenarios & Examples
Scenario 1: Allow HTTP/HTTPS
- Add Rule
- Name = "Allow HTTP"
- Action = Accept
- Direction = Input
- Service = HTTP
- Priority = 20
- Save
- Repeat for HTTPS (Priority 30)
- Apply Rules
Scenario 2: Allow SIP from LAN Only
- Add Rule
- Name = "Allow SIP LAN"
- Action = Accept
- Direction = Input
- Service = SIP
- Priority = 100
- Source = 192.168.1.0/24
- Save
- Apply Rules
Scenario 3: Block External SSH
- First: Create "Allow Admin SSH" (Priority 10, Source: your IP)
- Add Rule
- Name = "Block SSH External"
- Action = Drop
- Direction = Input
- Service = SSH
- Priority = 200
- (No source = all sources)
- Save
- Apply Rules
Scenario 4: Complete PBX Ruleset
Priority 10: Allow Admin SSH (Source: admin IP)
Priority 20: Allow HTTP (Any - redirect to HTTPS)
Priority 30: Allow HTTPS (Any - includes WebRTC WSS proxy)
Priority 100: Allow SIP UDP (Source: LAN + Trunks)
Priority 110: Allow SIP TLS (Source: LAN + Trunks)
Priority 120: Allow RTP (Any)
Priority 130: Allow STUN (Any - NAT traversal)
Priority 131: Allow TURN TLS (Any - NAT traversal)
Priority 200: Block SSH External (Any)
Priority 300: Block SIP External (Any)
---
7. Limitations & Important Notes
Technical Notes
NOTE
Apply Required: Rules don't take effect until applied.
NOTE
Priority Order: Lower numbers are processed first.
CAUTION
Lock-Out Risk: Always allow admin access before blocking!
Best Practices
- Admin First: Always create allow rule for admin access first
- Specific Before General: Narrow rules before broad blocks
- Meaningful Names: Clear, descriptive rule names
- Document Purpose: Use consistent naming convention
- Test Changes: Verify access after applying
- Backup Access: Have console/IPMI access available
Rule Evaluation Order
1. Enabled rules only
2. Sorted by priority (ascending)
3. First matching rule wins
4. If no match, default policy applies
Common Mistakes
| Mistake | Result | Prevention |
|---|
| Block before allow | Locked out | Lower priority for blocks | |
| No admin allow | Can't access | Priority 1-10 admin rules | |
| Forgot Apply | Rules inactive | Always click Apply | |
| Wrong direction | Not matching | Verify Input vs Output |
8. Troubleshooting Tips
Common Issues
| Symptom | Possible Cause | Solution |
|---|
| Rule not working | Not applied | Click Apply Rules | |
| Blocked traffic | Priority wrong | Check priority order | |
| Can't connect | Locked out | Console access | |
| Service not in list | Disabled service | Enable in Services |
Check Rules
SELECT
name,
action,
direction,
priority,
source_address,
is_enabled
FROM public.firewall_rules
ORDER BY priority;
nftables Commands
# View current rules
nft list ruleset
# View input chain
nft list chain inet filter input
# Flush rules (emergency)
nft flush ruleset
Emergency Recovery
# If locked out via SSH:
# 1. Access server console (IPMI, KVM, physical)
# 2. Disable firewall temporarily
systemctl stop nftables
# 3. Fix rules via admin panel
# 4. Re-enable firewall
systemctl start nftables
---
9. Glossary
| Term | Definition |
|---|
| Rule | Traffic control statement | |
| Action | What to do (accept/drop/reject) | |
| Direction | Traffic flow direction | |
| Priority | Rule evaluation order | |
| nftables | Linux firewall framework | |
| Chain | Rule processing group |
Lua Script Status ℹ️
Security Module
| Component | Status |
|---|
| Firewall Rules | ℹ️ Traffic rules - no Lua handler required |
---
Documentation last updated: January 2026
