Create a firewall rule

1. Add a new rule.
2. Select the behavior and protocol of the rule.
3. Select a Packet Source and Packet Destination.

• Configure rule events and alerts
• Set a schedule for the rule
• Assign a context to the rule
• See policies and computers a rule is assigned to

Add a new rule

• Create a new rule by clicking New → New Firewall Rule.
• Import a rule from an XML file by clicking New → Import From File.
• Copy and then modify an existing rule. To do this, right-click the rule in the Firewall Rules list, and then click Duplicate. To edit the new rule, select it, and then click Properties.

Select the behavior and protocol of the rule

1. Enter a Name and Description for the rule.
   It is good practice to document all firewall rule changes in the Description field of the firewall rule. Make a note of when and why rules were created or deleted for easier firewall maintenance.
2. Select the Action that the rule should perform on packets. You can select from one of five actions. Note that only one rule action is applied to a packet, and rules (of the same priority) are applied in the order of precedence, as follows:
   • The rule can allow traffic to bypass the firewall. A bypass rule allows traffic to pass through the firewall and intrusion prevention engine at the fastest possible rate. Bypass rules are meant for traffic using media intensive protocols where filtering may not be desired or for traffic originating from trusted sources.
     Bypass rules are unidirectional, therefore explicit rules are required for each direction of traffic.
     You can achieve maximum throughput performance on a bypass rule with the following settings:

     • Priority: Highest
     • Frame Type: IP
     • Protocol: TCP, UDP, or other IP protocol. Do not use Any.
     • Source and Destination IP and MAC: All, Any.
     • If the protocol is TCP or UDP and the traffic direction is incoming, the destination ports must be one or more specified ports (not Any), and the source ports must be Any.
     • If the protocol is TCP or UDP and the traffic direction is outgoing, the source ports must be one or more specified ports (not Any), and the destination ports must be Any.
     • Schedule: None.
     For an example of how to create and use a bypass rule for trusted sources in a policy, see Allow trusted traffic to bypass the firewall.
   • The rule can log only. This action makes entries in the logs but does not process traffic.
   • The rule can force allow defined traffic (it allows traffic defined by this rule without excluding any other traffic).
   • The rule can deny traffic (it denies traffic defined by this rule).
   • The rule can allow traffic (it exclusively allows traffic defined by this rule).
   If you do not have allow rules in effect on a computer, all traffic is permitted unless it is specifically blocked by a deny rule. Once you create a single allow rule, all other traffic is blocked unless it meets the requirements of the allow rule. There is one exception to this: ICMPv6 traffic is always permitted unless it is specifically blocked by a deny rule.
3. Select the Priority of the rule. The priority determines the order in which rules are applied. If you select force allow, deny, or bypass as your rule action, you can set a priority of 0 (low) to 4 (highest). Setting a priority allows you to combine the actions of rules to achieve a cascading rule effect.
   Log only rules can only have a priority of 4, and Allow rules can only have a priority of 0.
   High priority rules are applied before low priority rules. For example, a port 80 incoming deny rule with a priority of 3 drops a packet before a port 80 incoming force allow rule with a priority of 2 gets applied to it.
   For details on how actions and priority work together, see Firewall rule actions and priorities.
4. Select a Packet Direction to define whether this rule is to be applied to incoming (from the network to the computer) or outgoing (from the computer to the network) traffic.
   An individual firewall rule only applies to a single-direction of traffic. You may need to create incoming and outgoing firewall rules in pairs for specific types of traffic.
5. Select a User List—This determines which User List this rule applies to traffic. The traffic is filtered based on User Identity. You can use a previously created User List.
   User Name is part of a controlled release and is in preview. The related content is subject to change.
   There is a number of constraints and guidelines to consider when selecting the User List:
   • The protocol must be set to TCP or UDP and the traffic direction must be outgoing.
   • To avoid accidental blocking of critical traffic, you should first select the log only action and check the behavior and user identity match. After that you can change the action to allow or deny.
   • To allow a user, the firewall rule converts outgoing access from permissive to restrictive firewall. Therefore, all users are blocked, except a specific user. For more information, see Restrictive or permissive firewall design.
   • User identities are defined when a new policy is sent to Deep Security Agent. If the user information changes, the configuration must be resent to update the user identities.
   • The User List is supported on Windows and Linux operating systems.
6. Select an Ethernet Frame Type. The term frame refers to Ethernet frames, and the available protocols specify the data that the frame carries. If you select Other as the frame type, you need to specify a frame number.
   IP covers both IPv4 and IPv6. You can also select IPv4 or IPv6 individually.
   On Solaris, agents only examine packets with an IP frame type, and Linux agents only examine packets with IP or ARP frame types. Packets with other frame types are allowed through.
   If you select the IP frame type, you need to select the transport Protocol. If you select Other as the protocol, you also need to enter a protocol number.

Select a packet source and packet destination

• URG
• ACK
• PSH
• RST
• SYN
• FIN

Configure rule events and alerts

Alerts

Set a schedule for the rule

Assign a context to the rule

View policies and computers to which a rule is assigned

Export a rule

Delete a rule