7.4. Firewall profiles

In Chapter 5, Firewall integration, it was described how to prepare the firewall for eurephia. Two firewall destinations were prepared for eurephia in the examples. This chapter will build on those examples and also assign firewall profiles to the user accesses created in Section 7.3, “Registering user accesses”

The eurephiadm fwprofiles command is used to configure the firewall access profiles.

user@host:~ $ eurephiadm fwprofiles --help
Available modes for the fwprofiles command are:

     -A | --add          Add a new firewall profile
     -D | --delete       Delete a firewall profile
     -l | --list         List available firewall profiles
     -h | --help <mode>  Show help
user@host:~ $

7.4.1. Registering firewall access profiles

First, lets have a look at the help screen for the add mode.

user@host:~ $ eurephiadm fwprofiles --help --add
The fwprofiles add mode will register a new firewall profile.

     -d | --description    <text> Description of the firewall destination/rule
     -f | --fw-destination <name> The reference used by the firewall module
user@host:~ $

In the previous examples in Chapter 5, Firewall integration, the firewall destinations vpn_intranet and vpn_all_srv were prepared in the OS firewall. At the moment, eurephia does not know about these destinations at all, so lets register them.

user@host:~ $ eurephiadm fwprofiles --add --description "Access to only Intranet server" --fw-destination vpn_intranet
eurephia::fwProfiles: Firewall profile registered with id 1
user@host:~ $ eurephiadm fwprofiles --add --description "Access to all network servers" --fw-destination vpn_all_srv
eurephia::fwProfiles: Firewall profile registered with id 2
user@host:~ $ eurephiadm fwprofiles --list
   ID Firewall profile       Description                                Users
 ------------------------------------------------------------------------------
    1 vpn_intranet           Access to only Intranet server                 0
    2 vpn_all_srv            Access to all network servers                  0
 ------------------------------------------------------------------------------
user@host:~ $