ControlOne: Firewall rules

Topic

This article discusses how to create and manage firewall rules in ControlOne. 

Environment

• Cytracom ControlOne

Description

ControlOne automatically creates rules allowing full bidirectional communication between connected zones. When you connect zones to each other, you do not need to create any firewall rules to allow access. However, you can use firewall rules if you want to limit the traffic based on source/destination IP addresses, Fully Qualified Domain Names (FQDN), service ports, TCP/UDP/ICMP protocols, or geographic regions.

Why Would You Need FWaaS (Firewall as a Service)?

• Granular Traffic Control: Restrict traffic based on IP addresses, FQDNs, country locations, ports, or protocols to enforce security policies.

• East/West Protection: Secure communication between zones within your network to prevent lateral movement of threats.

• Regulatory Compliance: Enforce location-based restrictions to comply with data sovereignty and privacy regulations.

• Improved Security Posture: Block traffic from high-risk countries or disallowed services to reduce exposure to threats.

• Custom Use Cases: Enable bespoke traffic controls for unique operational requirements.

How to Create and Manage Firewall Rules in ControlOne

Important Considerations

Core Concepts: Understanding Inbound Traffic and Stateful Inspection

When configuring your network, it is important to understand how our firewall handles traffic coming from the outside world. Like all modern Stateful Packet Inspection (SPI) firewalls, our system is designed with security as the top priority.

Here are a few foundational principles to keep in mind:

• The Default "Deny" Posture: By default, the firewall blocks all unsolicited inbound connections from the public Internet. If traffic tries to enter your network without being explicitly requested by a device inside the network, the firewall will drop it.

• Firewall Rules Are Not Enough for Inbound Traffic: A common misconception is that simply creating an "Allow" Firewall Rule for inbound traffic will let that traffic through. This is not the case. While a Firewall Rule would prevent the traffic from being blocked, outright, the firewall still doesn't know which specific internal device should receive it.

• The Requirement for Outside-to-Inside Mapping: To successfully allow unsolicited inbound traffic (like hosting a local web server or allowing external RDP access), you must tell the firewall exactly where to send that traffic once it arrives. This requires either Port Forwarding (Inbound NAT) or placing the device in a DMZ.

How to Properly Route Inbound Traffic

If you have a legitimate need to expose an internal resource to the public Internet, you will need to configure the following:

1. Port Forwarding (Inbound NAT): This acts as a map for the firewall. It translates the public-facing IP address and port to the specific private IP address and port of your internal device.

2. DMZ (Demilitarized Zone): For devices that need completely unrestricted access to and from the Internet (which should be used rarely and with caution), placing them in a DMZ isolates them from your secure internal network while mapping public traffic directly to them.

NOTE: See ControlOne: Port Forwarding & Outbound 1:1 NAT Rule

In Summary: A Firewall Rule acts as the security guard checking IDs at the door, but Port Forwarding provides the actual directions to the right room. You need both to successfully route external traffic to an internal device.

• ControlOne automatically creates the proper firewall rules when you connect zones on the network map.
• Firewall rules created through this procedure will apply globally at the Tenant level. For this reason, rules allowing "any source IP to any destination IP over any protocol and any port" are not permitted, as they would compromise network protections.
• ControlOne uses network validation. If you specify invalid IP addresses or FQDNs during rule creation, the system will return an error.
• An explicit Allow Any/Any rule is created by ControlOne at the end of the rule stack to enable zone communication.
• Firewall rules are created on the Cloud Gateway Firewall and can inspect and filter any traffic flowing through it, including internet-bound or East/West traffic.

Navigating to the Firewalls Page

1. In the ControlOne Portal, click the Firewall link in the Navigation menu.

Creating a Rule

1. On the Firewalls page, click Add Rule in the upper-right portion of the window. A configuration window will open.

2. Configure the rule in the following sections:

   New Firewall Rule: Specify the rule name, select the protocol, and add a description.

   Source:

   • Source IP: Select the source IP address, network address, or FQDN to match inbound or outbound traffic. 

   • Source Port: Specify a single port, port range, multiple ports (separated by commas), or Any.

   • Source Country: Use the country-based blocking option to restrict or allow traffic from specific geographic locations.

   Destination:

   • Destination IP: Select the destination IP address, network address, or FQDN to match destination traffic. 

   • Destination Port: Specify a single port, port range, multiple ports (separated by commas), or Any.

   • Destination Country: Use the country-based blocking option to restrict or allow traffic to specific geographic locations.

   Action:

   • Specify Allow or Deny for the traffic that matches your source and destination criteria. If you allow the traffic, use the Default Security Policy drop-down menu to select the appropriate Security Policy for this rule.

3. Click Save to apply the rule.

To edit any rule you have created you simply click the rule from the main Firewall menu item.  This will pull up a dialog that will let you edit the same fields you used to build the rule.

Best Practices for Using FWaaS

1. Start with Least Privilege: Define the most restrictive rules possible and expand only as needed.

2. Use FQDNs for Dynamic Targets: When managing dynamic or cloud-based services, use FQDNs instead of IPs to ensure flexibility.

3. Enable Country-Based Blocking for High-Risk Regions: Use geographic restrictions to block or allow traffic based on location.

4. Review and Audit Regularly: Periodically review rules to ensure they align with current operational and security requirements.

5. Document Rule Changes: Maintain a log of rule additions, modifications, and deletions for accountability and troubleshooting.

6. Test Rules in a Staging Environment: Validate new rules in a test environment before applying them to production.

By leveraging ControlOne’s enhanced FWaaS capabilities, including FQDN and country-based blocking, you can implement more effective and granular network security controls tailored to your specific needs.