X

Lumen help

Creating a firewall rule to allow internet access for networks

Use Lumen® Private Cloud on VMware Cloud Foundation™ to create a firewall rule to allow internet access for networks on your Lumen® Edge Private Cloud service. If you do not have a network to add the rule to, you must configure a network.

To create a firewall rule to allow internet access for networks:

  1. Click Networking.

    The Lumen Private Cloud on VMware Cloud Foundation™ portal shows the Networks screen.
Networking tab.
  1. Click Edge Gateways, then select the edge gateway you want to create the firewall for.

    The edge gateways details page shows.
Edge Gateways
  1. Click Firewall to view a list of firewall rules.
Edge gateway details page.
  1. Click EDIT RULES.

    The Edit Rules window appears.
Edit Rules window.
  1. In the Edit Rules window, click NEW ON TOP, then complete the following fields to configure how a rule applies to a network:

    1. Name—Type a name for the network.

    2. Category—Leave this field as User defined.

    3. State—To enable the firewall rule, turn this option on.

    4. Applications—Click the icon, turn on the Choose a specific application option, select the applications for the rule, then click SAVE.

    5. Context—Click the icon, turn on the Choose a specific profile option, select the context for the rule, then click SAVE.

    6. Source—Click the icon, turn on the Any Source option, then click >KEEP.

    7. Destination—Click the icon, select the destinations for the rule, then click KEEP. To use any destination, turn on the Any Destination option.

    8. Action—Select one of the following options:

      • Allow—Allow traffic matching the rule to pass, but block any traffic that does not match the rule. 

      • Drop—Discard traffic matching the rule without sending a response.

      • Reject—Block traffic matching the rule.

    9. IP Protocol—Select one of the following versions of IP for the firewall rule:

      • IPv4

      • IPv6

      • IPv4 and IPv6
         
    10. Applied To—Select a specific network to apply the rule.

    11. Logging—To enable logging for the firewall rule, turn this option on.

    12. Logging ID—After the rule is created, the firewall rule ID that generates will show.

    13. Comments—Click the icon, type your comments for the rule, then click SAVE.
  1. Click SAVE.

    The Lumen Private Cloud on VMware Cloud Foundation™ creates the firewall rule to allow internet access for the network.
  1. If you want to create a NAT (Network Address Translation) rule, click NAT, then click NEW.
Add NAT Rule window

Note: Take note of the public IP listed under External IP. You need this to create a SNAT (Source Network Address Translator) rule.

  1. In the Add NAT Rule window, complete the following fields:

    1. Name—Type a name for the rule.

    2. Description—Type a description of the rule.

    3. NAT Action—Select one of the following interface types for the rule:

      • DNAT—Use Destination Network Address Translator (DNAT) to translate the destination IP address.

      • SNAT—Use Source Network Address Translator (SNAT) to translate the source IP address.

      • NO DNAT—Prevent translating the external IP address of packets received by an organization VDC (virtual data center) from an external network or from another organization VDC network.

      • NO SNAT—Prevent translating the internal IP address of packets sent from an organization VDC to an external network or to another organization VDC network.

      • REFLEXIVE—Use both DNAT and SNAT depending on ingress or egress traffic.

    4. External IP—This field is not available if you selected NO SNAT for the NAT Action. Type the external IP address as listed on the NAT screen.

    5. External Port—This field is only available if you selected DNAT or NO DNAT for the NAT Action. Type the external port for the rule.

    6. Internal IP—Type the internal IP address for the rule.

    7. Application—This field is only available if you selected DNAT for the NAT Action type. Click the icon, turn on the Choose a specific application option, select the application to use then click SAVE.

    8. Apply to Policy Based VPN—This field is only available if you selected DNAT or NO DNAT for the NAT Action type. Select one of the following options to determine how the traffic is decrypted from a policy‑based IPSec VPN tunnel.

      • Bypass—The NAT rule is not applied.

      • Match—The NAT policy is evaluated and matched on the traffic.
         
    9. Destination IP—This field is only available if you selected SNAT or NO SNAT for the NAT Action type. Type the destination IP address for the traffic.

    10. State—To enable the rule, turn this option on.

    11. Logging—To enable logging for the rule, turn this option on.

    12. Priority—Type the priority of the rule. A lower number signifies priority. For example, 1 is higher than 3. Valid numbers depend on the total number of rules for the edge gateway.

    13. Firewall Match—Select one of the following options to determine how the firewall matches the address during NAT translating if the firewall stage is not skipped:

      • Match Internal Address—Applies the firewall to the internal address of a NAT rule. For SNAT, the internal address is the original source address before NAT is done. For DNAT, the internal address is the translated destination address after NAT is done.

      • Match External Address—Applies the firewall to the external address of a NAT rule. For SNAT, the external address is the translated source address after NAT is done. For DNAT, the external address is the original destination address before NAT is done.

      • Bypass—Firewall stage will be skipped.

    14. Applied To—Select Public‑1.
  1. Click SAVE.

    The Lumen Private Cloud on VMware Cloud Foundation™ creates the NAT rule.