How to configure firewall and NAT rules

When to use

When you need to allow or block traffic through an Edge, or publish a service at a different address and port. This procedure takes you from reading the current set to applying rules to the router and checking the packet filter log.

Keep the key distinction in mind: editing rules and applying them are separate steps. Adding and removing rules changes only the configuration in vStack Center. Until you click Apply rules, traffic follows the previous set. Always finish a series of edits by applying the rules.

Prerequisites

To read the set, the Cluster master role or any VDC (virtual data center) role: administrators, users, and observers can read the rules of every router in their own VDC;
To edit and apply the set, the Cluster master role or router ownership. A VDC administrator can edit and apply rules only on routers they created;
To apply the set, the router is running: the operation has completed, and internal initialization (bootstrap) is complete;
The router ports are already connected to networks: a rule is bound to a port, and the form selects the port by network name;
vStack Center version 3.0.3.

Steps

Open the router page. In the sidebar tree, expand Virtual Data Centers, select the VDC, go to its Edges section, and open the required router's row. The current sets are in the Firewall rules and NAT rules sections: rule tables with the rule count next to each section heading.

Add a firewall rule. In the Firewall rules section, click Add rule and fill in the fields:

Form field	Required	What it specifies
#	Yes	Rule number, 100–32767. The form fills it in automatically: 100 for the first rule, then the highest number in the set plus 100
Action	Yes	Action: block or pass
Direction	Yes	Direction: in or out
Network	Yes	Router port to which the rule is bound. Selected by network name
Protocol	Yes	Protocol: ICMP, UDP, TCP, or IP
From (CIDR)	Yes	Source in CIDR notation. Default: `0.0.0.0/0`
From Port	Yes	Source port. Default: `0`
Dst. (CIDR)	Yes	Destination in CIDR notation. Default: `0.0.0.0/0`
Dst. Port	Yes	Destination port. Default: `0`
Log	No	Rule logging checkbox. Available only for the block action

Click Save Rule. The rule appears in the section table.

Add a NAT rule. In the NAT rules section, click Add rule. Here, the translation address and port replace the direction and source port:

Form field	What it specifies
#	Rule number. The form fills it in automatically using the same rule as for firewall rules
Action	Action: SNAT, DNAT, or biNAT
Network	Router port to which the rule is bound
Protocol	Protocol: ICMP, UDP, TCP, or IP
From (CIDR)	Source in CIDR notation
Dst. (CIDR)	Destination in CIDR notation
Dst. Port	Destination port
NAT IP	Translation address: a single IPv4 address without a mask
NAT Port	Translation port

Click Save Rule.

Remove rules you no longer need. In the rule row, click the delete icon and confirm with Remove in the Are you sure want to remove firewall rule N? dialog (for NAT, Are you sure want to remove NAT rule N?).

A rule cannot be edited in place: to change it, remove the rule and add a new one with the same number.
Apply the set. The Apply rules button is below the sections on the router page; the same item is available in the Actions menu, both on the page and in the Edges list row.

Application replaces the entire set on the router, rather than adding changes. Apply a series of edits once, after the last edit.

The button and menu item remain disabled while the router is not running, its operation has not completed, or internal initialization after its last start has not finished.

Verify the result

The panel confirms successful application with a notification, and the Rules applied pair in General properties updates to the time when the router accepted the set. State modified appears next to it: if that time is later, the router has restarted since the set was applied.

Then reread the Firewall rules and NAT rules section tables and check that rules with the required numbers are present and removed rules are absent from the set. The columns match the form fields: for firewall rules, Action, Log, Direction, Network, Protocol, From (CIDR), From Port, Dst. (CIDR), and Dst. Port; for NAT, Action, Network, Protocol, From (CIDR), Dst. (CIDR), Dst. Port, NAT IP, and NAT Port.

Packet filter log

If a rule has been added and applied but traffic does not behave as expected, retrieve the packet filter log from the Logs section on the router page. The section appears only if log export is enabled by the feature.edge_log_pcap feature flag in the cluster settings and the role has access to the router. The log contains packets blocked by rules with the Log checkbox enabled.

Set Limit to the number of packets to retrieve.
Set Period to the interval for which you need the log.
Click Get file. A download link appears next to it; use the link to save the PCAP file, then open it in a traffic analyzer. If nothing was found for the interval, the section displays "No data found. Try another params.".

Log limitations:

Limitation	Reason	Workaround
The log is retained for 24 hours	The packet filter keeps only a one-day window on the router	Retrieve the log promptly. A request for an older interval returns an empty file
Exports are capped at 3000 packets	Agent limit: `0` and any value greater than 3000 are converted to 3000	Narrow the interval in Period instead of increasing Limit
The Logs section is missing from the page	Log export is enabled by the `feature.edge_log_pcap` flag in the cluster settings	Request that the flag be enabled at the cluster level

Troubleshooting

The panel displays failures as notifications with text and a code, for example The edge isn't running (error code: -14005). The form highlights fields with invalid values: this is how failures -18032 (From (CIDR)) and -18037 (Dst. (CIDR)) are displayed for a firewall rule.

Editing the set (adding and removing rules):

Failure	Cause	Resolution
`-18018` `Rule number below 100`, `-18019` `Rule number above 32767`	The firewall rule number is outside the allowed range	Use a number in the range 100–32767; the form shows the limits next to #. The same limits apply to removal (`-18318`, `-18319`)
`-17032`, `-17037`, `-18032`, `-18037` `Invalid CIDR value`	The source or destination is not in CIDR notation: `-17032` and `-17037` refer to From (CIDR) and Dst. (CIDR) in a NAT rule; `-18032` and `-18037` refer to the same fields in a firewall rule	Enter the network as `x.x.x.x/n`; use a `/32` mask for a single address
`-18053` `Bad rule_log param value`	Rule logging is set to a value other than 0 or 1	Control logging with the Log checkbox: it is available only for the block action
`-18350` `FW rule N not found for edge`, `-18250` `NAT rule N not found for edge`	The set no longer contains a rule with that number: it was removed from another session	Reread the Firewall rules or NAT rules section table and remove the rule from the current set
`-17050`, `-18050`, `-18220`, `-18320`, `-18510` `Edge id doesn't exist`	The router was not found: the record has already been removed, or the page is outdated	Return to the Edges list, refresh it, and reopen the router
`-18803`, `-17003`, `-18003`, `-18203`, `-18303` `Bad edge_id param value`	The router identifier does not look like a UUID	Open the router from the Edges list instead of using a saved link
`-403` `Access denied`	Another user created the router, and the role has no cluster-level rights	Edit and apply rules as the router owner or with the Cluster master role. Reading the set remains available to all roles in its VDC
`-17091`, `-18091`, `-18240`, `-18340`	Database error	Retry the edit; if the failure recurs, check the cluster database state

Applying the set and retrieving the log:

Failure	Cause	Resolution
`-14005` `The edge isn't running`, `-25005`	The router is stopped, and only a running Edge accepts a rule set	Start the router with the start button next to UUID and retry application
`-14006` `The edge start in progress`, `-25006`	Startup is still in progress	Wait until State shows a running machine
`-14007` `The edge bootstrap has not been completed yet`, `-25007`	The router is running, but internal initialization after the last start has not finished	Wait and retry. Readiness is indicated by the Rules applied pair in General properties: application is available when its time is no earlier than State modified
`-14040` `Edge ID has not found`	The router has no rules	Add at least one rule, then apply the set
`-14010`, `-25010` `Edge id doesn't exist`	The router was not found	Refresh the Edges list and reopen the router
`-25030` `The edge feature has not been enabled`	All Edge functionality is disabled by the overarching `feature.edge` feature flag. This flag is checked before `feature.edge_log_pcap`	Request that the flag be enabled at the cluster level. While it is disabled, reading rule sets is also unavailable
`-25025` `The edge_log_pcap feature has not been enabled`	Log export is disabled by the cluster feature flag	Enable `feature.edge_log_pcap` in the cluster settings
`-25023` `ts_start param value is too low`	The interval starts before January 1, 2023	Move the start of the interval forward in Period: the log is retained for only one day anyway
`-25024` `ts_finish param value is less then ts_start`	The interval ends before it starts	Correct the order of the boundaries in Period
`-32602`	Request parameters failed validation: for example, Limit is outside the range 0–9999	Check the value limits in Limit and Period
`-22` `Bootstrap is not done` and other agent failures	The Edge agent did not accept the set: initialization is incomplete, or the rules failed to load	The failure text is returned unchanged by the agent; use it to investigate. Remove a rule with invalid syntax and add it again
`-14004`, `-25004`	Database error or failure to forward to the agent	Retry the operation; if the failure recurs, check the database and agent state

API methods

The API operations covered on this page are edge-list-rules, edge-add-fw-rule, edge-add-nat-rule, edge-remove-fw-rule, edge-remove-nat-rule, edge-deploy-rules, and edge-get-pfloggs; see the API reference.

When to use​

Prerequisites​

Steps​

Verify the result​

Packet filter log​

Troubleshooting​

See also​

API methods​