Menu

Lumen help

Creating a firewall rule to allow internet access for networks

Use Lumen® Edge Private Cloud on VMware Cloud Foundation™ to create a firewall rule to allow internet access for networks. If you do not have a network to add the rule to, you must configure a network.

To create a firewall rule to allow internet access for networks:

  1. Click Networking.

    The Lumen Edge Private Cloud on VMware Cloud Foundation™ portal shows the Networks screen.
Networking tab.
  1. Click Edge Gateways, then select the edge gateway you want to create the firewall for.

    The edge gateway details page appears.
Edge Gateways
  1. Click Firewall.

    The firewall details section appears.
Edge gateway details page.
  1. Click EDIT RULES.

    The Edit Rules window appears.
Edit Rules window.
  1. In the Edit Rules window, click NEW ON TOP, then complete the following fields:
Field Description
Name Type a name for the network.
Category Leave this field as User defined.
State To enable the firewall rule, turn this option on.
Applications Click the icon, turn on the Choose a specific application option, select the applications for the rule, then click SAVE.
Source Click the icon, turn on the Any Source option, then click KEEP.
Destination Click the icon, select the destinations for the rule, then click KEEP. To use any destination, turn on the Any Destination option.
Action

Select one of the following options:
 

  • Allow—Allow traffic matching the rule to pass, but block any traffic that does not match the rule.
  • Drop—Discard traffic matching the rule without sending a response. 
  • Reject—Block traffic matching the rule.
IP Protocol

Select one of the following versions of IP for the firewall rule:
 

  • IPv4
  • IPv6
  • IPv4 and IPv6
Logging To enable logging for the firewall rule, turn this option on.
  1. Click SAVE.

    The Lumen Edge Private Cloud on VMware Cloud Foundation™ creates the firewall rule to allow internet access for the network.
  1. If you want to create a NAT (Network Address Translation) rule, click NAT, and then click NEW.

    The Add NAT Rule window appears.
Add NAT Rule window

Note: You will need to make a note of the public IP that is listed under External IP in order to create a SNAT (Source Network Address Translator) rule.

  1. In the Add NAT Rule window, complete the following fields:
Field Description
Name Type a name for the rule.
Description Type a description for the rule.
Interface Type

Select one of the following interface types for the rule:
 

  • DNAT—Use Destination Network Address Translator (DNAT) to translate the destination IP address.
  • SNAT—Use Source Network Address Translator (SNAT) to translate the source IP address.
  • NO DNAT—Prevent translating the external IP address of packets received by an organization VDC (virtual data center) from an external network or from another organization VDC network.
  • NO SNAT—Prevent translating the internal IP address of packets sent from an organization VDC to an external network or to another organization VDC network.
  • REFLEXIVE—Use both DNAT and SNAT depending on ingress or egress traffic.
External IP This field is not available if you selected NO SNAT for the Interface Type. Type the external IP address as listed on the NAT screen.
External Port This field is only available if you selected DNAT or NO DNAT for the Interface Type. Type the external port for the rule.
Internal IP Type the internal IP address for the rule.
Application This field is only available if you selected DNAT for the Interface Type. Click the icon, turn on the Choose a specific application option, select the application to use, then click SAVE.
Destination IP This field is only available if you selected SNAT or NO SNAT for the Interface Type. Type the destination IP address for the traffic.
State To enable the rule, turn this option on.
Logging

To enable logging for the rule, turn this option on.
Priority

Type the priority of the rule. A lower number signifies priority. For example, 1 is higher than 2. Valid numbers depend on the total number of rules for the edge gateway.
Firewall Match

Select one of the following options to determine how the firewall matches the address during NAT translating if the firewall stage is not skipped:
 

  • Match Internal Address—Applies the firewall to the internal address of a NAT rule. For SNAT, the internal address is the original source address before NAT is done. For DNAT, the internal address is the translated destination address after NAT is done.
  • Match External Address—Applies the firewall to the external address of a NAT rule. For SNAT, the external address is the translated source address after NAT is done. For DNAT, the external address is the original destination address before NAT is done.
  • Bypass—Firewall stage will be skipped.
Applied To Select Public-1.
  1. Click SAVE.

    The Lumen Edge Private Cloud on VMware Cloud Foundation™ creates the NAT rule.