Firewall medium security filter allows only one IP

[Internet]

Hi:

I enabled the firewall with medium security but wanted to add a filter for management (web interface) access for several IP addresses and a dyndns url. I added the dyndns url for my laptop that has always a dynamic IP address. I could access the Quadro management interface from my laptop. That works great!
However I wanted to add more IP addresses to this filter. That doesn't work. Adding another filter doesn't neither.
Am I missing something?
Please help me. Thanks.
Toon

[KSComs]

You add the IP addresses to the group and add the group to the management access and it still doesnt work ?

Thats odd

Kev

[davrays]

Well, I see the problem.. You can put any number of IP addresses in a group ("IP Pool Groups"), and allow/deny access from that group. But you cannot put a URL into the group.
This makes it impossible to specify several URLs to be allowed to access Quadro management... And even you cannot specify one URL + some IP address. If yo have URL specified in the "Management Access", yu cannot add anything more there.

Your only option (workaround) for this now is to configure your URL to have HTTPS access, and the group of IP addresses to have HTTP access. I agree this is not very elegant, but this is the only way for now.

Best regards,
David

P.S. Generally speaking, this "Single URL" option is kind of a new option, which is is actually not very nice to use (as to me), as you never know when you will get access to the Quadro, after your URL changes IP address. This is up to DNS caching, and one cannot guarantee that the caches will refresh quickly enough...

Using IP address in firewall settings is always preferred.

P.S.2. We will consider adding a "Single URL" option into the "IP Pool Groups" table, but I cannot give you any dates. This was not done mainly because the IP Groups are used in various places in the "Filtering Rules", including some pages, where the "Single URL" option cannot be used by technical reasons. Most probably we will allow now to add URL into a IP Group, but prohibit to use that group in the table where URL cannot be configured, for example in "Incoming Traffic / Port Forwarding", "Outgoing Traffic", "Blocked IP List", "Allowed IP List" and "Restricting IPSec" tables.

[Internet]

David:

Thanks a lot for your help.
I should have first desribed the customer needs and the var needs regarding remote access to Quadro management.
For a VAR tech person who is always on the road and who has a laptop that has only a dynamic IP address, a DYNDNS url is a must.
For the IT person of a small business, remote access to the quadro will be needed via an office server that has a static IP address. He may have a VPN. He will access remotely the office server, and from the webbrowser on the office server access the Quadro.
Some other customer employees may want to access the quadro management also to change their extension settings incl call settings.
So, there is a need to enable the entry of a DYNDNS url and of one or more static routable IP addresses of office servers. All this is for HTTP.
I hope this clarifies the needs.
Thanks for your great contributions to the forum.
Lots of very interesting posts.
Toon

[davrays]

I see, Toon. We'll try to fit this into the first public 5.2 release. I would expect it in 1.5-2 months...

BTW, using a roadwarrier VPN to a Quadro (or to a server behind the Quadro) could still be a very good workaround. And it will be more secure as you don't send the login/password in open form through the internet.

Best regards,
David

[howardjjjj]

The firewall adds security and this will cause some privileges to be limited. You might want to configure them manually even the firewall is one. I think that will solve the