---
title: "Protect your server with the UserGate VE firewall"
sidebar_label: "Protect your server with the UserGate VE firewall"
sidebar_position: 3
description: "How to set up connectivity between the protected server and the firewall, configure interfaces, NAT, and traffic filtering rules"
---
import Formbricks from '@theme/MDXComponents/Formbricks'
import Tabs from '@theme/Tabs'
import TabItem from '@theme/TabItem'
import {TabItemLabel} from '@selectel/docux/components'
# Protect your server with the UserGate VE firewall
1. [Link the firewall server and the protected server](#link-firewall-server-and-protected-server).
2. [Check interfaces](#check-interfaces).
3. [Configure the local interface on the firewall](#configure-local-interface-on-firewall).
4. [Configure the NAT rule](#configure-nat-rule).
5. [Configure filtering rules](#configure-filtering-rules).
## 1. Link the firewall server and the protected server \{#link-firewall-server-and-protected-server}
The organization of connectivity to the protected infrastructure depends on where the firewall is deployed — on a cloud server or on a virtual machine in a VMware-based public or private cloud.
Cloud server
1. If you need to protect a cloud server, Managed Kubernetes cluster, or Managed Database cluster in the same project with a firewall, [add the firewall server to the project's private network](/cloud-servers/cloud-networks/ports.mdx#add-cloud-server-to-subnet-via-port). For different projects in the same pool, [configure access to the private network in different projects](/cloud-servers/cloud-networks/private-networks-and-subnets.mdx#configure-access-to-private-network).
2. If you need to protect a cloud server, a Managed Kubernetes cluster, a Managed Database cluster that is in a different pool, or a dedicated server, a hosted server, or a VMware-based virtual machine in the cloud — use the [Selectel Global Router](/global-router/create-network/create-global-router-network.mdx).
Cloud powered by VMware
1. Optional: if you do not have a private subnet in the data center where the firewall is deployed, or you want to use a new one, [create a new private subnet](/public-cloud/manage-networks/create-network.mdx). When creating a subnet:
* select the first subnet address as the gateway. When entering the **IP range**, exclude the selected gateway address;
* as **Secondary DNS** specify the Selectel DNS server `188.93.16.19`.
2. In the [control panel](https://my.selectel.ru/vmware/dashboard/), on the top menu, click **Products** and select **VMware-based Cloud**.
3. Go to the **Cloud Director** section.
4. Open the virtual data center page → **Virtual Machines** section.
5. Open the virtual machine page.
6. Go to **Hardware** → **NICs**.
7. Click **Edit**.
8. Click **ADD NETWORK TO VAPP**.
9. In the **Type** field, select Routed.
10. In the table, select a private subnet. If you need to protect virtual machines in the same data center with a firewall, you can combine them using a single private network. For different data centers in the same organization, you can use a [shared subnet](/public-cloud/manage-networks/configure-shared-network.mdx).
11. Enter the network name.
12. In the **Gateway CIDR** field, enter the subnet gateway from the **Gateway CIDR** column of the selected subnet.
13. Click **Add**.
14. In the **NIC 1** row, in the **Network** column, select the subnet.
15. In the **NIC 1** row, in the **IP Mode** column, select **Static - Manual**.
16. In the **NIC 1** row, in the **IP** column, enter an IP address from the subnet that is different from the gateway address.
17. If you need to protect a virtual machine in another organization, a cloud server, a cloud database, a dedicated server, hosted hardware, or a Managed Kubernetes cluster — connect them to the firewall via a [global router](/global-router/create-network/create-global-router-network.mdx).
## 2. Check interfaces \{#check-interfaces}
UserGate network interfaces are organized into zones for which security policies are configured. By default, the Internet port is assigned to the `Management` zone. It is used for Internet access and connections from external networks.
After adding the local network interface, check that the Internet port is in the correct zone and reassign it if necessary.
UGOS 6
1. Open the CLI.
2. Perform a software restart of the server.
3. At system boot, select the **Support Menu**.
4. Select **Refresh NIC names** and click **OK**.
5. Wait for the restart to complete.
6. Authorize using the default data:
* login — Admin;
* password — utm.
7. Print the list of interfaces:
```bash
iface list
```
8. Ensure that the Internet port in the `zone` line has the value `Management`.
9. If the value does not match, change the zone for the Internet port:
```bash
iface config -name -zone Management
```
Specify `` as the name of the Internet port.
UGOS 7
1. Open the CLI.
2. Select the **UGOS NGFW (serial console)** mode.
3. Authorize using the default data:
* login — Admin;
* password — leave the field empty.
4. Go to configuration mode:
```bash
configure
```
5. Update the NIC:
```bash
clear network interface-mapping
```
6. Restart the server:
```bash
reboot
```
7. Enter your login and password.
8. Go to configuration mode:
```bash
configure
```
9. Print the list of interfaces:
```bash
show
```
10. Ensure that the Internet port in the `zone` line has the value `Management`.
11. If the value does not match, change the zone for the Internet port:
```bash
set network interface adapter -zone Management
```
Specify `` as the name of the Internet port.
UGOS 7.1 and higher
1. Open the CLI.
2. Select the **UGOS NGFW (serial console)** mode.
3. Authorize using the default data:
* login — Admin;
* password — usergate.
4. Go to configuration mode:
```bash
configure
```
5. Update the NIC:
```bash
clear network interface-mapping
```
6. Restart the server:
```bash
reboot
```
7. Enter your login and password.
8. Go to configuration mode:
```bash
configure
```
9. Print the list of interfaces:
```bash
show
```
10. Ensure that the Internet port in the `zone` line has the value `Management`.
11. If the value does not match, change the zone for the Internet port:
```bash
set network interface adapter -zone Management
```
Specify `` as the Internet port name.
## 3. Configure the local interface on the firewall \{#configure-local-interface-on-firewall}
1. [Connect to the firewall](/firewalls/usergate/connect-to-firewall.mdx).
2. Go to **Settings** → **Network** → **Interfaces**.
3. For the added port1, click **Enable**.
4. Click **Edit**.
5. Open the **General** tab.
6. In the **Zone** field, select Trusted.
7. Open the **Network** tab.
8. In the **Mode** field, select Static.
9. Click **Add**.
10. Enter the IP address of the interface.
11. Optional: change the mask.
12. Click **Save**.
## 4. Configure the NAT rule \{#configure-nat-rule}
1. [Connect to the firewall](/firewalls/usergate/connect-to-firewall.mdx).
2. Go to **Settings** → **Network Policies** → **NAT and Routing**.
3. Click **Add**.
4. Open the **General** tab.
5. Enter the name of the rule.
6. Optional: enter a description for the rule.
7. Select the type — NAT.
8. In the **SNAT IP** field, enter the IP address of the firewall's Internet port to which the source address will be replaced. If the firewall is deployed on a cloud server with a single public address, specify the address from the private network to which the public address is bound.
9. Open the **Source** tab.
10. In the **Source Zone** block, check the **Trusted** checkbox.
11. Optional: add a specific IP address or subnet that can be the source of traffic. In the **Source Address** block, click **Create and add a new object** → **Add**, enter the addresses, and save the object. If you do not add addresses, the rule will apply to traffic from all private networks behind the firewall.
12. Open the **Destination** tab.
13. In the **Destination Zone** block, check the **Management** checkbox.
14. Optional: add a specific IP address or subnet to which traffic can be sent. In the **Destination Address** block, click **Create and add a new object** → **Add**, enter the addresses, and save the object. If you do not add addresses, traffic can be sent to any external networks.
15. Optional: to limit the list of ports for outgoing traffic, add them on the **Service** tab.
16. Click **Save**.
## 5. Configure filtering rules \{#configure-filtering-rules}
1. [Connect to the firewall](/firewalls/usergate/connect-to-firewall.mdx).
2. Go to **Settings** → **Network Policies** → **Firewall section**.
3. Click **Add**.
4. Open the **General** tab.
5. Enter the name of the policy.
6. Optional: enter a description for the policy.
7. Select the action — Allow.
8. Open the **Source** tab.
9. Check the **Trusted** checkbox.
10. Optional: add a specific IP address or subnet that can be the source of traffic. In the **Source Address** block, click **Create and add a new object** → **Add**, enter the addresses, and save the object. If you do not add addresses, the rule will apply to traffic from all private networks behind the firewall.
11. Open the **Destination** tab.
12. In the **Destination Zone** block, check the **Management** checkbox.
13. Optional: add a specific IP address or subnet to which traffic can be sent. In the **Destination Address** block, click **Create and add a new object** → **Add**, enter the addresses, and save the object. If you do not add addresses, traffic can be sent to any external networks.
14. Optional: to limit the list of ports for outgoing traffic, add them on the **Service** tab.
15. Click **Save**.