Protect your server with the UserGate VE firewall

Last update: May 30 2026

1. Link the firewall server and the protected server.
2. Check interfaces.
3. Configure the local interface on the firewall.
4. Configure the NAT rule.
5. Configure filtering rules.

1. Link the firewall server and the protected server

The organization of connectivity to the protected infrastructure depends on where the firewall is deployed — on a cloud server or on a virtual machine in a VMware-based public or private cloud.

Cloud server

1. If you need to protect a cloud server, a Managed Kubernetes cluster, or a Managed Database cluster in the same project as the firewall, add the firewall server to the project's private network. For different projects in the same pool, configure access to the private network in different projects.

2. If you need to protect a cloud server, a Managed Kubernetes cluster, a Managed Database cluster that is in a different pool, or a dedicated server, a hosted server, or a VMware-based virtual machine in the cloud — use the Selectel Global Router.

Cloud powered by VMware

1. Optional: if you do not have a private subnet in the data center where the firewall is deployed, or you want to use a new one, create a new private subnet. When creating a subnet:

   • select the first subnet address as the gateway. When entering the IP range, exclude the selected gateway address;
   • as Secondary DNS specify the Selectel DNS server 188.93.16.19.

2. In the control panel, on the top menu, click Products and select VMware-based Cloud.

3. Go to the Cloud Director section.

4. Open the virtual data center page → Virtual Machines section.

5. Open the virtual machine page.

6. Go to Hardware → NICs.

7. Click Edit.

8. Click ADD NETWORK TO VAPP.

9. In the Type field, select Routed.

10. In the table, select a private subnet. If you need to protect virtual machines in the same data center with a firewall, you can combine them using a single private network. For different data centers in the same organization, you can use a shared subnet.

11. Enter the network name.

12. In the Gateway CIDR field, enter the subnet gateway from the Gateway CIDR column of the selected subnet.

13. Click Add.

14. In the NIC 1 row, in the Network column, select the subnet.

15. In the NIC 1 row, in the IP Mode column, select Static - Manual.

16. In the NIC 1 row, in the IP column, enter an IP address from the subnet that is different from the gateway address.

17. If you need to protect a virtual machine in another organization, a cloud server, a cloud database, a dedicated server, hosted hardware, or a Managed Kubernetes cluster — connect them to the firewall via a global router.

2. Check interfaces

UserGate network interfaces are organized into zones for which security policies are configured. By default, the Internet port is assigned to the Management zone. It is used for Internet access and connections from external networks.

After adding the local network interface, check that the Internet port is in the correct zone and reassign it if necessary.

UGOS 6

1. Open the CLI.

2. Perform a software restart of the server.

3. At system boot, select the Support Menu.

4. Select Refresh NIC names and click OK.

5. Wait for the restart to complete.

6. Authorize using the default data:

   • login — Admin;
   • password — utm.

7. Print the list of interfaces:

   iface list

8. Ensure that the Internet port in the zone line has the value Management.

9. If the value does not match, change the zone for the Internet port:

   iface config -name <eth_name> -zone Management

   Specify <eth_name> as the name of the Internet port.

UGOS 7

1. Open the CLI.

2. Select the UGOS NGFW (serial console) mode.

3. Authorize using the default data:

   • login — Admin;
   • password — leave the field empty.

4. Go to configuration mode:

   configure

5. Update the NIC:

   clear network interface-mapping

6. Restart the server:

   reboot

7. Enter your login and password.

8. Go to configuration mode:

   configure

9. Print the list of interfaces:

   show

10. Ensure that the Internet port in the zone line has the value Management.

11. If the value does not match, change the zone for the Internet port:

    set network interface adapter <eth_name> -zone Management

    Specify <eth_name> as the name of the Internet port.

UGOS 7.1 and higher

1. Open the CLI.

2. Select the UGOS NGFW (serial console) mode.

3. Authorize using the default data:

   • login — Admin;
   • password — usergate.

4. Go to configuration mode:

   configure

5. Update the NIC:

   clear network interface-mapping

6. Restart the server:

   reboot

7. Enter your login and password.

8. Go to configuration mode:

   configure

9. Print the list of interfaces:

   show

10. Ensure that the Internet port in the zone line has the value Management.

11. If the value does not match, change the zone for the Internet port:

    set network interface adapter <eth_name> -zone Management

    Specify <eth_name> as the Internet port name.

3. Configure the local interface on the firewall

1. Connect to the firewall.
2. Go to Settings → Network → Interfaces.
3. For the added port1, click Enable.
4. Click Edit.
5. Open the General tab.
6. In the Zone field, select Trusted.
7. Open the Network tab.
8. In the Mode field, select Static.
9. Click Add.
10. Enter the IP address of the interface.
11. Optional: change the mask.
12. Click Save.

4. Configure the NAT rule

1. Connect to the firewall.
2. Go to Settings → Network Policies → NAT and Routing.
3. Click Add.
4. Open the General tab.
5. Enter the name of the rule.
6. Optional: enter a description for the rule.
7. Select the type — NAT.
8. In the SNAT IP field, enter the IP address of the firewall's Internet port to which the source address will be replaced. If the firewall is deployed on a cloud server with a single public address, specify the address from the private network to which the public address is bound.
9. Open the Source tab.
10. In the Source Zone block, check the Trusted checkbox.
11. Optional: add a specific IP address or subnet that can be the source of traffic. In the Source Address block, click Create and add a new object → Add, enter the addresses, and save the object. If you do not add addresses, the rule will apply to traffic from all private networks behind the firewall.
12. Open the Destination tab.
13. In the Destination Zone block, check the Management checkbox.
14. Optional: add a specific IP address or subnet to which traffic can be sent. In the Destination Address block, click Create and add a new object → Add, enter the addresses, and save the object. If you do not add addresses, traffic can be sent to any external network.
15. Optional: to limit the list of ports for outgoing traffic, add them on the Service tab.
16. Click Save.

5. Configure filtering rules

1. Connect to the firewall.
2. Go to Settings → Network Policies → Firewall section.
3. Click Add.
4. Open the General tab.
5. Enter the name of the policy.
6. Optional: enter a description for the policy.
7. Select the action — Allow.
8. Open the Source tab.
9. Check the Trusted checkbox.
10. Optional: add a specific IP address or subnet that can be the source of traffic. In the Source Address block, click Create and add a new object → Add, enter the addresses, and save the object. If you do not add addresses, the rule will apply to traffic from all private networks behind the firewall.
11. Open the Destination tab.
12. In the Destination Zone block, check the Management checkbox.
13. Optional: add a specific IP address or subnet to which traffic can be sent. In the Destination Address block, click Create and add a new object → Add, enter the addresses, and save the object. If you do not add addresses, traffic can be sent to any external network.
14. Optional: to limit the list of ports for outgoing traffic, add them on the Service tab.
15. Click Save.